Dangerzone Security Dashboard
- Target
- ghcr.io/freedomofpress/dangerzone/v1:latest
- Date
- 2026-07-20T03:07:04.707186135Z
Critical
13
High
70
Medium
160
Low
21
Unknown
37
| Name | Version | Type | Vulnerability | Severity | State | Fixed In | Description | Related URLs | PURL |
|---|---|---|---|---|---|---|---|---|---|
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-11856 | Critical | wont-fix | N/A | Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-9079 | Critical | wont-fix | N/A | libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-11856 | Critical | wont-fix | N/A | Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-9079 | Critical | wont-fix | N/A | libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libpoppler147 | 25.03.0-5+deb13u3 | deb | CVE-2019-9543 | Low | wont-fix | N/A | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit. | [] | pkg:deb/debian/libpoppler147@25.03.0-5%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=poppler |
| libexpat1 | 2.7.1-2 | deb | CVE-2025-59375 | High | wont-fix | N/A | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-10536 | Critical | wont-fix | N/A | A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-10536 | Critical | wont-fix | N/A | A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libtasn1-6 | 4.20.0-2 | deb | CVE-2025-13151 | High | fixed |
|
Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string. | [] | pkg:deb/debian/libtasn1-6@4.20.0-2?arch=amd64&distro=debian-13.5 |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-8927 | Critical | wont-fix | N/A | When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-8927 | Critical | wont-fix | N/A | When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-8924 | Critical | wont-fix | N/A | A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-8924 | Critical | wont-fix | N/A | A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-8926 | Critical | wont-fix | N/A | When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username(without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-8926 | Critical | wont-fix | N/A | When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username(without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcairo2 | 1.18.4-1+b1 | deb | CVE-2017-7475 | Low | wont-fix | N/A | Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash. | [] | pkg:deb/debian/libcairo2@1.18.4-1%2Bb1?arch=amd64&distro=debian-13.5&upstream=cairo%401.18.4-1 |
| libpoppler147 | 25.03.0-5+deb13u3 | deb | CVE-2019-9545 | Low | wont-fix | N/A | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero. | [] | pkg:deb/debian/libpoppler147@25.03.0-5%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=poppler |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-3805 | High | fixed |
|
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-3805 | High | fixed |
|
When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libopenjp2-7 | 2.5.3-2.1~deb13u2 | deb | CVE-2019-6988 | Low | wont-fix | N/A | An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress. | [] | pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.5&upstream=openjpeg2 |
| libpython3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u2 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| python3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-12064 | High | wont-fix | N/A | When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-12064 | High | wont-fix | N/A | When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-5773 | High | fixed |
|
libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-5773 | High | fixed |
|
libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | deb | CVE-2026-0990 | Medium | fixed |
|
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications. | [] | pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-8286 | High | wont-fix | N/A | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-8286 | High | wont-fix | N/A | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libpython3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-7774 | Medium | fixed |
|
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-7774 | Medium | fixed |
|
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u2 | deb | CVE-2026-7774 | Medium | fixed |
|
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-7774 | Medium | fixed |
|
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| python3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-7774 | Medium | fixed |
|
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-9080 | High | wont-fix | N/A | Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-9080 | High | wont-fix | N/A | Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-25556 | High | wont-fix | N/A | MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-25556 | High | wont-fix | N/A | MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=mupdf |
| libavahi-client3 | 0.8-16 | deb | CVE-2024-52616 | Medium | wont-fix | N/A | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2024-52616 | Medium | wont-fix | N/A | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2024-52616 | Medium | wont-fix | N/A | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2025-14819 | Medium | fixed |
|
When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2025-14819 | Medium | fixed |
|
When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-6253 | Medium | fixed |
|
curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-6253 | Medium | fixed |
|
curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libpython3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-9669 | High | fixed |
|
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-9669 | High | fixed |
|
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u2 | deb | CVE-2026-9669 | High | fixed |
|
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-9669 | High | fixed |
|
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| python3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-9669 | High | fixed |
|
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u2 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| python3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | deb | CVE-2026-6653 | Critical | wont-fix | N/A | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling. | [] | pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| libjbig2dec0 | 0.20-1+b3 | deb | CVE-2026-38076 | High | not-fixed | N/A | An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [] | pkg:deb/debian/libjbig2dec0@0.20-1%2Bb3?arch=amd64&distro=debian-13.5&upstream=jbig2dec%400.20-1 |
| dirmngr | 2.4.7-21+deb13u1+b3 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/dirmngr@2.4.7-21%2Bdeb13u1%2Bb3?arch=amd64&distro=debian-13.5&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gnupg | 2.4.7-21+deb13u1 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gnupg@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.5&upstream=gnupg2 |
| gnupg-l10n | 2.4.7-21+deb13u1 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gnupg-l10n@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.5&upstream=gnupg2 |
| gpg | 2.4.7-21+deb13u1+b3 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gpg@2.4.7-21%2Bdeb13u1%2Bb3?arch=amd64&distro=debian-13.5&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpg-agent | 2.4.7-21+deb13u1+b3 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gpg-agent@2.4.7-21%2Bdeb13u1%2Bb3?arch=amd64&distro=debian-13.5&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpgconf | 2.4.7-21+deb13u1+b3 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gpgconf@2.4.7-21%2Bdeb13u1%2Bb3?arch=amd64&distro=debian-13.5&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpgsm | 2.4.7-21+deb13u1+b3 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gpgsm@2.4.7-21%2Bdeb13u1%2Bb3?arch=amd64&distro=debian-13.5&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| libopenjp2-7 | 2.5.3-2.1~deb13u2 | deb | CVE-2023-39329 | Medium | wont-fix | N/A | A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service. | [] | pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.5&upstream=openjpeg2 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-45186 | High | not-fixed | N/A | In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libncursesw6 | 6.5+20250216-2 | deb | CVE-2025-69720 | High | wont-fix | N/A | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | [] | pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64&distro=debian-13.5&upstream=ncurses |
| libtinfo6 | 6.5+20250216-2 | deb | CVE-2025-69720 | High | wont-fix | N/A | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | [] | pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64&distro=debian-13.5&upstream=ncurses |
| ncurses-base | 6.5+20250216-2 | deb | CVE-2025-69720 | High | wont-fix | N/A | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | [] | pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all&distro=debian-13.5&upstream=ncurses |
| ncurses-bin | 6.5+20250216-2 | deb | CVE-2025-69720 | High | wont-fix | N/A | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | [] | pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64&distro=debian-13.5&upstream=ncurses |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2025-14524 | Medium | fixed |
|
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2025-14524 | Medium | fixed |
|
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58015 | High | wont-fix | N/A | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.5&upstream=glib2.0 |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-8458 | Medium | wont-fix | N/A | libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-8458 | Medium | wont-fix | N/A | libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-9545 | High | wont-fix | N/A | In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-9545 | High | wont-fix | N/A | In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libpython3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-1502 | Medium | fixed |
|
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-1502 | Medium | fixed |
|
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u2 | deb | CVE-2026-1502 | Medium | fixed |
|
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-1502 | Medium | fixed |
|
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| python3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-1502 | Medium | fixed |
|
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-41080 | High | wont-fix | N/A | libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-55780 | High | wont-fix | N/A | A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-55780 | High | wont-fix | N/A | A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=mupdf |
| libavahi-client3 | 0.8-16 | deb | CVE-2024-52615 | Medium | wont-fix | N/A | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2024-52615 | Medium | wont-fix | N/A | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2024-52615 | Medium | wont-fix | N/A | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libpython3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-3276 | Medium | fixed |
|
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-3276 | Medium | fixed |
|
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u2 | deb | CVE-2026-3276 | Medium | fixed |
|
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-3276 | Medium | fixed |
|
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| python3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-3276 | Medium | fixed |
|
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-5928 | High | wont-fix | N/A | Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets. | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=glibc |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-5928 | High | wont-fix | N/A | Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets. | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=glibc |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-8932 | High | wont-fix | N/A | libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-8932 | High | wont-fix | N/A | libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-6429 | Medium | fixed |
|
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-6429 | Medium | fixed |
|
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libpython3.13 | 3.13.5-2+deb13u2 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u2 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u2 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| python3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-8328 | Medium | fixed |
|
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-8328 | Medium | fixed |
|
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u2 | deb | CVE-2026-8328 | Medium | fixed |
|
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-8328 | Medium | fixed |
|
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| python3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-8328 | Medium | fixed |
|
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58013 | High | wont-fix | N/A | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.5&upstream=glib2.0 |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58011 | High | wont-fix | N/A | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.5&upstream=glib2.0 |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58012 | High | wont-fix | N/A | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.5&upstream=glib2.0 |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58010 | High | wont-fix | N/A | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.5&upstream=glib2.0 |
| libopenjp2-7 | 2.5.3-2.1~deb13u2 | deb | CVE-2023-39327 | Medium | wont-fix | N/A | A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal. | [] | pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.5&upstream=openjpeg2 |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-7168 | Medium | fixed |
|
Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-7168 | Medium | fixed |
|
Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-5545 | Medium | fixed |
|
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1... | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-5545 | Medium | fixed |
|
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1... | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58014 | High | wont-fix | N/A | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.5&upstream=glib2.0 |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-71382 | High | wont-fix | N/A | MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-71382 | High | wont-fix | N/A | MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=mupdf |
| tar | 1.35+dfsg-3.1 | deb | CVE-2026-5704 | Medium | wont-fix | N/A | A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection. | [] | pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=amd64&distro=debian-13.5 |
| bsdutils | 1:2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 |
| libblkid1 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| libmount1 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| libuuid1 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 |
| mount | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| util-linux | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.5 |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-46206 | Medium | wont-fix | N/A | An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-46206 | Medium | wont-fix | N/A | An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=mupdf |
| gzip | 1.13-1 | deb | CVE-2026-41992 | High | wont-fix | N/A | GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer. This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681 | [] | pkg:deb/debian/gzip@1.13-1?arch=amd64&distro=debian-13.5 |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-6276 | High | fixed |
|
Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-6276 | High | fixed |
|
Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-6238 | Medium | wont-fix | N/A | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions. | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=glibc |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-6238 | Medium | wont-fix | N/A | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions. | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=glibc |
| libavahi-client3 | 0.8-16 | deb | CVE-2025-68471 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2025-68471 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2025-68471 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libpam-modules | 1.7.0-5 | deb | CVE-2026-54411 | Medium | wont-fix | N/A | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext. | [] | pkg:deb/debian/libpam-modules@1.7.0-5?arch=amd64&distro=debian-13.5&upstream=pam |
| libpam-modules-bin | 1.7.0-5 | deb | CVE-2026-54411 | Medium | wont-fix | N/A | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext. | [] | pkg:deb/debian/libpam-modules-bin@1.7.0-5?arch=amd64&distro=debian-13.5&upstream=pam |
| libpam-runtime | 1.7.0-5 | deb | CVE-2026-54411 | Medium | wont-fix | N/A | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext. | [] | pkg:deb/debian/libpam-runtime@1.7.0-5?arch=all&distro=debian-13.5&upstream=pam |
| libpam0g | 1.7.0-5 | deb | CVE-2026-54411 | Medium | wont-fix | N/A | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext. | [] | pkg:deb/debian/libpam0g@1.7.0-5?arch=amd64&distro=debian-13.5&upstream=pam |
| libpython3.13 | 3.13.5-2+deb13u2 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u2 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u2 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| python3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libnss3 | 2:3.110-1+deb13u2 | deb | CVE-2026-12318 | High | fixed |
|
Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | [] | pkg:deb/debian/libnss3@2%3A3.110-1%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=nss |
| libavahi-client3 | 0.8-16 | deb | CVE-2025-68468 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2025-68468 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2025-68468 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| liblzma5 | 5.8.1-1 | deb | CVE-2026-34743 | Medium | fixed |
|
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3. | [] | pkg:deb/debian/liblzma5@5.8.1-1?arch=amd64&distro=debian-13.5&upstream=xz-utils |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-4873 | Medium | fixed |
|
A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-4873 | Medium | fixed |
|
A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-5435 | High | wont-fix | N/A | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=glibc |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-5435 | High | wont-fix | N/A | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=glibc |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-3784 | Medium | fixed |
|
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-3784 | Medium | fixed |
|
curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libpython3.13 | 3.13.5-2+deb13u2 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u2 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u2 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| python3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-3783 | Medium | fixed |
|
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-3783 | Medium | fixed |
|
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libtiff6 | 4.7.0-3+deb13u2 | deb | CVE-2026-12912 | High | not-fixed | N/A | A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS). | [] | pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=tiff |
| libcurl3t64-gnutls | 8.14.1-2+deb13u3 | deb | CVE-2026-1965 | Medium | fixed |
|
libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API). | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u3 | deb | CVE-2026-1965 | Medium | fixed |
|
libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates *connections* and not *requests*, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API). | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=curl |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-25210 | High | wont-fix | N/A | In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libavahi-client3 | 0.8-16 | deb | CVE-2026-24401 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2026-24401 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2026-24401 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | deb | CVE-2026-0989 | Low | fixed |
|
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk. | [] | pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-7233 | Medium | wont-fix | N/A | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-7233 | Medium | wont-fix | N/A | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=mupdf |
| login.defs | 1:4.17.4-2 | deb | CVE-2024-56433 | Low | wont-fix | N/A | shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid. | [] | pkg:deb/debian/login.defs@1%3A4.17.4-2?arch=all&distro=debian-13.5&upstream=shadow |
| passwd | 1:4.17.4-2 | deb | CVE-2024-56433 | Low | wont-fix | N/A | shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid. | [] | pkg:deb/debian/passwd@1%3A4.17.4-2?arch=amd64&distro=debian-13.5&upstream=shadow |
| libopenjp2-7 | 2.5.3-2.1~deb13u2 | deb | CVE-2023-39328 | Medium | wont-fix | N/A | A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file. | [] | pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.5&upstream=openjpeg2 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-50219 | Medium | not-fixed | N/A | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libnghttp2-14 | 1.64.0-1.1+deb13u1 | deb | CVE-2026-58055 | Medium | wont-fix | N/A | nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning. | [] | pkg:deb/debian/libnghttp2-14@1.64.0-1.1%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=nghttp2 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-32777 | Medium | wont-fix | N/A | libexpat before 2.7.5 allows an infinite loop while parsing DTD content. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | deb | CVE-2026-1757 | Medium | fixed |
|
A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system. | [] | pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| zlib1g | 1:1.3.dfsg+really1.3.1-1+b1 | deb | CVE-2026-27171 | Medium | wont-fix | N/A | zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition. | [] | pkg:deb/debian/zlib1g@1%3A1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64&distro=debian-13.5&upstream=zlib%401%3A1.3.dfsg%2Breally1.3.1-1 |
| libavahi-client3 | 0.8-16 | deb | CVE-2026-34933 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2026-34933 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2026-34933 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libacl1 | 2.3.2-2+b1 | deb | CVE-2026-54369 | High | wont-fix | N/A | acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation. | [] | pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64&distro=debian-13.5&upstream=acl%402.3.2-2 |
| libexpat1 | 2.7.1-2 | deb | CVE-2025-66382 | Medium | wont-fix | N/A | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | deb | CVE-2026-0992 | Low | fixed |
|
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition. | [] | pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-32778 | Medium | wont-fix | N/A | libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-32776 | Medium | wont-fix | N/A | libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libxslt1.1 | 1.1.35-1.2+deb13u3 | deb | CVE-2025-10911 | Medium | wont-fix | N/A | A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. | [] | pkg:deb/debian/libxslt1.1@1.1.35-1.2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=libxslt |
| libgraphite2-3 | 1.3.14-2+b1 | deb | CVE-2026-50593 | High | fixed |
|
Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range. | [] | pkg:deb/debian/libgraphite2-3@1.3.14-2%2Bb1?arch=amd64&distro=debian-13.5&upstream=graphite2%401.3.14-2 |
| libavahi-client3 | 0.8-16 | deb | CVE-2025-59529 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2025-59529 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2025-59529 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-40505 | Medium | wont-fix | N/A | MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-40505 | Medium | wont-fix | N/A | MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.5&upstream=mupdf |
| libncursesw6 | 6.5+20250216-2 | deb | CVE-2025-6141 | Medium | wont-fix | N/A | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | [] | pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64&distro=debian-13.5&upstream=ncurses |
| libtinfo6 | 6.5+20250216-2 | deb | CVE-2025-6141 | Medium | wont-fix | N/A | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | [] | pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64&distro=debian-13.5&upstream=ncurses |
| ncurses-base | 6.5+20250216-2 | deb | CVE-2025-6141 | Medium | wont-fix | N/A | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | [] | pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all&distro=debian-13.5&upstream=ncurses |
| ncurses-bin | 6.5+20250216-2 | deb | CVE-2025-6141 | Medium | wont-fix | N/A | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | [] | pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64&distro=debian-13.5&upstream=ncurses |
| libxslt1.1 | 1.1.35-1.2+deb13u3 | deb | CVE-2025-11731 | Low | wont-fix | N/A | A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service. | [] | pkg:deb/debian/libxslt1.1@1.1.35-1.2%2Bdeb13u3?arch=amd64&distro=debian-13.5&upstream=libxslt |
| libattr1 | 1:2.5.2-3 | deb | CVE-2026-54371 | Medium | wont-fix | N/A | attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path. | [] | pkg:deb/debian/libattr1@1%3A2.5.2-3?arch=amd64&distro=debian-13.5&upstream=attr |
| libp11-kit0 | 0.25.5-3 | deb | CVE-2026-13757 | Medium | wont-fix | N/A | A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services. | [] | pkg:deb/debian/libp11-kit0@0.25.5-3?arch=amd64&distro=debian-13.5&upstream=p11-kit |
| libavahi-client3 | 0.8-16 | deb | CVE-2025-68276 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2025-68276 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2025-68276 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.5&upstream=avahi |
| libacl1 | 2.3.2-2+b1 | deb | CVE-2026-54370 | High | wont-fix | N/A | acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation. | [] | pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64&distro=debian-13.5&upstream=acl%402.3.2-2 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56131 | Medium | not-fixed | N/A | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56410 | Medium | not-fixed | N/A | xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56411 | Medium | not-fixed | N/A | xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56132 | Medium | not-fixed | N/A | In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libcairo2 | 1.18.4-1+b1 | deb | CVE-2025-50422 | Low | wont-fix | N/A | Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c. | [] | pkg:deb/debian/libcairo2@1.18.4-1%2Bb1?arch=amd64&distro=debian-13.5&upstream=cairo%401.18.4-1 |
| libbz2-1.0 | 1.0.8-6 | deb | CVE-2026-42250 | Medium | wont-fix | N/A | bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67 | [] | pkg:deb/debian/libbz2-1.0@1.0.8-6?arch=amd64&distro=debian-13.5&upstream=bzip2 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56403 | Medium | not-fixed | N/A | libexpat before 2.8.2 has an integer overflow in storeAtts. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56405 | Medium | not-fixed | N/A | libexpat before 2.8.2 has an integer overflow in getAttributeId. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56408 | Medium | not-fixed | N/A | libexpat before 2.8.2 has an integer overflow in copyString. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56404 | Medium | not-fixed | N/A | libexpat before 2.8.2 has an integer overflow in addBinding. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56406 | Medium | not-fixed | N/A | libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56407 | Medium | not-fixed | N/A | libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libpython3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u2 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u2 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| python3.13-minimal | 3.13.5-2+deb13u2 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=python3.13 |
| bsdutils | 1:2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 |
| libblkid1 | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| libmount1 | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| libuuid1 | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 |
| mount | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| util-linux | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.5 |
| bsdutils | 1:2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 |
| libblkid1 | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| libmount1 | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| libuuid1 | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 |
| mount | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux |
| util-linux | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.5 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56412 | Medium | not-fixed | N/A | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56409 | Medium | not-fixed | N/A | xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| libsystemd0 | 257.13-1~deb13u1 | deb | CVE-2026-40228 | Low | wont-fix | N/A | In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set. | [] | pkg:deb/debian/libsystemd0@257.13-1~deb13u1?arch=amd64&distro=debian-13.5&upstream=systemd |
| libudev1 | 257.13-1~deb13u1 | deb | CVE-2026-40228 | Low | wont-fix | N/A | In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set. | [] | pkg:deb/debian/libudev1@257.13-1~deb13u1?arch=amd64&distro=debian-13.5&upstream=systemd |
| gzip | 1.13-1 | deb | CVE-2026-41991 | Medium | wont-fix | N/A | GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 | [] | pkg:deb/debian/gzip@1.13-1?arch=amd64&distro=debian-13.5 |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | deb | CVE-2025-8732 | Low | fixed |
|
A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all." | [] | pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u2?arch=amd64&distro=debian-13.5 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-24515 | Low | wont-fix | N/A | In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.5&upstream=expat |
| dirmngr | 2.4.7-21+deb13u1+b3 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/dirmngr@2.4.7-21%2Bdeb13u1%2Bb3?arch=amd64&distro=debian-13.5&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gnupg | 2.4.7-21+deb13u1 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gnupg@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.5&upstream=gnupg2 |
| gnupg-l10n | 2.4.7-21+deb13u1 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gnupg-l10n@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.5&upstream=gnupg2 |
| gpg | 2.4.7-21+deb13u1+b3 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gpg@2.4.7-21%2Bdeb13u1%2Bb3?arch=amd64&distro=debian-13.5&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpg-agent | 2.4.7-21+deb13u1+b3 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gpg-agent@2.4.7-21%2Bdeb13u1%2Bb3?arch=amd64&distro=debian-13.5&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpgconf | 2.4.7-21+deb13u1+b3 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gpgconf@2.4.7-21%2Bdeb13u1%2Bb3?arch=amd64&distro=debian-13.5&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpgsm | 2.4.7-21+deb13u1+b3 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gpgsm@2.4.7-21%2Bdeb13u1%2Bb3?arch=amd64&distro=debian-13.5&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| bsdutils | 1:2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 | |
| bsdutils | 1:2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 | |
| bsdutils | 1:2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 | |
| bsdutils | 1:2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 | |
| libblkid1 | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libblkid1 | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libblkid1 | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libblkid1 | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libtiff6 | 4.7.0-3+deb13u2 | deb | CVE-2026-36849 | Unknown | wont-fix | N/A | [] | pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u2?arch=amd64&distro=debian-13.5&upstream=tiff | |
| libuuid1 | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libuuid1 | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libuuid1 | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| libuuid1 | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux%402.41-5 | |
| mount | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| mount | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| mount | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| mount | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.5&upstream=util-linux | |
| util-linux | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.5 | |
| util-linux | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.5 | |
| util-linux | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.5 | |
| util-linux | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.5 |
You can always download 💾 the full Grype report in JSON format.