Dangerzone Security Dashboard
- Target
- ghcr.io/freedomofpress/dangerzone/v1:20260720-v1.0.0-20-ga3a91f4
- Date
- 2026-07-20T03:06:20.728525263Z
Critical
13
High
56
Medium
117
Low
18
Unknown
37
| Name | Version | Type | Vulnerability | Severity | State | Fixed In | Description | Related URLs | PURL |
|---|---|---|---|---|---|---|---|---|---|
| libcurl3t64-gnutls | 8.14.1-2+deb13u4 | deb | CVE-2026-11856 | Critical | wont-fix | N/A | Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u4 | deb | CVE-2026-9079 | Critical | wont-fix | N/A | libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u4 | deb | CVE-2026-11856 | Critical | wont-fix | N/A | Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u4 | deb | CVE-2026-9079 | Critical | wont-fix | N/A | libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libpoppler147 | 25.03.0-5+deb13u4 | deb | CVE-2019-9543 | Low | wont-fix | N/A | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit. | [] | pkg:deb/debian/libpoppler147@25.03.0-5%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=poppler |
| libexpat1 | 2.7.1-2 | deb | CVE-2025-59375 | High | wont-fix | N/A | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libcurl3t64-gnutls | 8.14.1-2+deb13u4 | deb | CVE-2026-10536 | Critical | wont-fix | N/A | A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u4 | deb | CVE-2026-10536 | Critical | wont-fix | N/A | A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u4 | deb | CVE-2026-8927 | Critical | wont-fix | N/A | When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u4 | deb | CVE-2026-8927 | Critical | wont-fix | N/A | When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u4 | deb | CVE-2026-8924 | Critical | wont-fix | N/A | A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u4 | deb | CVE-2026-8924 | Critical | wont-fix | N/A | A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u4 | deb | CVE-2026-8926 | Critical | wont-fix | N/A | When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username(without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u4 | deb | CVE-2026-8926 | Critical | wont-fix | N/A | When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username(without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcairo2 | 1.18.4-1+b1 | deb | CVE-2017-7475 | Low | wont-fix | N/A | Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash. | [] | pkg:deb/debian/libcairo2@1.18.4-1%2Bb1?arch=amd64&distro=debian-13.6&upstream=cairo%401.18.4-1 |
| libpoppler147 | 25.03.0-5+deb13u4 | deb | CVE-2019-9545 | Low | wont-fix | N/A | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero. | [] | pkg:deb/debian/libpoppler147@25.03.0-5%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=poppler |
| libopenjp2-7 | 2.5.3-2.1~deb13u2 | deb | CVE-2019-6988 | Low | wont-fix | N/A | An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress. | [] | pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjpeg2 |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libcurl3t64-gnutls | 8.14.1-2+deb13u4 | deb | CVE-2026-12064 | High | wont-fix | N/A | When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u4 | deb | CVE-2026-12064 | High | wont-fix | N/A | When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u4 | deb | CVE-2026-8286 | High | wont-fix | N/A | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u4 | deb | CVE-2026-8286 | High | wont-fix | N/A | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u4 | deb | CVE-2026-9080 | High | wont-fix | N/A | Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u4 | deb | CVE-2026-9080 | High | wont-fix | N/A | Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-25556 | High | wont-fix | N/A | MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-25556 | High | wont-fix | N/A | MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| libavahi-client3 | 0.8-16 | deb | CVE-2024-52616 | Medium | wont-fix | N/A | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2024-52616 | Medium | wont-fix | N/A | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2024-52616 | Medium | wont-fix | N/A | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | deb | CVE-2026-6653 | Critical | wont-fix | N/A | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling. | [] | pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=amd64&distro=debian-13.6 |
| libjbig2dec0 | 0.20-1+b3 | deb | CVE-2026-38076 | High | not-fixed | N/A | An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [] | pkg:deb/debian/libjbig2dec0@0.20-1%2Bb3?arch=amd64&distro=debian-13.6&upstream=jbig2dec%400.20-1 |
| dirmngr | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/dirmngr@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gnupg | 2.4.7-21+deb13u1 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gnupg@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.6&upstream=gnupg2 |
| gnupg-l10n | 2.4.7-21+deb13u1 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gnupg-l10n@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.6&upstream=gnupg2 |
| gpg | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gpg@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpg-agent | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gpg-agent@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpgconf | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gpgconf@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpgsm | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gpgsm@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| libopenjp2-7 | 2.5.3-2.1~deb13u2 | deb | CVE-2023-39329 | Medium | wont-fix | N/A | A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service. | [] | pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjpeg2 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-45186 | High | not-fixed | N/A | In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libncursesw6 | 6.5+20250216-2 | deb | CVE-2025-69720 | High | wont-fix | N/A | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | [] | pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64&distro=debian-13.6&upstream=ncurses |
| libtinfo6 | 6.5+20250216-2 | deb | CVE-2025-69720 | High | wont-fix | N/A | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | [] | pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64&distro=debian-13.6&upstream=ncurses |
| ncurses-base | 6.5+20250216-2 | deb | CVE-2025-69720 | High | wont-fix | N/A | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | [] | pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all&distro=debian-13.6&upstream=ncurses |
| ncurses-bin | 6.5+20250216-2 | deb | CVE-2025-69720 | High | wont-fix | N/A | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | [] | pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64&distro=debian-13.6&upstream=ncurses |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58015 | High | wont-fix | N/A | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| libcurl3t64-gnutls | 8.14.1-2+deb13u4 | deb | CVE-2026-8458 | Medium | wont-fix | N/A | libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u4 | deb | CVE-2026-8458 | Medium | wont-fix | N/A | libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl3t64-gnutls | 8.14.1-2+deb13u4 | deb | CVE-2026-9545 | High | wont-fix | N/A | In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u4 | deb | CVE-2026-9545 | High | wont-fix | N/A | In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-41080 | High | wont-fix | N/A | libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-55780 | High | wont-fix | N/A | A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-55780 | High | wont-fix | N/A | A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| libavahi-client3 | 0.8-16 | deb | CVE-2024-52615 | Medium | wont-fix | N/A | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2024-52615 | Medium | wont-fix | N/A | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2024-52615 | Medium | wont-fix | N/A | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-5928 | High | wont-fix | N/A | Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets. | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-5928 | High | wont-fix | N/A | Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets. | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libcurl3t64-gnutls | 8.14.1-2+deb13u4 | deb | CVE-2026-8932 | High | wont-fix | N/A | libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key. | [] | pkg:deb/debian/libcurl3t64-gnutls@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libcurl4t64 | 8.14.1-2+deb13u4 | deb | CVE-2026-8932 | High | wont-fix | N/A | libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key. | [] | pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=curl |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58013 | High | wont-fix | N/A | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58011 | High | wont-fix | N/A | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58012 | High | wont-fix | N/A | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58010 | High | wont-fix | N/A | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| libopenjp2-7 | 2.5.3-2.1~deb13u2 | deb | CVE-2023-39327 | Medium | wont-fix | N/A | A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal. | [] | pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjpeg2 |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58014 | High | wont-fix | N/A | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-71382 | High | wont-fix | N/A | MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-71382 | High | wont-fix | N/A | MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| tar | 1.35+dfsg-3.1 | deb | CVE-2026-5704 | Medium | wont-fix | N/A | A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection. | [] | pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=amd64&distro=debian-13.6 |
| bsdutils | 1:2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| libblkid1 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libmount1 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libuuid1 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| mount | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| util-linux | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-46206 | Medium | wont-fix | N/A | An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-46206 | Medium | wont-fix | N/A | An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| gzip | 1.13-1 | deb | CVE-2026-41992 | High | wont-fix | N/A | GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer. This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681 | [] | pkg:deb/debian/gzip@1.13-1?arch=amd64&distro=debian-13.6 |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-6238 | Medium | wont-fix | N/A | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions. | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-6238 | Medium | wont-fix | N/A | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions. | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libavahi-client3 | 0.8-16 | deb | CVE-2025-68471 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2025-68471 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2025-68471 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libpam-modules | 1.7.0-5 | deb | CVE-2026-54411 | Medium | wont-fix | N/A | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext. | [] | pkg:deb/debian/libpam-modules@1.7.0-5?arch=amd64&distro=debian-13.6&upstream=pam |
| libpam-modules-bin | 1.7.0-5 | deb | CVE-2026-54411 | Medium | wont-fix | N/A | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext. | [] | pkg:deb/debian/libpam-modules-bin@1.7.0-5?arch=amd64&distro=debian-13.6&upstream=pam |
| libpam-runtime | 1.7.0-5 | deb | CVE-2026-54411 | Medium | wont-fix | N/A | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext. | [] | pkg:deb/debian/libpam-runtime@1.7.0-5?arch=all&distro=debian-13.6&upstream=pam |
| libpam0g | 1.7.0-5 | deb | CVE-2026-54411 | Medium | wont-fix | N/A | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext. | [] | pkg:deb/debian/libpam0g@1.7.0-5?arch=amd64&distro=debian-13.6&upstream=pam |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libavahi-client3 | 0.8-16 | deb | CVE-2025-68468 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2025-68468 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2025-68468 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-5435 | High | wont-fix | N/A | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-5435 | High | wont-fix | N/A | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libtiff6 | 4.7.0-3+deb13u3 | deb | CVE-2026-12912 | High | not-fixed | N/A | A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS). | [] | pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=tiff |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-25210 | High | wont-fix | N/A | In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libavahi-client3 | 0.8-16 | deb | CVE-2026-24401 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2026-24401 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2026-24401 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-7233 | Medium | wont-fix | N/A | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-7233 | Medium | wont-fix | N/A | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| login.defs | 1:4.17.4-2 | deb | CVE-2024-56433 | Low | wont-fix | N/A | shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid. | [] | pkg:deb/debian/login.defs@1%3A4.17.4-2?arch=all&distro=debian-13.6&upstream=shadow |
| passwd | 1:4.17.4-2 | deb | CVE-2024-56433 | Low | wont-fix | N/A | shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid. | [] | pkg:deb/debian/passwd@1%3A4.17.4-2?arch=amd64&distro=debian-13.6&upstream=shadow |
| libopenjp2-7 | 2.5.3-2.1~deb13u2 | deb | CVE-2023-39328 | Medium | wont-fix | N/A | A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file. | [] | pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjpeg2 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-50219 | Medium | not-fixed | N/A | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libnghttp2-14 | 1.64.0-1.1+deb13u1 | deb | CVE-2026-58055 | Medium | wont-fix | N/A | nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning. | [] | pkg:deb/debian/libnghttp2-14@1.64.0-1.1%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=nghttp2 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-32777 | Medium | wont-fix | N/A | libexpat before 2.7.5 allows an infinite loop while parsing DTD content. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| zlib1g | 1:1.3.dfsg+really1.3.1-1+b1 | deb | CVE-2026-27171 | Medium | wont-fix | N/A | zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition. | [] | pkg:deb/debian/zlib1g@1%3A1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64&distro=debian-13.6&upstream=zlib%401%3A1.3.dfsg%2Breally1.3.1-1 |
| libavahi-client3 | 0.8-16 | deb | CVE-2026-34933 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2026-34933 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2026-34933 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libacl1 | 2.3.2-2+b1 | deb | CVE-2026-54369 | High | wont-fix | N/A | acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation. | [] | pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64&distro=debian-13.6&upstream=acl%402.3.2-2 |
| libexpat1 | 2.7.1-2 | deb | CVE-2025-66382 | Medium | wont-fix | N/A | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-32778 | Medium | wont-fix | N/A | libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-32776 | Medium | wont-fix | N/A | libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libxslt1.1 | 1.1.35-1.2+deb13u3 | deb | CVE-2025-10911 | Medium | wont-fix | N/A | A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. | [] | pkg:deb/debian/libxslt1.1@1.1.35-1.2%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=libxslt |
| libavahi-client3 | 0.8-16 | deb | CVE-2025-59529 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2025-59529 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2025-59529 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-40505 | Medium | wont-fix | N/A | MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-40505 | Medium | wont-fix | N/A | MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| libncursesw6 | 6.5+20250216-2 | deb | CVE-2025-6141 | Medium | wont-fix | N/A | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | [] | pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64&distro=debian-13.6&upstream=ncurses |
| libtinfo6 | 6.5+20250216-2 | deb | CVE-2025-6141 | Medium | wont-fix | N/A | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | [] | pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64&distro=debian-13.6&upstream=ncurses |
| ncurses-base | 6.5+20250216-2 | deb | CVE-2025-6141 | Medium | wont-fix | N/A | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | [] | pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all&distro=debian-13.6&upstream=ncurses |
| ncurses-bin | 6.5+20250216-2 | deb | CVE-2025-6141 | Medium | wont-fix | N/A | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | [] | pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64&distro=debian-13.6&upstream=ncurses |
| libxslt1.1 | 1.1.35-1.2+deb13u3 | deb | CVE-2025-11731 | Low | wont-fix | N/A | A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service. | [] | pkg:deb/debian/libxslt1.1@1.1.35-1.2%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=libxslt |
| libattr1 | 1:2.5.2-3 | deb | CVE-2026-54371 | Medium | wont-fix | N/A | attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path. | [] | pkg:deb/debian/libattr1@1%3A2.5.2-3?arch=amd64&distro=debian-13.6&upstream=attr |
| libp11-kit0 | 0.25.5-3 | deb | CVE-2026-13757 | Medium | wont-fix | N/A | A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services. | [] | pkg:deb/debian/libp11-kit0@0.25.5-3?arch=amd64&distro=debian-13.6&upstream=p11-kit |
| libavahi-client3 | 0.8-16 | deb | CVE-2025-68276 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2025-68276 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2025-68276 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libacl1 | 2.3.2-2+b1 | deb | CVE-2026-54370 | High | wont-fix | N/A | acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation. | [] | pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64&distro=debian-13.6&upstream=acl%402.3.2-2 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56131 | Medium | not-fixed | N/A | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56410 | Medium | not-fixed | N/A | xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56411 | Medium | not-fixed | N/A | xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56132 | Medium | not-fixed | N/A | In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libcairo2 | 1.18.4-1+b1 | deb | CVE-2025-50422 | Low | wont-fix | N/A | Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c. | [] | pkg:deb/debian/libcairo2@1.18.4-1%2Bb1?arch=amd64&distro=debian-13.6&upstream=cairo%401.18.4-1 |
| libbz2-1.0 | 1.0.8-6 | deb | CVE-2026-42250 | Medium | wont-fix | N/A | bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67 | [] | pkg:deb/debian/libbz2-1.0@1.0.8-6?arch=amd64&distro=debian-13.6&upstream=bzip2 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56403 | Medium | not-fixed | N/A | libexpat before 2.8.2 has an integer overflow in storeAtts. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56405 | Medium | not-fixed | N/A | libexpat before 2.8.2 has an integer overflow in getAttributeId. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56408 | Medium | not-fixed | N/A | libexpat before 2.8.2 has an integer overflow in copyString. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56404 | Medium | not-fixed | N/A | libexpat before 2.8.2 has an integer overflow in addBinding. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56406 | Medium | not-fixed | N/A | libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56407 | Medium | not-fixed | N/A | libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| bsdutils | 1:2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| libblkid1 | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libmount1 | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libuuid1 | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| mount | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| util-linux | 2.41-5 | deb | CVE-2026-13595 | Medium | not-fixed | N/A | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 |
| bsdutils | 1:2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| libblkid1 | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libmount1 | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libuuid1 | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| mount | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| util-linux | 2.41-5 | deb | CVE-2026-27456 | Medium | wont-fix | N/A | util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56412 | Medium | not-fixed | N/A | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-56409 | Medium | not-fixed | N/A | xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| libsystemd0 | 257.13-1~deb13u1 | deb | CVE-2026-40228 | Low | wont-fix | N/A | In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set. | [] | pkg:deb/debian/libsystemd0@257.13-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=systemd |
| libudev1 | 257.13-1~deb13u1 | deb | CVE-2026-40228 | Low | wont-fix | N/A | In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set. | [] | pkg:deb/debian/libudev1@257.13-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=systemd |
| gzip | 1.13-1 | deb | CVE-2026-41991 | Medium | wont-fix | N/A | GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 | [] | pkg:deb/debian/gzip@1.13-1?arch=amd64&distro=debian-13.6 |
| libexpat1 | 2.7.1-2 | deb | CVE-2026-24515 | Low | wont-fix | N/A | In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data. | [] | pkg:deb/debian/libexpat1@2.7.1-2?arch=amd64&distro=debian-13.6&upstream=expat |
| dirmngr | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/dirmngr@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gnupg | 2.4.7-21+deb13u1 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gnupg@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.6&upstream=gnupg2 |
| gnupg-l10n | 2.4.7-21+deb13u1 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gnupg-l10n@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.6&upstream=gnupg2 |
| gpg | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gpg@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpg-agent | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gpg-agent@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpgconf | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gpgconf@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpgsm | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gpgsm@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| bsdutils | 1:2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| bsdutils | 1:2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| bsdutils | 1:2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| bsdutils | 1:2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| libblkid1 | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libblkid1 | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libblkid1 | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libblkid1 | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libtiff6 | 4.7.0-3+deb13u3 | deb | CVE-2026-36849 | Unknown | wont-fix | N/A | [] | pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=tiff | |
| libuuid1 | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libuuid1 | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libuuid1 | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libuuid1 | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| mount | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| mount | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| mount | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| mount | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| util-linux | 2.41-5 | deb | CVE-2026-53612 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 | |
| util-linux | 2.41-5 | deb | CVE-2026-53613 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 | |
| util-linux | 2.41-5 | deb | CVE-2026-53614 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 | |
| util-linux | 2.41-5 | deb | CVE-2026-53615 | Unknown | not-fixed | N/A | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 |
You can always download 💾 the full Grype report in JSON format.