Dangerzone Security Dashboard
- Target
- ghcr.io/freedomofpress/dangerzone/v1:20261022-1.1.0-13-gc515759
- Date
- 2026-10-22T02:14:44.504046474Z
Critical
0
High
35
Medium
56
Low
24
Unknown
1
| Name | Version | Vulnerability | Severity | State | Description | Affected packages | Related URLs |
|---|---|---|---|---|---|---|---|
| poppler | 25.03.0-5+deb13u4 | CVE-2019-9543 | Low | wont-fix | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit. | ["libpoppler147"] | [] |
| mupdf | 1.25.1+ds1-6+deb13u1 | CVE-2026-25556 | High | wont-fix | MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes. | ["libmupdf25.1","python3-mupdf"] | [] |
| cairo | 1.18.4-1 | CVE-2017-7475 | Low | wont-fix | Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash. | ["libcairo2"] | [] |
| poppler | 25.03.0-5+deb13u4 | CVE-2019-9545 | Low | wont-fix | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero. | ["libpoppler147"] | [] |
| openjpeg2 | 2.5.3-2.1~deb13u2 | CVE-2019-6988 | Low | wont-fix | An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress. | ["libopenjp2-7"] | [] |
| python3.13 | 3.13.5-2+deb13u5 | CVE-2026-15308 | High | wont-fix | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. | ["libpython3.13","libpython3.13-minimal","libpython3.13-stdlib","python3.13","python3.13-minimal"] | [] |
| mupdf | 1.25.1+ds1-6+deb13u1 | CVE-2025-71382 | High | wont-fix | MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering. | ["libmupdf25.1","python3-mupdf"] | [] |
| python3.13 | 3.13.5-2+deb13u5 | CVE-2026-17084 | Medium | wont-fix | The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0. | ["libpython3.13","libpython3.13-minimal","libpython3.13-stdlib","python3.13","python3.13-minimal"] | [] |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | CVE-2026-74860 | High | not-fixed | A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings. | ["libxml2"] | [] |
| ncurses | 6.5+20250216-2 | CVE-2025-69720 | High | wont-fix | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | ["libncursesw6","libtinfo6","ncurses-base","ncurses-bin"] | [] |
| avahi | 0.8-16 | CVE-2024-52616 | Medium | wont-fix | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. | ["libavahi-client3","libavahi-common-data","libavahi-common3"] | [] |
| gnupg2 | 2.4.7-21+deb13u1 | CVE-2026-24882 | High | wont-fix | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | ["dirmngr","gnupg","gnupg-l10n","gpg","gpg-agent","gpgconf","gpgsm"] | [] |
| openjpeg2 | 2.5.3-2.1~deb13u2 | CVE-2023-39329 | Medium | wont-fix | A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service. | ["libopenjp2-7"] | [] |
| mupdf | 1.25.1+ds1-6+deb13u1 | CVE-2025-55780 | High | wont-fix | A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain. | ["libmupdf25.1","python3-mupdf"] | [] |
| krb5 | 1.21.3-5+deb13u1 | CVE-2026-107708 | Medium | wont-fix | MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication. | ["libgssapi-krb5-2","libk5crypto3","libkrb5-3","libkrb5support0"] | [] |
| krb5 | 1.21.3-5+deb13u1 | CVE-2026-107778 | High | wont-fix | MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service. | ["libgssapi-krb5-2","libk5crypto3","libkrb5-3","libkrb5support0"] | [] |
| python3.13 | 3.13.5-2+deb13u5 | CVE-2026-19553 | High | wont-fix | ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration. If the program passes a server_hostname value that isn't an empty string or None to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-None and non-empty server_hostname value to SSLContext.wrap_bio(), asyncio.create_connection(), or asyncio.loop.start_tls() and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a ValueError, similar to SSLContext.wrap_socket(), when server_hostname isn't supplied. | ["libpython3.13","libpython3.13-minimal","libpython3.13-stdlib","python3.13","python3.13-minimal"] | [] |
| pam | 1.7.0-5 | CVE-2026-54411 | Medium | wont-fix | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. | ["libpam-modules","libpam-modules-bin","libpam-runtime","libpam0g"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-5435 | High | wont-fix | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. | ["libc-bin","libc6"] | [] |
| python3.13 | 3.13.5-2+deb13u5 | CVE-2026-15806 | Medium | wont-fix | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs. | ["libpython3.13","libpython3.13-minimal","libpython3.13-stdlib","python3.13","python3.13-minimal"] | [] |
| avahi | 0.8-16 | CVE-2024-52615 | Medium | wont-fix | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. | ["libavahi-client3","libavahi-common-data","libavahi-common3"] | [] |
| python3.13 | 3.13.5-2+deb13u5 | CVE-2025-12781 | Medium | wont-fix | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | ["libpython3.13","libpython3.13-minimal","libpython3.13-stdlib","python3.13","python3.13-minimal"] | [] |
| zlib | 1:1.3.dfsg+really1.3.1-1 | CVE-2026-85091 | High | not-fixed | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary. | ["zlib1g"] | [] |
| gcc-14 | 14.2.0-19 | CVE-2026-95619 | High | wont-fix | A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability. | ["gcc-14-base","libatomic1","libgcc-s1","libgfortran5","libgomp1","libstdc++6"] | [] |
| python3.13 | 3.13.5-2+deb13u5 | CVE-2026-87910 | Medium | wont-fix | When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None. | ["libpython3.13","libpython3.13-minimal","libpython3.13-stdlib","python3.13","python3.13-minimal"] | [] |
| poppler | 25.03.0-5+deb13u4 | CVE-2026-107705 | High | not-fixed | Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory. | ["libpoppler147"] | [] |
| openjpeg2 | 2.5.3-2.1~deb13u2 | CVE-2023-39327 | Medium | wont-fix | A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal. | ["libopenjp2-7"] | [] |
| mujs | 1.3.6-1 | CVE-2026-88362 | High | wont-fix | MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service. | ["libmujs3"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-6238 | Medium | wont-fix | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions. | ["libc-bin","libc6"] | [] |
| mupdf | 1.25.1+ds1-6+deb13u1 | CVE-2025-46206 | Medium | wont-fix | An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion | ["libmupdf25.1","python3-mupdf"] | [] |
| python3.13 | 3.13.5-2+deb13u5 | CVE-2025-15366 | Medium | wont-fix | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | ["libpython3.13","libpython3.13-minimal","libpython3.13-stdlib","python3.13","python3.13-minimal"] | [] |
| avahi | 0.8-16 | CVE-2025-68471 | Medium | wont-fix | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. | ["libavahi-client3","libavahi-common-data","libavahi-common3"] | [] |
| pymupdf | 1.25.4+ds1-3+deb13u1 | CVE-2026-82035 | High | wont-fix | PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2 file with a BaseFont name containing encoded path separators that decode to ../ sequences or absolute paths, causing arbitrary file writes outside the intended output directory without requiring authentication or elevated privileges. | ["python3-fitz","python3-pymupdf"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-19499 | High | wont-fix | Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known. | ["libc-bin","libc6"] | [] |
| util-linux | 2.41.5-0+deb13u1 | CVE-2026-3184 | Medium | wont-fix | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | ["bsdutils","libblkid1","liblastlog2-2","libmount1","libsmartcols1","libuuid1","login","mount","util-linux"] | [] |
| golang.org/x/mod | v0.36.0 | GO-2026-6180 | High | fixed | A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy | ["golang.org/x/mod","golang.org/x/mod"] | ["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/815000","https://go.dev/cl/815020"] |
| avahi | 0.8-16 | CVE-2025-68468 | Medium | wont-fix | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes. | ["libavahi-client3","libavahi-common-data","libavahi-common3"] | [] |
| libxrender | 1:0.9.12-1 | CVE-2026-88807 | High | wont-fix | A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. | ["libxrender1"] | [] |
| tar | 1.35+dfsg-3.1 | CVE-2026-5704 | Medium | wont-fix | A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection. | ["tar"] | [] |
| cyrus-sasl2 | 2.1.28+dfsg1-9 | CVE-2026-107161 | High | wont-fix | A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application. | ["libsasl2-2","libsasl2-modules-db"] | [] |
| python3.13 | 3.13.5-2+deb13u5 | CVE-2025-15367 | Medium | wont-fix | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | ["libpython3.13","libpython3.13-minimal","libpython3.13-stdlib","python3.13","python3.13-minimal"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-77117 | Medium | wont-fix | Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489. | ["libc-bin","libc6"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-80489 | Medium | wont-fix | Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117. | ["libc-bin","libc6"] | [] |
| gcc-14 | 14.2.0-19 | CVE-2026-102010 | High | wont-fix | A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption. | ["gcc-14-base","libatomic1","libgcc-s1","libgfortran5","libgomp1","libstdc++6"] | [] |
| avahi | 0.8-16 | CVE-2026-24401 | Medium | wont-fix | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524. | ["libavahi-client3","libavahi-common-data","libavahi-common3"] | [] |
| util-linux | 2.41.5-0+deb13u1 | CVE-2026-76642 | High | wont-fix | util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation. | ["bsdutils","libblkid1","liblastlog2-2","libmount1","libsmartcols1","libuuid1","login","mount","util-linux"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-8674 | Medium | wont-fix | Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software. | ["libc-bin","libc6"] | [] |
| python3.13 | 3.13.5-2+deb13u5 | CVE-2026-82049 | High | wont-fix | In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree. | ["libpython3.13","libpython3.13-minimal","libpython3.13-stdlib","python3.13","python3.13-minimal"] | [] |
| libx11 | 2:1.8.12-1 | CVE-2026-88806 | High | wont-fix | A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map. | ["libx11-6","libx11-data"] | [] |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | CVE-2026-86143 | High | not-fixed | In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback. | ["libxml2"] | [] |
| poppler | 25.03.0-5+deb13u4 | CVE-2026-93311 | Low | wont-fix | A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through a bug report but has not responded yet. | ["libpoppler147"] | [] |
| util-linux | 2.41.5-0+deb13u1 | CVE-2026-78408 | High | wont-fix | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. | ["bsdutils","libblkid1","liblastlog2-2","libmount1","libsmartcols1","libuuid1","login","mount","util-linux"] | [] |
| nghttp2 | 1.64.0-1.1+deb13u1 | CVE-2026-58055 | Medium | wont-fix | nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning. | ["libnghttp2-14"] | [] |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | CVE-2026-86144 | High | not-fixed | In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow). | ["libxml2"] | [] |
| shadow | 1:4.17.4-2 | CVE-2024-56433 | Low | wont-fix | shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid. | ["login.defs","passwd"] | [] |
| python3.13 | 3.13.5-2+deb13u5 | CVE-2026-15310 | Low | wont-fix | When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. | ["libpython3.13","libpython3.13-minimal","libpython3.13-stdlib","python3.13","python3.13-minimal"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-6791 | Medium | wont-fix | When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash. | ["libc-bin","libc6"] | [] |
| openjpeg2 | 2.5.3-2.1~deb13u2 | CVE-2023-39328 | Medium | wont-fix | A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file. | ["libopenjp2-7"] | [] |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | CVE-2026-86139 | High | not-fixed | In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. | ["libxml2"] | [] |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | CVE-2026-86140 | High | not-fixed | In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. | ["libxml2"] | [] |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | CVE-2026-86142 | High | not-fixed | In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. | ["libxml2"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-19542 | Medium | wont-fix | Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified. | ["libc-bin","libc6"] | [] |
| util-linux | 2.41.5-0+deb13u1 | CVE-2026-78410 | High | wont-fix | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode. | ["bsdutils","libblkid1","liblastlog2-2","libmount1","libsmartcols1","libuuid1","login","mount","util-linux"] | [] |
| libx11 | 2:1.8.12-1 | CVE-2026-94283 | Medium | wont-fix | An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients. | ["libx11-6","libx11-data"] | [] |
| acl | 2.3.2-2 | CVE-2026-54369 | High | wont-fix | acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation. | ["libacl1"] | [] |
| util-linux | 2.41.5-0+deb13u1 | CVE-2026-78409 | High | wont-fix | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint. | ["bsdutils","libblkid1","liblastlog2-2","libmount1","libsmartcols1","libuuid1","login","mount","util-linux"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-89092 | Medium | wont-fix | The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server. In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service. | ["libc-bin","libc6"] | [] |
| zlib | 1:1.3.dfsg+really1.3.1-1 | CVE-2026-27171 | Medium | wont-fix | zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition. | ["zlib1g"] | [] |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | CVE-2026-86137 | Medium | not-fixed | In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. | ["libxml2"] | [] |
| mupdf | 1.25.1+ds1-6+deb13u1 | CVE-2026-7233 | Medium | wont-fix | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet. | ["libmupdf25.1","python3-mupdf"] | [] |
| expat | 2.9.0-1~deb13u1 | CVE-2025-66382 | Medium | wont-fix | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. | ["libexpat1"] | [] |
| poppler | 25.03.0-5+deb13u4 | CVE-2026-93312 | Low | wont-fix | A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised. | ["libpoppler147"] | [] |
| golang.org/x/mod | v0.36.0 | GO-2026-6179 | High | fixed | A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy | ["golang.org/x/mod","golang.org/x/mod"] | ["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/814960","https://go.dev/cl/815020"] |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | CVE-2026-86138 | High | not-fixed | In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. | ["libxml2"] | [] |
| ncurses | 6.5+20250216-2 | CVE-2025-6141 | Medium | wont-fix | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | ["libncursesw6","libtinfo6","ncurses-base","ncurses-bin"] | [] |
| python3.13 | 3.13.5-2+deb13u5 | CVE-2026-12345 | Medium | wont-fix | The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms. | ["libpython3.13","libpython3.13-minimal","libpython3.13-stdlib","python3.13","python3.13-minimal"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-97399 | Low | wont-fix | The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable. | ["libc-bin","libc6"] | [] |
| avahi | 0.8-16 | CVE-2025-59529 | Medium | wont-fix | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users. | ["libavahi-client3","libavahi-common-data","libavahi-common3"] | [] |
| freetype | 2.13.3+dfsg-1+deb13u1 | CVE-2026-95512 | Medium | wont-fix | A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate. | ["libfreetype6"] | [] |
| mupdf | 1.25.1+ds1-6+deb13u1 | CVE-2026-40505 | Medium | wont-fix | MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands. | ["libmupdf25.1","python3-mupdf"] | [] |
| libxslt | 1.1.35-1.2+deb13u3 | CVE-2025-10911 | Medium | wont-fix | A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. | ["libxslt1.1"] | [] |
| bzip2 | 1.0.8-6 | CVE-2026-42250 | Medium | wont-fix | bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67 | ["libbz2-1.0"] | [] |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | CVE-2026-76781 | Medium | not-fixed | A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS). | ["libxml2"] | [] |
| libxslt | 1.1.35-1.2+deb13u3 | CVE-2025-11731 | Low | wont-fix | A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service. | ["libxslt1.1"] | [] |
| p11-kit | 0.25.5-3 | CVE-2026-13757 | Medium | wont-fix | A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services. | ["libp11-kit0"] | [] |
| mupdf | 1.25.1+ds1-6+deb13u1 | CVE-2026-112036 | Low | not-fixed | A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch. | ["libmupdf25.1","python3-mupdf"] | [] |
| avahi | 0.8-16 | CVE-2026-34933 | Medium | wont-fix | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4. | ["libavahi-client3","libavahi-common-data","libavahi-common3"] | [] |
| attr | 1:2.5.2-3 | CVE-2026-54371 | Medium | wont-fix | attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path. | ["libattr1"] | [] |
| avahi | 0.8-16 | CVE-2025-68276 | Medium | wont-fix | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves. | ["libavahi-client3","libavahi-common-data","libavahi-common3"] | [] |
| poppler | 25.03.0-5+deb13u4 | CVE-2026-93653 | Medium | wont-fix | A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine, without a corresponding memory allocation. An attacker could exploit this by supplying a malicious PDF to an application that renders it via Poppler's Splash backend, causing the rendering process to consume 100% CPU for an attacker-controlled, extended duration. | ["libpoppler147"] | [] |
| glib2.0 | 2.84.4-3~deb13u5 | CVE-2026-86469 | Medium | wont-fix | A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file. | ["libglib2.0-0t64"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-18374 | Medium | wont-fix | Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation. | ["libc-bin","libc6"] | [] |
| tar | 1.35+dfsg-3.1 | CVE-2026-18508 | Medium | wont-fix | A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction. | ["tar"] | [] |
| cairo | 1.18.4-1 | CVE-2025-50422 | Low | wont-fix | Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c. | ["libcairo2"] | [] |
| tiff | 4.7.0-3+deb13u3 | CVE-2026-18495 | Medium | wont-fix | A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption. | ["libtiff6"] | [] |
| acl | 2.3.2-2 | CVE-2026-54370 | High | wont-fix | acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation. | ["libacl1"] | [] |
| systemd | 257.13-1~deb13u1 | CVE-2026-15059 | Medium | wont-fix | Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation. | ["libsystemd0","libudev1"] | [] |
| poppler | 25.03.0-5+deb13u4 | CVE-2026-93313 | Low | wont-fix | A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named eb87cf711563894649bd0c365baa479401dc6d51. To fix this issue, it is recommended to deploy a patch. | ["libpoppler147"] | [] |
| poppler | 25.03.0-5+deb13u4 | CVE-2026-93314 | Low | wont-fix | A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called ed2a5538cf0a8d3ff908191eda9b73f91a5f952a. It is advisable to implement a patch to correct this issue. | ["libpoppler147"] | [] |
| p11-kit | 0.25.5-3 | CVE-2026-18938 | Medium | wont-fix | A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems. | ["libp11-kit0"] | [] |
| libx11 | 2:1.8.12-1 | CVE-2026-94285 | Medium | wont-fix | An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients. | ["libx11-6","libx11-data"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-86805 | Medium | wont-fix | A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability. | ["libc-bin","libc6"] | [] |
| libx11 | 2:1.8.12-1 | CVE-2026-94284 | Medium | wont-fix | An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients. | ["libx11-6","libx11-data"] | [] |
| libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | CVE-2026-86141 | Low | not-fixed | xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking. | ["libxml2"] | [] |
| github.com/cilium/ebpf | v0.16.0 | GHSA-xhgw-qwwf-pg32 | Low | fixed | ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReader | ["github.com/cilium/ebpf"] | ["https://nvd.nist.gov/vuln/detail/CVE-2026-10722","https://github.com/cilium/ebpf/issues/2019","https://github.com/cilium/ebpf/pull/2021","https://github.com/cilium/ebpf/commit/533dfc82fd228bfadf42ea7180c39de7d9af47fa","https://gist.github.com/thesmartshadow/256bff0f8042c584f993ace89074a815","https://github.com/cilium/ebpf","https://vuldb.com/cve/CVE-2026-10722","https://vuldb.com/submit/818291","https://vuldb.com/vuln/368091","https://vuldb.com/vuln/368091/cti"] |
| gnupg2 | 2.4.7-21+deb13u1 | CVE-2026-57062 | Low | wont-fix | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | ["dirmngr","gnupg","gnupg-l10n","gpg","gpg-agent","gpgconf","gpgsm"] | [] |
| systemd | 257.13-1~deb13u1 | CVE-2026-40228 | Low | wont-fix | In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set. | ["libsystemd0","libudev1"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-95818 | Low | wont-fix | A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory. | ["libc-bin","libc6"] | [] |
| gnupg2 | 2.4.7-21+deb13u1 | CVE-2026-105712 | Low | wont-fix | gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk. | ["dirmngr","gnupg","gnupg-l10n","gpg","gpg-agent","gpgconf","gpgsm"] | [] |
| tar | 1.35+dfsg-3.1 | CVE-2026-18477 | Medium | wont-fix | A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue. | ["tar"] | [] |
| systemd | 257.13-1~deb13u1 | CVE-2026-16742 | Medium | wont-fix | systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user | ["libsystemd0","libudev1"] | [] |
| python3.13 | 3.13.5-2+deb13u5 | CVE-2026-18503 | Low | wont-fix | Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff(). | ["libpython3.13","libpython3.13-minimal","libpython3.13-stdlib","python3.13","python3.13-minimal"] | [] |
| poppler | 25.03.0-5+deb13u4 | CVE-2026-102620 | Low | wont-fix | A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue. | ["libpoppler147"] | [] |
| poppler | 25.03.0-5+deb13u4 | CVE-2026-102621 | Low | wont-fix | A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component. | ["libpoppler147"] | [] |
| glibc | 2.41-12+deb13u4 | CVE-2026-6368 | Low | wont-fix | Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process. | ["libc-bin","libc6"] | [] |
| tiff | 4.7.0-3+deb13u3 | CVE-2026-36849 | Unknown | wont-fix | ["libtiff6"] | [] |