{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b91c-5af1-7601-8713-ab3e614ec0eb", "CreatedAt": "2026-11-08T04:03:25.681394892+01:00", "ArtifactID": "sha256:152a0c02050e1c5a30f430ca51ae3cfd30aa498c192da4a6a6a30615fafb9121", "ArtifactName": "traefik-stack-claude-assistant", "ArtifactType": "container_image", "Metadata": { "Size": 201339904, "OS": { "Family": "debian", "Name": "13.1" }, "ImageID": "sha256:289b2d340bf55dde20db6df0c599a141b17dfcf967a08267e547d1febc3b6089", "DiffIDs": [ "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4", "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420", "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd", "sha256:3e79ec3d489e3dd6ff054c140f09e69519a942557cbd7a70ca67a5bbcc5a45ea", "sha256:e774ae43b80c4e32563931e8ccec19dc5389ba3cbc755b1d46238ec8f1e4920d", "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705", "sha256:f8bfcfd9925dc0bcc9f47db975b60582463a1285109fa61bacdd55f8a2fe51e4", "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3", "sha256:501fffc20a1c6ba3833246802093c10e5d8dda41905ee645060478a18ffe44de", "sha256:c7cac39b77d345a0fb421464c177182a0eb9337b978e8337bced3992c28492a1" ], "RepoTags": [ "traefik-stack-claude-assistant:latest" ], "Reference": "traefik-stack-claude-assistant:latest", "ImageConfig": { "architecture": "amd64", "created": "2025-11-14T19:37:19.826476433Z", "history": [ { "created": "2025-11-03T20:44:10Z", "created_by": "# debian.sh --arch 'amd64' out/ 'trixie' '@1762202650'", "comment": "debuerreotype 0.16" }, { "created": "2025-11-04T04:23:03Z", "created_by": "ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-11-04T04:23:03Z", "created_by": "ENV LANG=C.UTF-8", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-11-04T04:23:03Z", "created_by": "RUN /bin/sh -c set -eux; \tapt-get update; \tapt-get install -y --no-install-recommends \t\tca-certificates \t\tnetbase \t\ttzdata \t; \tapt-get dist-clean # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-11-04T04:23:03Z", "created_by": "ENV GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-11-04T04:23:03Z", "created_by": "ENV PYTHON_VERSION=3.11.14", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-11-04T04:23:03Z", "created_by": "ENV PYTHON_SHA256=8d3ed8ec5c88c1c95f5e558612a725450d2452813ddad5e58fdb1a53b1209b78", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-11-04T04:30:30Z", "created_by": "RUN /bin/sh -c set -eux; \t\tsavedAptMark=\"$(apt-mark showmanual)\"; \tapt-get update; \tapt-get install -y --no-install-recommends \t\tdpkg-dev \t\tgcc \t\tgnupg \t\tlibbluetooth-dev \t\tlibbz2-dev \t\tlibc6-dev \t\tlibdb-dev \t\tlibffi-dev \t\tlibgdbm-dev \t\tliblzma-dev \t\tlibncursesw5-dev \t\tlibreadline-dev \t\tlibsqlite3-dev \t\tlibssl-dev \t\tmake \t\ttk-dev \t\tuuid-dev \t\twget \t\txz-utils \t\tzlib1g-dev \t; \t\twget -O python.tar.xz \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz\"; \techo \"$PYTHON_SHA256 *python.tar.xz\" | sha256sum -c -; \twget -O python.tar.xz.asc \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc\"; \tGNUPGHOME=\"$(mktemp -d)\"; export GNUPGHOME; \tgpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$GPG_KEY\"; \tgpg --batch --verify python.tar.xz.asc python.tar.xz; \tgpgconf --kill all; \trm -rf \"$GNUPGHOME\" python.tar.xz.asc; \tmkdir -p /usr/src/python; \ttar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; \trm python.tar.xz; \t\tcd /usr/src/python; \tgnuArch=\"$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)\"; \t./configure \t\t--build=\"$gnuArch\" \t\t--enable-loadable-sqlite-extensions \t\t--enable-optimizations \t\t--enable-option-checking=fatal \t\t--enable-shared \t\t$(test \"${gnuArch%%-*}\" != 'riscv64' \u0026\u0026 echo '--with-lto') \t\t--with-ensurepip \t; \tnproc=\"$(nproc)\"; \tEXTRA_CFLAGS=\"$(dpkg-buildflags --get CFLAGS)\"; \tLDFLAGS=\"$(dpkg-buildflags --get LDFLAGS)\"; \tLDFLAGS=\"${LDFLAGS:--Wl},--strip-all\"; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-}\" \t; \trm python; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:--Wl},-rpath='\\$\\$ORIGIN/../lib'\" \t\tpython \t; \tmake install; \t\tcd /; \trm -rf /usr/src/python; \t\tfind /usr/local -depth \t\t\\( \t\t\t\\( -type d -a \\( -name test -o -name tests -o -name idle_test \\) \\) \t\t\t-o \\( -type f -a \\( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \\) \\) \t\t\\) -exec rm -rf '{}' + \t; \t\tldconfig; \t\tapt-mark auto '.*' \u003e /dev/null; \tapt-mark manual $savedAptMark; \tfind /usr/local -type f -executable -not \\( -name '*tkinter*' \\) -exec ldd '{}' ';' \t\t| awk '/=\u003e/ { so = $(NF-1); if (index(so, \"/usr/local/\") == 1) { next }; gsub(\"^/(usr/)?\", \"\", so); printf \"*%s\\n\", so }' \t\t| sort -u \t\t| xargs -rt dpkg-query --search \t\t| awk 'sub(\":$\", \"\", $1) { print $1 }' \t\t| sort -u \t\t| xargs -r apt-mark manual \t; \tapt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \tapt-get dist-clean; \t\texport PYTHONDONTWRITEBYTECODE=1; \tpython3 --version; \t\tpip3 install \t\t--disable-pip-version-check \t\t--no-cache-dir \t\t--no-compile \t\t'setuptools==79.0.1' \t\t'wheel\u003c0.46' \t; \tpip3 --version # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-11-04T04:30:30Z", "created_by": "RUN /bin/sh -c set -eux; \tfor src in idle3 pip3 pydoc3 python3 python3-config; do \t\tdst=\"$(echo \"$src\" | tr -d 3)\"; \t\t[ -s \"/usr/local/bin/$src\" ]; \t\t[ ! -e \"/usr/local/bin/$dst\" ]; \t\tln -svT \"$src\" \"/usr/local/bin/$dst\"; \tdone # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-11-04T04:30:30Z", "created_by": "CMD [\"python3\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-11-14T18:34:15Z", "created_by": "WORKDIR /app", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-11-14T19:37:13Z", "created_by": "RUN /bin/sh -c apt-get update \u0026\u0026 apt-get install -y curl \u0026\u0026 rm -rf /var/lib/apt/lists/* # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-11-14T19:37:13Z", "created_by": "COPY requirements.txt . # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-11-14T19:37:19Z", "created_by": "RUN /bin/sh -c pip install --no-cache-dir -r requirements.txt # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-11-14T19:37:19Z", "created_by": "COPY app.py . # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-11-14T19:37:19Z", "created_by": "RUN /bin/sh -c useradd -m -u 1000 claude \u0026\u0026 chown -R claude:claude /app # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-11-14T19:37:19Z", "created_by": "USER claude", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-11-14T19:37:19Z", "created_by": "HEALTHCHECK \u0026{[\"CMD-SHELL\" \"curl -f http://localhost:8000/ || exit 1\"] \"30s\" \"10s\" \"5s\" \"0s\" '\\x03'}", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-11-14T19:37:19Z", "created_by": "EXPOSE [8000/tcp]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-11-14T19:37:19Z", "created_by": "CMD [\"python\" \"app.py\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4", "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420", "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd", "sha256:3e79ec3d489e3dd6ff054c140f09e69519a942557cbd7a70ca67a5bbcc5a45ea", "sha256:e774ae43b80c4e32563931e8ccec19dc5389ba3cbc755b1d46238ec8f1e4920d", "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705", "sha256:f8bfcfd9925dc0bcc9f47db975b60582463a1285109fa61bacdd55f8a2fe51e4", "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3", "sha256:501fffc20a1c6ba3833246802093c10e5d8dda41905ee645060478a18ffe44de", "sha256:c7cac39b77d345a0fb421464c177182a0eb9337b978e8337bced3992c28492a1" ] }, "config": { "Cmd": [ "python", "app.py" ], "Healthcheck": { "Test": [ "CMD-SHELL", "curl -f http://localhost:8000/ || exit 1" ], "Interval": 30000000000, "Timeout": 10000000000, "StartPeriod": 5000000000, "Retries": 3 }, "Env": [ "PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "LANG=C.UTF-8", "GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D", "PYTHON_VERSION=3.11.14", "PYTHON_SHA256=8d3ed8ec5c88c1c95f5e558612a725450d2452813ddad5e58fdb1a53b1209b78" ], "Labels": { "com.docker.compose.project": "traefik-stack", "com.docker.compose.service": "claude-assistant", "com.docker.compose.version": "2.40.3" }, "User": "claude", "WorkingDir": "/app", "ExposedPorts": { "8000/tcp": {} }, "ArgsEscaped": true } }, "Layers": [ { "Size": 81039360, "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, { "Size": 4122624, "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, { "Size": 43838976, "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, { "Size": 5120, "DiffID": "sha256:3e79ec3d489e3dd6ff054c140f09e69519a942557cbd7a70ca67a5bbcc5a45ea" }, { "Size": 1536, "DiffID": "sha256:e774ae43b80c4e32563931e8ccec19dc5389ba3cbc755b1d46238ec8f1e4920d" }, { "Size": 16475136, "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, { "Size": 2560, "DiffID": "sha256:f8bfcfd9925dc0bcc9f47db975b60582463a1285109fa61bacdd55f8a2fe51e4" }, { "Size": 55805952, "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, { "Size": 13312, "DiffID": "sha256:501fffc20a1c6ba3833246802093c10e5d8dda41905ee645060478a18ffe44de" }, { "Size": 35328, "DiffID": "sha256:c7cac39b77d345a0fb421464c177182a0eb9337b978e8337bced3992c28492a1" } ] }, "Results": [ { "Target": "traefik-stack-claude-assistant (debian 13.1)", "Class": "os-pkgs", "Type": "debian", "Packages": [ { "ID": "adduser@3.152", "Name": "adduser", "Identifier": { "PURL": "pkg:deb/debian/adduser@3.152?arch=all\u0026distro=debian-13.1", "UID": "17a3839c9950603e" }, "Version": "3.152", "Arch": "all", "SrcName": "adduser", "SrcVersion": "3.152", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Adduser Developers \u003cadduser@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "passwd@1:4.17.4-2" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "InstalledFiles": [ "/usr/sbin/adduser", "/usr/sbin/deluser", "/usr/share/doc/adduser/NEWS.Debian.gz", "/usr/share/doc/adduser/README.gz", "/usr/share/doc/adduser/TODO", "/usr/share/doc/adduser/changelog.gz", "/usr/share/doc/adduser/copyright", "/usr/share/doc/adduser/examples/INSTALL", "/usr/share/doc/adduser/examples/README", "/usr/share/doc/adduser/examples/adduser.conf", "/usr/share/doc/adduser/examples/adduser.local", "/usr/share/doc/adduser/examples/adduser.local.conf", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/bash.bashrc", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/profile", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel.other/index.html", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bash_logout", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bash_profile", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bashrc", "/usr/share/doc/adduser/examples/deluser.conf", "/usr/share/man/da/man5/deluser.conf.5.gz", "/usr/share/man/de/man5/adduser.conf.5.gz", "/usr/share/man/de/man5/deluser.conf.5.gz", "/usr/share/man/de/man8/adduser.8.gz", "/usr/share/man/de/man8/adduser.local.8.gz", "/usr/share/man/de/man8/deluser.8.gz", "/usr/share/man/es/man5/deluser.conf.5.gz", "/usr/share/man/fr/man5/adduser.conf.5.gz", "/usr/share/man/fr/man5/deluser.conf.5.gz", "/usr/share/man/fr/man8/adduser.8.gz", "/usr/share/man/fr/man8/deluser.8.gz", "/usr/share/man/it/man5/deluser.conf.5.gz", "/usr/share/man/man5/adduser.conf.5.gz", "/usr/share/man/man5/deluser.conf.5.gz", "/usr/share/man/man8/adduser.8.gz", "/usr/share/man/man8/adduser.local.8.gz", "/usr/share/man/man8/deluser.8.gz", "/usr/share/man/nl/man5/adduser.conf.5.gz", "/usr/share/man/nl/man5/deluser.conf.5.gz", "/usr/share/man/nl/man8/adduser.8.gz", "/usr/share/man/nl/man8/adduser.local.8.gz", "/usr/share/man/nl/man8/deluser.8.gz", "/usr/share/man/pl/man5/deluser.conf.5.gz", "/usr/share/man/pt/man5/adduser.conf.5.gz", "/usr/share/man/pt/man5/deluser.conf.5.gz", "/usr/share/man/pt/man8/adduser.8.gz", "/usr/share/man/pt/man8/adduser.local.8.gz", "/usr/share/man/pt/man8/deluser.8.gz", "/usr/share/man/ro/man5/adduser.conf.5.gz", "/usr/share/man/ro/man5/deluser.conf.5.gz", "/usr/share/man/ro/man8/adduser.8.gz", "/usr/share/man/ro/man8/adduser.local.8.gz", "/usr/share/man/ro/man8/deluser.8.gz", "/usr/share/man/ru/man5/deluser.conf.5.gz", "/usr/share/man/sv/man5/deluser.conf.5.gz", "/usr/share/perl5/Debian/AdduserCommon.pm", "/usr/share/perl5/Debian/AdduserLogging.pm", "/usr/share/perl5/Debian/AdduserRetvalues.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "apt@3.0.3", "Name": "apt", "Identifier": { "PURL": "pkg:deb/debian/apt@3.0.3?arch=amd64\u0026distro=debian-13.1", "UID": "11607181e5c9d3dd" }, "Version": "3.0.3", "Arch": "amd64", "SrcName": "apt", "SrcVersion": "3.0.3", "Licenses": [ "GPL-2.0-or-later", "curl", "BSD-3-Clause", "MIT", "GPL-2.0-only" ], "Maintainer": "APT Development Team \u003cdeity@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "adduser@3.152", "base-passwd@3.6.7", "debian-archive-keyring@2025.1", "libapt-pkg7.0@3.0.3", "libc6@2.41-12", "libgcc-s1@14.2.0-19", "libseccomp2@2.6.0-2", "libssl3t64@3.5.1-1+deb13u1", "libstdc++6@14.2.0-19", "libsystemd0@257.8-1~deb13u2", "sqv@1.3.0-3" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/apt", "/usr/bin/apt-cache", "/usr/bin/apt-cdrom", "/usr/bin/apt-config", "/usr/bin/apt-get", "/usr/bin/apt-mark", "/usr/lib/apt/apt-extracttemplates", "/usr/lib/apt/apt-helper", "/usr/lib/apt/apt.systemd.daily", "/usr/lib/apt/methods/cdrom", "/usr/lib/apt/methods/copy", "/usr/lib/apt/methods/file", "/usr/lib/apt/methods/gpgv", "/usr/lib/apt/methods/http", "/usr/lib/apt/methods/mirror", "/usr/lib/apt/methods/rred", "/usr/lib/apt/methods/sqv", "/usr/lib/apt/methods/store", "/usr/lib/apt/solvers/dump", "/usr/lib/dpkg/methods/apt/desc.apt", "/usr/lib/dpkg/methods/apt/install", "/usr/lib/dpkg/methods/apt/names", "/usr/lib/dpkg/methods/apt/setup", "/usr/lib/dpkg/methods/apt/update", "/usr/lib/systemd/system/apt-daily-upgrade.service", "/usr/lib/systemd/system/apt-daily-upgrade.timer", "/usr/lib/systemd/system/apt-daily.service", "/usr/lib/systemd/system/apt-daily.timer", "/usr/lib/x86_64-linux-gnu/libapt-private.so.0.0.0", "/usr/share/apt/default-sequoia.config", "/usr/share/bash-completion/completions/apt", "/usr/share/bug/apt/script", "/usr/share/doc/apt/NEWS.Debian.gz", "/usr/share/doc/apt/README.md.gz", "/usr/share/doc/apt/changelog.gz", "/usr/share/doc/apt/copyright", "/usr/share/doc/apt/examples/apt.conf", "/usr/share/doc/apt/examples/configure-index", "/usr/share/doc/apt/examples/debian.sources", "/usr/share/doc/apt/examples/preferences", "/usr/share/lintian/overrides/apt", "/usr/share/locale/ar/LC_MESSAGES/apt.mo", "/usr/share/locale/ast/LC_MESSAGES/apt.mo", "/usr/share/locale/bg/LC_MESSAGES/apt.mo", "/usr/share/locale/bs/LC_MESSAGES/apt.mo", "/usr/share/locale/ca/LC_MESSAGES/apt.mo", "/usr/share/locale/cs/LC_MESSAGES/apt.mo", "/usr/share/locale/cy/LC_MESSAGES/apt.mo", "/usr/share/locale/da/LC_MESSAGES/apt.mo", "/usr/share/locale/de/LC_MESSAGES/apt.mo", "/usr/share/locale/dz/LC_MESSAGES/apt.mo", "/usr/share/locale/el/LC_MESSAGES/apt.mo", "/usr/share/locale/es/LC_MESSAGES/apt.mo", "/usr/share/locale/eu/LC_MESSAGES/apt.mo", "/usr/share/locale/fi/LC_MESSAGES/apt.mo", "/usr/share/locale/fr/LC_MESSAGES/apt.mo", "/usr/share/locale/gl/LC_MESSAGES/apt.mo", "/usr/share/locale/hu/LC_MESSAGES/apt.mo", "/usr/share/locale/it/LC_MESSAGES/apt.mo", "/usr/share/locale/ja/LC_MESSAGES/apt.mo", "/usr/share/locale/km/LC_MESSAGES/apt.mo", "/usr/share/locale/ko/LC_MESSAGES/apt.mo", "/usr/share/locale/ku/LC_MESSAGES/apt.mo", "/usr/share/locale/lt/LC_MESSAGES/apt.mo", "/usr/share/locale/mr/LC_MESSAGES/apt.mo", "/usr/share/locale/nb/LC_MESSAGES/apt.mo", "/usr/share/locale/ne/LC_MESSAGES/apt.mo", "/usr/share/locale/nl/LC_MESSAGES/apt.mo", "/usr/share/locale/nn/LC_MESSAGES/apt.mo", "/usr/share/locale/pl/LC_MESSAGES/apt.mo", "/usr/share/locale/pt/LC_MESSAGES/apt.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/apt.mo", "/usr/share/locale/ro/LC_MESSAGES/apt.mo", "/usr/share/locale/ru/LC_MESSAGES/apt.mo", "/usr/share/locale/sk/LC_MESSAGES/apt.mo", "/usr/share/locale/sl/LC_MESSAGES/apt.mo", "/usr/share/locale/sv/LC_MESSAGES/apt.mo", "/usr/share/locale/th/LC_MESSAGES/apt.mo", "/usr/share/locale/tl/LC_MESSAGES/apt.mo", "/usr/share/locale/tr/LC_MESSAGES/apt.mo", "/usr/share/locale/uk/LC_MESSAGES/apt.mo", "/usr/share/locale/vi/LC_MESSAGES/apt.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/apt.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/apt.mo", "/usr/share/man/de/man1/apt-transport-http.1.gz", "/usr/share/man/de/man1/apt-transport-https.1.gz", "/usr/share/man/de/man1/apt-transport-mirror.1.gz", "/usr/share/man/de/man5/apt.conf.5.gz", "/usr/share/man/de/man5/apt_auth.conf.5.gz", "/usr/share/man/de/man5/apt_preferences.5.gz", "/usr/share/man/de/man5/sources.list.5.gz", "/usr/share/man/de/man7/apt-patterns.7.gz", "/usr/share/man/de/man8/apt-cache.8.gz", "/usr/share/man/de/man8/apt-cdrom.8.gz", "/usr/share/man/de/man8/apt-config.8.gz", "/usr/share/man/de/man8/apt-get.8.gz", "/usr/share/man/de/man8/apt-mark.8.gz", "/usr/share/man/de/man8/apt-secure.8.gz", "/usr/share/man/de/man8/apt.8.gz", "/usr/share/man/es/man5/apt_preferences.5.gz", "/usr/share/man/es/man8/apt-cache.8.gz", "/usr/share/man/es/man8/apt-cdrom.8.gz", "/usr/share/man/es/man8/apt-config.8.gz", "/usr/share/man/fr/man1/apt-transport-http.1.gz", "/usr/share/man/fr/man1/apt-transport-https.1.gz", "/usr/share/man/fr/man1/apt-transport-mirror.1.gz", "/usr/share/man/fr/man5/apt.conf.5.gz", "/usr/share/man/fr/man5/apt_auth.conf.5.gz", "/usr/share/man/fr/man5/apt_preferences.5.gz", "/usr/share/man/fr/man5/sources.list.5.gz", "/usr/share/man/fr/man7/apt-patterns.7.gz", "/usr/share/man/fr/man8/apt-cache.8.gz", "/usr/share/man/fr/man8/apt-cdrom.8.gz", "/usr/share/man/fr/man8/apt-config.8.gz", "/usr/share/man/fr/man8/apt-get.8.gz", "/usr/share/man/fr/man8/apt-mark.8.gz", "/usr/share/man/fr/man8/apt-secure.8.gz", "/usr/share/man/fr/man8/apt.8.gz", "/usr/share/man/it/man5/apt.conf.5.gz", "/usr/share/man/it/man5/apt_preferences.5.gz", "/usr/share/man/it/man8/apt-cache.8.gz", "/usr/share/man/it/man8/apt-cdrom.8.gz", "/usr/share/man/it/man8/apt-config.8.gz", "/usr/share/man/it/man8/apt-mark.8.gz", "/usr/share/man/it/man8/apt.8.gz", "/usr/share/man/ja/man5/apt.conf.5.gz", "/usr/share/man/ja/man5/apt_preferences.5.gz", "/usr/share/man/ja/man8/apt-cache.8.gz", "/usr/share/man/ja/man8/apt-cdrom.8.gz", "/usr/share/man/ja/man8/apt-config.8.gz", "/usr/share/man/ja/man8/apt-mark.8.gz", "/usr/share/man/ja/man8/apt.8.gz", "/usr/share/man/man1/apt-transport-http.1.gz", "/usr/share/man/man1/apt-transport-https.1.gz", "/usr/share/man/man1/apt-transport-mirror.1.gz", "/usr/share/man/man5/apt.conf.5.gz", "/usr/share/man/man5/apt_auth.conf.5.gz", "/usr/share/man/man5/apt_preferences.5.gz", "/usr/share/man/man5/sources.list.5.gz", "/usr/share/man/man7/apt-patterns.7.gz", "/usr/share/man/man8/apt-cache.8.gz", "/usr/share/man/man8/apt-cdrom.8.gz", "/usr/share/man/man8/apt-config.8.gz", "/usr/share/man/man8/apt-get.8.gz", "/usr/share/man/man8/apt-mark.8.gz", "/usr/share/man/man8/apt-secure.8.gz", "/usr/share/man/man8/apt.8.gz", "/usr/share/man/nl/man1/apt-transport-http.1.gz", "/usr/share/man/nl/man1/apt-transport-https.1.gz", "/usr/share/man/nl/man1/apt-transport-mirror.1.gz", "/usr/share/man/nl/man5/apt.conf.5.gz", "/usr/share/man/nl/man5/apt_auth.conf.5.gz", "/usr/share/man/nl/man5/apt_preferences.5.gz", "/usr/share/man/nl/man5/sources.list.5.gz", "/usr/share/man/nl/man7/apt-patterns.7.gz", "/usr/share/man/nl/man8/apt-cache.8.gz", "/usr/share/man/nl/man8/apt-cdrom.8.gz", "/usr/share/man/nl/man8/apt-config.8.gz", "/usr/share/man/nl/man8/apt-get.8.gz", "/usr/share/man/nl/man8/apt-mark.8.gz", "/usr/share/man/nl/man8/apt-secure.8.gz", "/usr/share/man/nl/man8/apt.8.gz", "/usr/share/man/pl/man5/apt_preferences.5.gz", "/usr/share/man/pl/man8/apt-cache.8.gz", "/usr/share/man/pl/man8/apt-cdrom.8.gz", "/usr/share/man/pl/man8/apt-config.8.gz", "/usr/share/man/pt/man1/apt-transport-http.1.gz", "/usr/share/man/pt/man1/apt-transport-https.1.gz", "/usr/share/man/pt/man1/apt-transport-mirror.1.gz", "/usr/share/man/pt/man5/apt.conf.5.gz", "/usr/share/man/pt/man5/apt_auth.conf.5.gz", "/usr/share/man/pt/man5/apt_preferences.5.gz", "/usr/share/man/pt/man5/sources.list.5.gz", "/usr/share/man/pt/man7/apt-patterns.7.gz", "/usr/share/man/pt/man8/apt-cache.8.gz", "/usr/share/man/pt/man8/apt-cdrom.8.gz", "/usr/share/man/pt/man8/apt-config.8.gz", "/usr/share/man/pt/man8/apt-get.8.gz", "/usr/share/man/pt/man8/apt-mark.8.gz", "/usr/share/man/pt/man8/apt-secure.8.gz", "/usr/share/man/pt/man8/apt.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "base-files@13.8+deb13u1", "Name": "base-files", "Identifier": { "PURL": "pkg:deb/debian/base-files@13.8%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "307a837561a4f4bd" }, "Version": "13.8+deb13u1", "Arch": "amd64", "SrcName": "base-files", "SrcVersion": "13.8+deb13u1", "Licenses": [ "GPL-2.0-or-later", "verbatim" ], "Maintainer": "Santiago Vila \u003csanvila@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/os-release", "/usr/share/base-files/dot.bashrc", "/usr/share/base-files/dot.profile", "/usr/share/base-files/dot.profile.md5sums", "/usr/share/base-files/info.dir", "/usr/share/base-files/motd", "/usr/share/base-files/profile", "/usr/share/base-files/profile.md5sums", "/usr/share/base-files/staff-group-for-usr-local", "/usr/share/common-licenses/Apache-2.0", "/usr/share/common-licenses/Artistic", "/usr/share/common-licenses/BSD", "/usr/share/common-licenses/CC0-1.0", "/usr/share/common-licenses/GFDL-1.2", "/usr/share/common-licenses/GFDL-1.3", "/usr/share/common-licenses/GPL-1", "/usr/share/common-licenses/GPL-2", "/usr/share/common-licenses/GPL-3", "/usr/share/common-licenses/LGPL-2", "/usr/share/common-licenses/LGPL-2.1", "/usr/share/common-licenses/LGPL-3", "/usr/share/common-licenses/MPL-1.1", "/usr/share/common-licenses/MPL-2.0", "/usr/share/doc/base-files/NEWS.Debian.gz", "/usr/share/doc/base-files/README", "/usr/share/doc/base-files/README.FHS", "/usr/share/doc/base-files/changelog.gz", "/usr/share/doc/base-files/copyright", "/usr/share/lintian/overrides/base-files" ], "AnalyzedBy": "dpkg" }, { "ID": "base-passwd@3.6.7", "Name": "base-passwd", "Identifier": { "PURL": "pkg:deb/debian/base-passwd@3.6.7?arch=amd64\u0026distro=debian-13.1", "UID": "71cb1054bb3b78a9" }, "Version": "3.6.7", "Arch": "amd64", "SrcName": "base-passwd", "SrcVersion": "3.6.7", "Licenses": [ "GPL-2.0-only", "public-domain" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libdebconfclient0@0.280", "libselinux1@3.8.1-1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/sbin/update-passwd", "/usr/share/base-passwd/group.master", "/usr/share/base-passwd/passwd.master", "/usr/share/doc-base/base-passwd.users-and-groups", "/usr/share/doc/base-passwd/README", "/usr/share/doc/base-passwd/changelog.gz", "/usr/share/doc/base-passwd/copyright", "/usr/share/doc/base-passwd/users-and-groups.html", "/usr/share/doc/base-passwd/users-and-groups.txt.gz", "/usr/share/lintian/overrides/base-passwd", "/usr/share/man/de/man8/update-passwd.8.gz", "/usr/share/man/es/man8/update-passwd.8.gz", "/usr/share/man/fr/man8/update-passwd.8.gz", "/usr/share/man/ja/man8/update-passwd.8.gz", "/usr/share/man/man8/update-passwd.8.gz", "/usr/share/man/pl/man8/update-passwd.8.gz", "/usr/share/man/ro/man8/update-passwd.8.gz", "/usr/share/man/ru/man8/update-passwd.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "bash@5.2.37-2+b5", "Name": "bash", "Identifier": { "PURL": "pkg:deb/debian/bash@5.2.37-2%2Bb5?arch=amd64\u0026distro=debian-13.1", "UID": "b9d1ff5c67584754" }, "Version": "5.2.37", "Release": "2+b5", "Arch": "amd64", "SrcName": "bash", "SrcVersion": "5.2.37", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-3+ with Bison exception", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only", "Latex2e", "BSD-4-Clause-UC", "MIT", "permissive" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "base-files@13.8+deb13u1", "debianutils@5.23.2" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/bash", "/usr/bin/bashbug", "/usr/bin/clear_console", "/usr/share/debianutils/shells.d/bash", "/usr/share/doc/bash/CHANGES.gz", "/usr/share/doc/bash/COMPAT.gz", "/usr/share/doc/bash/INTRO.gz", "/usr/share/doc/bash/NEWS.gz", "/usr/share/doc/bash/POSIX.gz", "/usr/share/doc/bash/RBASH", "/usr/share/doc/bash/README.Debian.gz", "/usr/share/doc/bash/README.abs-guide", "/usr/share/doc/bash/README.commands.gz", "/usr/share/doc/bash/README.gz", "/usr/share/doc/bash/changelog.Debian.amd64.gz", "/usr/share/doc/bash/changelog.Debian.gz", "/usr/share/doc/bash/changelog.gz", "/usr/share/doc/bash/copyright", "/usr/share/doc/bash/inputrc.arrows", "/usr/share/lintian/overrides/bash", "/usr/share/locale/af/LC_MESSAGES/bash.mo", "/usr/share/locale/bg/LC_MESSAGES/bash.mo", "/usr/share/locale/ca/LC_MESSAGES/bash.mo", "/usr/share/locale/cs/LC_MESSAGES/bash.mo", "/usr/share/locale/da/LC_MESSAGES/bash.mo", "/usr/share/locale/de/LC_MESSAGES/bash.mo", "/usr/share/locale/el/LC_MESSAGES/bash.mo", "/usr/share/locale/en@boldquot/LC_MESSAGES/bash.mo", "/usr/share/locale/en@quot/LC_MESSAGES/bash.mo", "/usr/share/locale/eo/LC_MESSAGES/bash.mo", "/usr/share/locale/es/LC_MESSAGES/bash.mo", "/usr/share/locale/et/LC_MESSAGES/bash.mo", "/usr/share/locale/fi/LC_MESSAGES/bash.mo", "/usr/share/locale/fr/LC_MESSAGES/bash.mo", "/usr/share/locale/ga/LC_MESSAGES/bash.mo", "/usr/share/locale/gl/LC_MESSAGES/bash.mo", "/usr/share/locale/hr/LC_MESSAGES/bash.mo", "/usr/share/locale/hu/LC_MESSAGES/bash.mo", "/usr/share/locale/id/LC_MESSAGES/bash.mo", "/usr/share/locale/it/LC_MESSAGES/bash.mo", "/usr/share/locale/ja/LC_MESSAGES/bash.mo", "/usr/share/locale/ko/LC_MESSAGES/bash.mo", "/usr/share/locale/lt/LC_MESSAGES/bash.mo", "/usr/share/locale/nb/LC_MESSAGES/bash.mo", "/usr/share/locale/nl/LC_MESSAGES/bash.mo", "/usr/share/locale/pl/LC_MESSAGES/bash.mo", "/usr/share/locale/pt/LC_MESSAGES/bash.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/bash.mo", "/usr/share/locale/ro/LC_MESSAGES/bash.mo", "/usr/share/locale/ru/LC_MESSAGES/bash.mo", "/usr/share/locale/sk/LC_MESSAGES/bash.mo", "/usr/share/locale/sl/LC_MESSAGES/bash.mo", "/usr/share/locale/sr/LC_MESSAGES/bash.mo", "/usr/share/locale/sv/LC_MESSAGES/bash.mo", "/usr/share/locale/tr/LC_MESSAGES/bash.mo", "/usr/share/locale/uk/LC_MESSAGES/bash.mo", "/usr/share/locale/vi/LC_MESSAGES/bash.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/bash.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/bash.mo", "/usr/share/man/man1/bash.1.gz", "/usr/share/man/man1/bashbug.1.gz", "/usr/share/man/man1/clear_console.1.gz", "/usr/share/man/man1/rbash.1.gz", "/usr/share/man/man7/bash-builtins.7.gz", "/usr/share/menu/bash" ], "AnalyzedBy": "dpkg" }, { "ID": "bash-completion@1:2.16.0-7", "Name": "bash-completion", "Identifier": { "PURL": "pkg:deb/debian/bash-completion@2.16.0-7?arch=all\u0026distro=debian-13.1\u0026epoch=1", "UID": "8587bcab5eb3439d" }, "Version": "2.16.0", "Release": "7", "Epoch": 1, "Arch": "all", "SrcName": "bash-completion", "SrcVersion": "2.16.0", "SrcRelease": "7", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Gabriel F. T. Gomes \u003cgabriel@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/bin/dh_bash-completion", "/usr/share/bash-completion/bash_completion", "/usr/share/bash-completion/completions/2to3", "/usr/share/bash-completion/completions/7z", "/usr/share/bash-completion/completions/_adb", "/usr/share/bash-completion/completions/_argc", "/usr/share/bash-completion/completions/_cal", "/usr/share/bash-completion/completions/_cargo", "/usr/share/bash-completion/completions/_chfn", "/usr/share/bash-completion/completions/_chsh", "/usr/share/bash-completion/completions/_coder", "/usr/share/bash-completion/completions/_delta", "/usr/share/bash-completion/completions/_dmesg", "/usr/share/bash-completion/completions/_eject", "/usr/share/bash-completion/completions/_flamegraph", "/usr/share/bash-completion/completions/_gaiacli", "/usr/share/bash-completion/completions/_gh", "/usr/share/bash-completion/completions/_golangci-lint", "/usr/share/bash-completion/completions/_gsctl", "/usr/share/bash-completion/completions/_hexdump", "/usr/share/bash-completion/completions/_hwclock", "/usr/share/bash-completion/completions/_insmod", "/usr/share/bash-completion/completions/_ionice", "/usr/share/bash-completion/completions/_jj", "/usr/share/bash-completion/completions/_jungle", "/usr/share/bash-completion/completions/_keyring", "/usr/share/bash-completion/completions/_kontena", "/usr/share/bash-completion/completions/_look", "/usr/share/bash-completion/completions/_mdbook", "/usr/share/bash-completion/completions/_mock", "/usr/share/bash-completion/completions/_modinfo", "/usr/share/bash-completion/completions/_modprobe", "/usr/share/bash-completion/completions/_modules", "/usr/share/bash-completion/completions/_mount", "/usr/share/bash-completion/completions/_mount.linux", "/usr/share/bash-completion/completions/_mtr", "/usr/share/bash-completion/completions/_newgrp", "/usr/share/bash-completion/completions/_nmcli", "/usr/share/bash-completion/completions/_nox", "/usr/share/bash-completion/completions/_nvm", "/usr/share/bash-completion/completions/_pip", "/usr/share/bash-completion/completions/_pipenv", "/usr/share/bash-completion/completions/_renice", "/usr/share/bash-completion/completions/_repomanage", "/usr/share/bash-completion/completions/_reptyr", "/usr/share/bash-completion/completions/_rfkill", "/usr/share/bash-completion/completions/_rg", "/usr/share/bash-completion/completions/_rmmod", "/usr/share/bash-completion/completions/_rtcwake", "/usr/share/bash-completion/completions/_ruff", "/usr/share/bash-completion/completions/_runuser", "/usr/share/bash-completion/completions/_rustup", "/usr/share/bash-completion/completions/_secret-tool", "/usr/share/bash-completion/completions/_slackpkg", "/usr/share/bash-completion/completions/_sops", "/usr/share/bash-completion/completions/_stern", "/usr/share/bash-completion/completions/_stripe", "/usr/share/bash-completion/completions/_su", "/usr/share/bash-completion/completions/_svn", "/usr/share/bash-completion/completions/_svnadmin", "/usr/share/bash-completion/completions/_svnlook", "/usr/share/bash-completion/completions/_task", "/usr/share/bash-completion/completions/_tokio-console", "/usr/share/bash-completion/completions/_udevadm", "/usr/share/bash-completion/completions/_umount", "/usr/share/bash-completion/completions/_umount.linux", "/usr/share/bash-completion/completions/_uvx", "/usr/share/bash-completion/completions/_vault", "/usr/share/bash-completion/completions/_wasmer", "/usr/share/bash-completion/completions/_write", "/usr/share/bash-completion/completions/_xm", "/usr/share/bash-completion/completions/_yq", "/usr/share/bash-completion/completions/_yum", "/usr/share/bash-completion/completions/a2x", "/usr/share/bash-completion/completions/abook", "/usr/share/bash-completion/completions/aclocal", "/usr/share/bash-completion/completions/acpi", "/usr/share/bash-completion/completions/add_members", "/usr/share/bash-completion/completions/alias", "/usr/share/bash-completion/completions/ant", "/usr/share/bash-completion/completions/apache2ctl", "/usr/share/bash-completion/completions/appdata-validate", "/usr/share/bash-completion/completions/apt-build", "/usr/share/bash-completion/completions/apt-cache", "/usr/share/bash-completion/completions/apt-get", "/usr/share/bash-completion/completions/apt-mark", "/usr/share/bash-completion/completions/aptitude", "/usr/share/bash-completion/completions/arch", "/usr/share/bash-completion/completions/arp", "/usr/share/bash-completion/completions/arping", "/usr/share/bash-completion/completions/arpspoof", "/usr/share/bash-completion/completions/asciidoc", "/usr/share/bash-completion/completions/aspell", "/usr/share/bash-completion/completions/autoconf", "/usr/share/bash-completion/completions/automake", "/usr/share/bash-completion/completions/autoreconf", "/usr/share/bash-completion/completions/autorpm", "/usr/share/bash-completion/completions/autoscan", "/usr/share/bash-completion/completions/avahi-browse", "/usr/share/bash-completion/completions/avctrl", "/usr/share/bash-completion/completions/badblocks", "/usr/share/bash-completion/completions/bind", "/usr/share/bash-completion/completions/bk", "/usr/share/bash-completion/completions/brctl", "/usr/share/bash-completion/completions/btdownloadheadless.py", "/usr/share/bash-completion/completions/bzip2", "/usr/share/bash-completion/completions/cancel", "/usr/share/bash-completion/completions/cardctl", "/usr/share/bash-completion/completions/carton", "/usr/share/bash-completion/completions/ccache", "/usr/share/bash-completion/completions/ccze", "/usr/share/bash-completion/completions/cd", "/usr/share/bash-completion/completions/cfagent", "/usr/share/bash-completion/completions/cfrun", "/usr/share/bash-completion/completions/chage", "/usr/share/bash-completion/completions/change_pw", "/usr/share/bash-completion/completions/check_db", "/usr/share/bash-completion/completions/check_perms", "/usr/share/bash-completion/completions/checksec", "/usr/share/bash-completion/completions/chflags", "/usr/share/bash-completion/completions/chgrp", "/usr/share/bash-completion/completions/chkconfig", "/usr/share/bash-completion/completions/chmod", "/usr/share/bash-completion/completions/chown", "/usr/share/bash-completion/completions/chpasswd", "/usr/share/bash-completion/completions/chromium-browser", "/usr/share/bash-completion/completions/chronyc", "/usr/share/bash-completion/completions/chrpath", "/usr/share/bash-completion/completions/cksfv", "/usr/share/bash-completion/completions/cleanarch", "/usr/share/bash-completion/completions/clisp", "/usr/share/bash-completion/completions/clone_member", "/usr/share/bash-completion/completions/complete", "/usr/share/bash-completion/completions/config_list", "/usr/share/bash-completion/completions/configure", "/usr/share/bash-completion/completions/convert", "/usr/share/bash-completion/completions/cowsay", "/usr/share/bash-completion/completions/cpan2dist", "/usr/share/bash-completion/completions/cpio", "/usr/share/bash-completion/completions/cppcheck", "/usr/share/bash-completion/completions/crontab", "/usr/share/bash-completion/completions/cryptsetup", "/usr/share/bash-completion/completions/curl", "/usr/share/bash-completion/completions/cvs", "/usr/share/bash-completion/completions/cvsps", "/usr/share/bash-completion/completions/dd", "/usr/share/bash-completion/completions/declare", "/usr/share/bash-completion/completions/deja-dup", "/usr/share/bash-completion/completions/desktop-file-validate", "/usr/share/bash-completion/completions/dhclient", "/usr/share/bash-completion/completions/dict", "/usr/share/bash-completion/completions/dmypy", "/usr/share/bash-completion/completions/dnssec-keygen", "/usr/share/bash-completion/completions/dnsspoof", "/usr/share/bash-completion/completions/dot", "/usr/share/bash-completion/completions/dpkg", "/usr/share/bash-completion/completions/dpkg-source", "/usr/share/bash-completion/completions/dselect", "/usr/share/bash-completion/completions/dsniff", "/usr/share/bash-completion/completions/dumpdb", "/usr/share/bash-completion/completions/dumpe2fs", "/usr/share/bash-completion/completions/e2freefrag", "/usr/share/bash-completion/completions/e2label", "/usr/share/bash-completion/completions/ebtables", "/usr/share/bash-completion/completions/ecryptfs-migrate-home", "/usr/share/bash-completion/completions/env", "/usr/share/bash-completion/completions/eog", "/usr/share/bash-completion/completions/ether-wake", "/usr/share/bash-completion/completions/evince", "/usr/share/bash-completion/completions/explodepkg", "/usr/share/bash-completion/completions/export", "/usr/share/bash-completion/completions/faillog", "/usr/share/bash-completion/completions/fbgs", "/usr/share/bash-completion/completions/fbi", "/usr/share/bash-completion/completions/feh", "/usr/share/bash-completion/completions/file", "/usr/share/bash-completion/completions/file-roller", "/usr/share/bash-completion/completions/filefrag", "/usr/share/bash-completion/completions/filesnarf", "/usr/share/bash-completion/completions/find", "/usr/share/bash-completion/completions/find_member", "/usr/share/bash-completion/completions/fio", "/usr/share/bash-completion/completions/firefox", "/usr/share/bash-completion/completions/flake8", "/usr/share/bash-completion/completions/fprintd-delete", "/usr/share/bash-completion/completions/fprintd-enroll", "/usr/share/bash-completion/completions/freeciv", "/usr/share/bash-completion/completions/freeciv-server", "/usr/share/bash-completion/completions/function", "/usr/share/bash-completion/completions/fusermount", "/usr/share/bash-completion/completions/gcc", "/usr/share/bash-completion/completions/gcl", "/usr/share/bash-completion/completions/gdb", "/usr/share/bash-completion/completions/genaliases", "/usr/share/bash-completion/completions/gendiff", "/usr/share/bash-completion/completions/genisoimage", "/usr/share/bash-completion/completions/geoiplookup", "/usr/share/bash-completion/completions/getconf", "/usr/share/bash-completion/completions/getent", "/usr/share/bash-completion/completions/gkrellm", "/usr/share/bash-completion/completions/gm", "/usr/share/bash-completion/completions/gnatmake", "/usr/share/bash-completion/completions/gnokii", "/usr/share/bash-completion/completions/gnome-mplayer", "/usr/share/bash-completion/completions/gnome-screenshot", "/usr/share/bash-completion/completions/gpasswd", "/usr/share/bash-completion/completions/gpg", "/usr/share/bash-completion/completions/gpg2", "/usr/share/bash-completion/completions/gpgv", "/usr/share/bash-completion/completions/gphoto2", "/usr/share/bash-completion/completions/gprof", "/usr/share/bash-completion/completions/groupadd", "/usr/share/bash-completion/completions/groupdel", "/usr/share/bash-completion/completions/groupmems", "/usr/share/bash-completion/completions/groupmod", "/usr/share/bash-completion/completions/growisofs", "/usr/share/bash-completion/completions/grpck", "/usr/share/bash-completion/completions/gssdp-discover", "/usr/share/bash-completion/completions/gzip", "/usr/share/bash-completion/completions/hash", "/usr/share/bash-completion/completions/hcitool", "/usr/share/bash-completion/completions/hddtemp", "/usr/share/bash-completion/completions/help", "/usr/share/bash-completion/completions/hid2hci", "/usr/share/bash-completion/completions/hostname", "/usr/share/bash-completion/completions/hping2", "/usr/share/bash-completion/completions/htop", "/usr/share/bash-completion/completions/htpasswd", "/usr/share/bash-completion/completions/hunspell", "/usr/share/bash-completion/completions/iconv", "/usr/share/bash-completion/completions/id", "/usr/share/bash-completion/completions/idn", "/usr/share/bash-completion/completions/ifstat", "/usr/share/bash-completion/completions/iftop", "/usr/share/bash-completion/completions/ifup", "/usr/share/bash-completion/completions/influx", "/usr/share/bash-completion/completions/info", "/usr/share/bash-completion/completions/inject", "/usr/share/bash-completion/completions/inotifywait", "/usr/share/bash-completion/completions/installpkg", "/usr/share/bash-completion/completions/interdiff", "/usr/share/bash-completion/completions/invoke-rc.d", "/usr/share/bash-completion/completions/ip", "/usr/share/bash-completion/completions/ipcalc", "/usr/share/bash-completion/completions/iperf", "/usr/share/bash-completion/completions/ipmitool", "/usr/share/bash-completion/completions/ipsec", "/usr/share/bash-completion/completions/iptables", "/usr/share/bash-completion/completions/ipv6calc", "/usr/share/bash-completion/completions/iscsiadm", "/usr/share/bash-completion/completions/isort", "/usr/share/bash-completion/completions/isql", "/usr/share/bash-completion/completions/iwconfig", "/usr/share/bash-completion/completions/iwlist", "/usr/share/bash-completion/completions/iwpriv", "/usr/share/bash-completion/completions/iwspy", "/usr/share/bash-completion/completions/jar", "/usr/share/bash-completion/completions/jarsigner", "/usr/share/bash-completion/completions/java", "/usr/share/bash-completion/completions/javaws", "/usr/share/bash-completion/completions/jpegoptim", "/usr/share/bash-completion/completions/jps", "/usr/share/bash-completion/completions/jq", "/usr/share/bash-completion/completions/jshint", "/usr/share/bash-completion/completions/json_xs", "/usr/share/bash-completion/completions/jsonschema", "/usr/share/bash-completion/completions/k3b", "/usr/share/bash-completion/completions/kcov", "/usr/share/bash-completion/completions/kill", "/usr/share/bash-completion/completions/killall", "/usr/share/bash-completion/completions/koji", "/usr/share/bash-completion/completions/ktutil", "/usr/share/bash-completion/completions/larch", "/usr/share/bash-completion/completions/lastlog", "/usr/share/bash-completion/completions/ldapsearch", "/usr/share/bash-completion/completions/ldapvi", "/usr/share/bash-completion/completions/lftp", "/usr/share/bash-completion/completions/lftpget", "/usr/share/bash-completion/completions/lilo", "/usr/share/bash-completion/completions/links", "/usr/share/bash-completion/completions/lintian", "/usr/share/bash-completion/completions/lisp", "/usr/share/bash-completion/completions/list_admins", "/usr/share/bash-completion/completions/list_lists", "/usr/share/bash-completion/completions/list_members", "/usr/share/bash-completion/completions/list_owners", "/usr/share/bash-completion/completions/locale-gen", "/usr/share/bash-completion/completions/lpq", "/usr/share/bash-completion/completions/lpr", "/usr/share/bash-completion/completions/lrzip", "/usr/share/bash-completion/completions/lsof", "/usr/share/bash-completion/completions/lsscsi", "/usr/share/bash-completion/completions/lsusb", "/usr/share/bash-completion/completions/lua", "/usr/share/bash-completion/completions/luac", "/usr/share/bash-completion/completions/luseradd", "/usr/share/bash-completion/completions/luserdel", "/usr/share/bash-completion/completions/lvm", "/usr/share/bash-completion/completions/lz4", "/usr/share/bash-completion/completions/lzip", "/usr/share/bash-completion/completions/lzma", "/usr/share/bash-completion/completions/lzop", "/usr/share/bash-completion/completions/macof", "/usr/share/bash-completion/completions/mailmanctl", "/usr/share/bash-completion/completions/make", "/usr/share/bash-completion/completions/makepkg", "/usr/share/bash-completion/completions/man", "/usr/share/bash-completion/completions/mc", "/usr/share/bash-completion/completions/mcrypt", "/usr/share/bash-completion/completions/mdadm", "/usr/share/bash-completion/completions/mdtool", "/usr/share/bash-completion/completions/medusa", "/usr/share/bash-completion/completions/mfiutil", "/usr/share/bash-completion/completions/mii-diag", "/usr/share/bash-completion/completions/mii-tool", "/usr/share/bash-completion/completions/minicom", "/usr/share/bash-completion/completions/mkinitrd", "/usr/share/bash-completion/completions/mktemp", "/usr/share/bash-completion/completions/mmsitepass", "/usr/share/bash-completion/completions/monodevelop", "/usr/share/bash-completion/completions/mplayer", "/usr/share/bash-completion/completions/mr", "/usr/share/bash-completion/completions/msynctool", "/usr/share/bash-completion/completions/mtx", "/usr/share/bash-completion/completions/munin-node-configure", "/usr/share/bash-completion/completions/munin-run", "/usr/share/bash-completion/completions/munin-update", "/usr/share/bash-completion/completions/munindoc", "/usr/share/bash-completion/completions/mussh", "/usr/share/bash-completion/completions/mutt", "/usr/share/bash-completion/completions/mypy", "/usr/share/bash-completion/completions/mysql", "/usr/share/bash-completion/completions/mysqladmin", "/usr/share/bash-completion/completions/nc", "/usr/share/bash-completion/completions/ncftp", "/usr/share/bash-completion/completions/nethogs", "/usr/share/bash-completion/completions/newlist", "/usr/share/bash-completion/completions/newusers", "/usr/share/bash-completion/completions/ngrep", "/usr/share/bash-completion/completions/nmap", "/usr/share/bash-completion/completions/nproc", "/usr/share/bash-completion/completions/nslookup", "/usr/share/bash-completion/completions/nsupdate", "/usr/share/bash-completion/completions/ntpdate", "/usr/share/bash-completion/completions/oggdec", "/usr/share/bash-completion/completions/openssl", "/usr/share/bash-completion/completions/opera", "/usr/share/bash-completion/completions/optipng", "/usr/share/bash-completion/completions/p4", "/usr/share/bash-completion/completions/pack200", "/usr/share/bash-completion/completions/passwd", "/usr/share/bash-completion/completions/patch", "/usr/share/bash-completion/completions/pdftoppm", "/usr/share/bash-completion/completions/pdftotext", "/usr/share/bash-completion/completions/perl", "/usr/share/bash-completion/completions/perlcritic", "/usr/share/bash-completion/completions/perltidy", "/usr/share/bash-completion/completions/pgrep", "/usr/share/bash-completion/completions/pidof", "/usr/share/bash-completion/completions/pine", "/usr/share/bash-completion/completions/ping", "/usr/share/bash-completion/completions/pkg-config", "/usr/share/bash-completion/completions/pkg-get", "/usr/share/bash-completion/completions/pkgadd", "/usr/share/bash-completion/completions/pkgrm", "/usr/share/bash-completion/completions/pkgtool", "/usr/share/bash-completion/completions/plague-client", "/usr/share/bash-completion/completions/pm-hibernate", "/usr/share/bash-completion/completions/pm-is-supported", "/usr/share/bash-completion/completions/pm-powersave", "/usr/share/bash-completion/completions/pngfix", "/usr/share/bash-completion/completions/postcat", "/usr/share/bash-completion/completions/postconf", "/usr/share/bash-completion/completions/postfix", "/usr/share/bash-completion/completions/postmap", "/usr/share/bash-completion/completions/postsuper", "/usr/share/bash-completion/completions/povray", "/usr/share/bash-completion/completions/prelink", "/usr/share/bash-completion/completions/printenv", "/usr/share/bash-completion/completions/protoc", "/usr/share/bash-completion/completions/ps", "/usr/share/bash-completion/completions/psql", "/usr/share/bash-completion/completions/puppet", "/usr/share/bash-completion/completions/pv", "/usr/share/bash-completion/completions/pwck", "/usr/share/bash-completion/completions/pwd", "/usr/share/bash-completion/completions/pwdx", "/usr/share/bash-completion/completions/pwgen", "/usr/share/bash-completion/completions/pycodestyle", "/usr/share/bash-completion/completions/pydoc", "/usr/share/bash-completion/completions/pydocstyle", "/usr/share/bash-completion/completions/pyflakes", "/usr/share/bash-completion/completions/pylint", "/usr/share/bash-completion/completions/pytest", "/usr/share/bash-completion/completions/python", "/usr/share/bash-completion/completions/pyvenv", "/usr/share/bash-completion/completions/qdbus", "/usr/share/bash-completion/completions/qemu", "/usr/share/bash-completion/completions/qrunner", "/usr/share/bash-completion/completions/querybts", "/usr/share/bash-completion/completions/quota", "/usr/share/bash-completion/completions/radvdump", "/usr/share/bash-completion/completions/rcs", "/usr/share/bash-completion/completions/rdesktop", "/usr/share/bash-completion/completions/remove_members", "/usr/share/bash-completion/completions/removepkg", "/usr/share/bash-completion/completions/reportbug", "/usr/share/bash-completion/completions/resolvconf", "/usr/share/bash-completion/completions/ri", "/usr/share/bash-completion/completions/rmlist", "/usr/share/bash-completion/completions/route", "/usr/share/bash-completion/completions/rpcdebug", "/usr/share/bash-completion/completions/rpm", "/usr/share/bash-completion/completions/rpm2tgz", "/usr/share/bash-completion/completions/rpmcheck", "/usr/share/bash-completion/completions/rrdtool", "/usr/share/bash-completion/completions/rsync", "/usr/share/bash-completion/completions/sbcl", "/usr/share/bash-completion/completions/sbopkg", "/usr/share/bash-completion/completions/screen", "/usr/share/bash-completion/completions/scrub", "/usr/share/bash-completion/completions/set", "/usr/share/bash-completion/completions/sh", "/usr/share/bash-completion/completions/sha256sum", "/usr/share/bash-completion/completions/shellcheck", "/usr/share/bash-completion/completions/sitecopy", "/usr/share/bash-completion/completions/slabtop", "/usr/share/bash-completion/completions/slapt-get", "/usr/share/bash-completion/completions/slapt-src", "/usr/share/bash-completion/completions/smartctl", "/usr/share/bash-completion/completions/smbclient", "/usr/share/bash-completion/completions/snownews", "/usr/share/bash-completion/completions/sqlite3", "/usr/share/bash-completion/completions/ss", "/usr/share/bash-completion/completions/ssh", "/usr/share/bash-completion/completions/ssh-add", "/usr/share/bash-completion/completions/ssh-copy-id", "/usr/share/bash-completion/completions/ssh-keygen", "/usr/share/bash-completion/completions/ssh-keyscan", "/usr/share/bash-completion/completions/sshfs", "/usr/share/bash-completion/completions/sshmitm", "/usr/share/bash-completion/completions/sshow", "/usr/share/bash-completion/completions/strace", "/usr/share/bash-completion/completions/strings", "/usr/share/bash-completion/completions/sudo", "/usr/share/bash-completion/completions/svcadm", "/usr/share/bash-completion/completions/svk", "/usr/share/bash-completion/completions/sync_members", "/usr/share/bash-completion/completions/synclient", "/usr/share/bash-completion/completions/sysbench", "/usr/share/bash-completion/completions/sysctl", "/usr/share/bash-completion/completions/tar", "/usr/share/bash-completion/completions/tcpdump", "/usr/share/bash-completion/completions/tcpkill", "/usr/share/bash-completion/completions/tcpnice", "/usr/share/bash-completion/completions/timeout", "/usr/share/bash-completion/completions/tipc", "/usr/share/bash-completion/completions/tox", "/usr/share/bash-completion/completions/tracepath", "/usr/share/bash-completion/completions/tree", "/usr/share/bash-completion/completions/truncate", "/usr/share/bash-completion/completions/tshark", "/usr/share/bash-completion/completions/tsig-keygen", "/usr/share/bash-completion/completions/tune2fs", "/usr/share/bash-completion/completions/ulimit", "/usr/share/bash-completion/completions/unace", "/usr/share/bash-completion/completions/unpack200", "/usr/share/bash-completion/completions/unrar", "/usr/share/bash-completion/completions/unshunt", "/usr/share/bash-completion/completions/update-alternatives", "/usr/share/bash-completion/completions/update-rc.d", "/usr/share/bash-completion/completions/upgradepkg", "/usr/share/bash-completion/completions/urlsnarf", "/usr/share/bash-completion/completions/useradd", "/usr/share/bash-completion/completions/userdel", "/usr/share/bash-completion/completions/usermod", "/usr/share/bash-completion/completions/valgrind", "/usr/share/bash-completion/completions/vipw", "/usr/share/bash-completion/completions/vmstat", "/usr/share/bash-completion/completions/vncviewer", "/usr/share/bash-completion/completions/vpnc", "/usr/share/bash-completion/completions/watch", "/usr/share/bash-completion/completions/webmitm", "/usr/share/bash-completion/completions/wget", "/usr/share/bash-completion/completions/wine", "/usr/share/bash-completion/completions/withlist", "/usr/share/bash-completion/completions/wodim", "/usr/share/bash-completion/completions/wol", "/usr/share/bash-completion/completions/wsimport", "/usr/share/bash-completion/completions/wtf", "/usr/share/bash-completion/completions/wvdial", "/usr/share/bash-completion/completions/xdg-mime", "/usr/share/bash-completion/completions/xdg-settings", "/usr/share/bash-completion/completions/xev", "/usr/share/bash-completion/completions/xfreerdp", "/usr/share/bash-completion/completions/xgamma", "/usr/share/bash-completion/completions/xhost", "/usr/share/bash-completion/completions/xmllint", "/usr/share/bash-completion/completions/xmlwf", "/usr/share/bash-completion/completions/xmms", "/usr/share/bash-completion/completions/xmodmap", "/usr/share/bash-completion/completions/xrandr", "/usr/share/bash-completion/completions/xrdb", "/usr/share/bash-completion/completions/xsltproc", "/usr/share/bash-completion/completions/xvfb-run", "/usr/share/bash-completion/completions/xxd", "/usr/share/bash-completion/completions/xz", "/usr/share/bash-completion/completions/xzdec", "/usr/share/bash-completion/completions/ypmatch", "/usr/share/bash-completion/completions/yum-arch", "/usr/share/bash-completion/completions/zopfli", "/usr/share/bash-completion/completions/zopflipng", "/usr/share/bash-completion/helpers/make-extract-targets.awk", "/usr/share/bash-completion/helpers/perl", "/usr/share/bash-completion/helpers/python", "/usr/share/cmake/bash-completion/bash-completion-config-version.cmake", "/usr/share/cmake/bash-completion/bash-completion-config.cmake", "/usr/share/doc/bash-completion/AUTHORS", "/usr/share/doc/bash-completion/CONTRIBUTING.md.gz", "/usr/share/doc/bash-completion/README.Debian", "/usr/share/doc/bash-completion/README.md.gz", "/usr/share/doc/bash-completion/changelog.Debian.gz", "/usr/share/doc/bash-completion/changelog.gz", "/usr/share/doc/bash-completion/copyright", "/usr/share/lintian/overrides/bash-completion", "/usr/share/man/man1/dh_bash-completion.1.gz", "/usr/share/perl5/Debian/Debhelper/Sequence/bash_completion.pm", "/usr/share/pkgconfig/bash-completion.pc" ], "AnalyzedBy": "dpkg" }, { "ID": "bsdutils@1:2.41-5", "Name": "bsdutils", "Identifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "5843733a461e6ce1" }, "Version": "2.41", "Release": "5", "Epoch": 1, "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/logger", "/usr/bin/renice", "/usr/bin/script", "/usr/bin/scriptlive", "/usr/bin/scriptreplay", "/usr/bin/wall", "/usr/share/bash-completion/completions/logger", "/usr/share/bash-completion/completions/renice", "/usr/share/bash-completion/completions/script", "/usr/share/bash-completion/completions/scriptlive", "/usr/share/bash-completion/completions/scriptreplay", "/usr/share/bash-completion/completions/wall", "/usr/share/doc/bsdutils/NEWS.Debian.gz", "/usr/share/doc/bsdutils/changelog.Debian.gz", "/usr/share/doc/bsdutils/changelog.gz", "/usr/share/doc/bsdutils/copyright", "/usr/share/lintian/overrides/bsdutils", "/usr/share/man/man1/logger.1.gz", "/usr/share/man/man1/renice.1.gz", "/usr/share/man/man1/script.1.gz", "/usr/share/man/man1/scriptlive.1.gz", "/usr/share/man/man1/scriptreplay.1.gz", "/usr/share/man/man1/wall.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ca-certificates@20250419", "Name": "ca-certificates", "Identifier": { "PURL": "pkg:deb/debian/ca-certificates@20250419?arch=all\u0026distro=debian-13.1", "UID": "8a14418b57dc4e02" }, "Version": "20250419", "Arch": "all", "SrcName": "ca-certificates", "SrcVersion": "20250419", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "MPL-2.0" ], "Maintainer": "Julien Cristau \u003cjcristau@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "openssl@3.5.1-1+deb13u1" ], "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "InstalledFiles": [ "/usr/sbin/update-ca-certificates", "/usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", "/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", "/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", "/usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", "/usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", "/usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", "/usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", "/usr/share/ca-certificates/mozilla/Baltimore_CyberTrust_Root.crt", "/usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", "/usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", "/usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", "/usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", "/usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", "/usr/share/ca-certificates/mozilla/Certigna.crt", "/usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_ECC_Root-01.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_ECC_Root-02.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_RSA_Root-01.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_RSA_Root-02.crt", "/usr/share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", "/usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", "/usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", "/usr/share/ca-certificates/mozilla/Entrust.net_Premium_2048_Secure_Server_CA.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/FIRMAPROFESIONAL_CA_ROOT-A_WEB.crt", "/usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", "/usr/share/ca-certificates/mozilla/GLOBALTRUST_2020.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R2.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", "/usr/share/ca-certificates/mozilla/Go_Daddy_Class_2_CA.crt", "/usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", "/usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", "/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", "/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", "/usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", "/usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", "/usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", "/usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Izenpe.com.crt", "/usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", "/usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", "/usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", "/usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", "/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", "/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", "/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", "/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", "/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", "/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", "/usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", "/usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", "/usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", "/usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", "/usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", "/usr/share/ca-certificates/mozilla/SecureSign_Root_CA12.crt", "/usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", "/usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", "/usr/share/ca-certificates/mozilla/SecureTrust_CA.crt", "/usr/share/ca-certificates/mozilla/Secure_Global_CA.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", "/usr/share/ca-certificates/mozilla/Starfield_Class_2_CA.crt", "/usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt", "/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", "/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", "/usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", "/usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", "/usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", "/usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", "/usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", "/usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt", "/usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", "/usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", "/usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P256_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P384_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", "/usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", "/usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", "/usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/XRamp_Global_CA_Root.crt", "/usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt", "/usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", "/usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", "/usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", "/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", "/usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", "/usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", "/usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", "/usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt", "/usr/share/doc/ca-certificates/README.Debian", "/usr/share/doc/ca-certificates/changelog.gz", "/usr/share/doc/ca-certificates/copyright", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/Makefile", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/README", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/ca-certificates-local.triggers", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/changelog", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/compat", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/control", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/copyright", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/postrm", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/rules", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/source/format", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/local/Local_Root_CA.crt", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/local/Makefile", "/usr/share/man/man8/update-ca-certificates.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "coreutils@9.7-3", "Name": "coreutils", "Identifier": { "PURL": "pkg:deb/debian/coreutils@9.7-3?arch=amd64\u0026distro=debian-13.1", "UID": "cb4a55f50bda2393" }, "Version": "9.7", "Release": "3", "Arch": "amd64", "SrcName": "coreutils", "SrcVersion": "9.7", "SrcRelease": "3", "Licenses": [ "GPL-3.0-or-later", "BSD-4-Clause-UC", "GPL-3.0-only", "ISC", "FSFULLR", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only" ], "Maintainer": "Michael Stone \u003cmstone@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/[", "/usr/bin/arch", "/usr/bin/b2sum", "/usr/bin/base32", "/usr/bin/base64", "/usr/bin/basename", "/usr/bin/basenc", "/usr/bin/cat", "/usr/bin/chcon", "/usr/bin/chgrp", "/usr/bin/chmod", "/usr/bin/chown", "/usr/bin/cksum", "/usr/bin/comm", "/usr/bin/cp", "/usr/bin/csplit", "/usr/bin/cut", "/usr/bin/date", "/usr/bin/dd", "/usr/bin/df", "/usr/bin/dir", "/usr/bin/dircolors", "/usr/bin/dirname", "/usr/bin/du", "/usr/bin/echo", "/usr/bin/env", "/usr/bin/expand", "/usr/bin/expr", "/usr/bin/factor", "/usr/bin/false", "/usr/bin/fmt", "/usr/bin/fold", "/usr/bin/groups", "/usr/bin/head", "/usr/bin/hostid", "/usr/bin/id", "/usr/bin/install", "/usr/bin/join", "/usr/bin/link", "/usr/bin/ln", "/usr/bin/logname", "/usr/bin/ls", "/usr/bin/md5sum", "/usr/bin/mkdir", "/usr/bin/mkfifo", "/usr/bin/mknod", "/usr/bin/mktemp", "/usr/bin/mv", "/usr/bin/nice", "/usr/bin/nl", "/usr/bin/nohup", "/usr/bin/nproc", "/usr/bin/numfmt", "/usr/bin/od", "/usr/bin/paste", "/usr/bin/pathchk", "/usr/bin/pinky", "/usr/bin/pr", "/usr/bin/printenv", "/usr/bin/printf", "/usr/bin/ptx", "/usr/bin/pwd", "/usr/bin/readlink", "/usr/bin/realpath", "/usr/bin/rm", "/usr/bin/rmdir", "/usr/bin/runcon", "/usr/bin/seq", "/usr/bin/sha1sum", "/usr/bin/sha224sum", "/usr/bin/sha256sum", "/usr/bin/sha384sum", "/usr/bin/sha512sum", "/usr/bin/shred", "/usr/bin/shuf", "/usr/bin/sleep", "/usr/bin/sort", "/usr/bin/split", "/usr/bin/stat", "/usr/bin/stdbuf", "/usr/bin/stty", "/usr/bin/sum", "/usr/bin/sync", "/usr/bin/tac", "/usr/bin/tail", "/usr/bin/tee", "/usr/bin/test", "/usr/bin/timeout", "/usr/bin/touch", "/usr/bin/tr", "/usr/bin/true", "/usr/bin/truncate", "/usr/bin/tsort", "/usr/bin/tty", "/usr/bin/uname", "/usr/bin/unexpand", "/usr/bin/uniq", "/usr/bin/unlink", "/usr/bin/users", "/usr/bin/vdir", "/usr/bin/wc", "/usr/bin/who", "/usr/bin/whoami", "/usr/bin/yes", "/usr/libexec/coreutils/libstdbuf.so", "/usr/sbin/chroot", "/usr/share/doc/coreutils/AUTHORS", "/usr/share/doc/coreutils/NEWS.gz", "/usr/share/doc/coreutils/README.Debian", "/usr/share/doc/coreutils/README.gz", "/usr/share/doc/coreutils/THANKS.gz", "/usr/share/doc/coreutils/TODO.gz", "/usr/share/doc/coreutils/changelog.Debian.gz", "/usr/share/doc/coreutils/changelog.gz", "/usr/share/doc/coreutils/copyright", "/usr/share/info/coreutils.info.gz", "/usr/share/lintian/overrides/coreutils", "/usr/share/locale/af/LC_MESSAGES/coreutils.mo", "/usr/share/locale/be/LC_MESSAGES/coreutils.mo", "/usr/share/locale/bg/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ca/LC_MESSAGES/coreutils.mo", "/usr/share/locale/cs/LC_MESSAGES/coreutils.mo", "/usr/share/locale/da/LC_MESSAGES/coreutils.mo", "/usr/share/locale/de/LC_MESSAGES/coreutils.mo", "/usr/share/locale/el/LC_MESSAGES/coreutils.mo", "/usr/share/locale/eo/LC_MESSAGES/coreutils.mo", "/usr/share/locale/es/LC_MESSAGES/coreutils.mo", "/usr/share/locale/et/LC_MESSAGES/coreutils.mo", "/usr/share/locale/eu/LC_MESSAGES/coreutils.mo", "/usr/share/locale/fi/LC_MESSAGES/coreutils.mo", "/usr/share/locale/fr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ga/LC_MESSAGES/coreutils.mo", "/usr/share/locale/gl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/hr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/hu/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ia/LC_MESSAGES/coreutils.mo", "/usr/share/locale/id/LC_MESSAGES/coreutils.mo", "/usr/share/locale/it/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ja/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ka/LC_MESSAGES/coreutils.mo", "/usr/share/locale/kk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ko/LC_MESSAGES/coreutils.mo", "/usr/share/locale/lg/LC_MESSAGES/coreutils.mo", "/usr/share/locale/lt/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ms/LC_MESSAGES/coreutils.mo", "/usr/share/locale/nb/LC_MESSAGES/coreutils.mo", "/usr/share/locale/nl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pt/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ro/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ru/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sv/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ta/LC_MESSAGES/coreutils.mo", "/usr/share/locale/tr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/uk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/vi/LC_MESSAGES/coreutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/coreutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/coreutils.mo", "/usr/share/man/man1/arch.1.gz", "/usr/share/man/man1/b2sum.1.gz", "/usr/share/man/man1/base32.1.gz", "/usr/share/man/man1/base64.1.gz", "/usr/share/man/man1/basename.1.gz", "/usr/share/man/man1/basenc.1.gz", "/usr/share/man/man1/cat.1.gz", "/usr/share/man/man1/chcon.1.gz", "/usr/share/man/man1/chgrp.1.gz", "/usr/share/man/man1/chmod.1.gz", "/usr/share/man/man1/chown.1.gz", "/usr/share/man/man1/cksum.1.gz", "/usr/share/man/man1/comm.1.gz", "/usr/share/man/man1/cp.1.gz", "/usr/share/man/man1/csplit.1.gz", "/usr/share/man/man1/cut.1.gz", "/usr/share/man/man1/date.1.gz", "/usr/share/man/man1/dd.1.gz", "/usr/share/man/man1/df.1.gz", "/usr/share/man/man1/dir.1.gz", "/usr/share/man/man1/dircolors.1.gz", "/usr/share/man/man1/dirname.1.gz", "/usr/share/man/man1/du.1.gz", "/usr/share/man/man1/echo.1.gz", "/usr/share/man/man1/env.1.gz", "/usr/share/man/man1/expand.1.gz", "/usr/share/man/man1/expr.1.gz", "/usr/share/man/man1/factor.1.gz", "/usr/share/man/man1/false.1.gz", "/usr/share/man/man1/fmt.1.gz", "/usr/share/man/man1/fold.1.gz", "/usr/share/man/man1/groups.1.gz", "/usr/share/man/man1/head.1.gz", "/usr/share/man/man1/hostid.1.gz", "/usr/share/man/man1/id.1.gz", "/usr/share/man/man1/install.1.gz", "/usr/share/man/man1/join.1.gz", "/usr/share/man/man1/link.1.gz", "/usr/share/man/man1/ln.1.gz", "/usr/share/man/man1/logname.1.gz", "/usr/share/man/man1/ls.1.gz", "/usr/share/man/man1/md5sum.1.gz", "/usr/share/man/man1/mkdir.1.gz", "/usr/share/man/man1/mkfifo.1.gz", "/usr/share/man/man1/mknod.1.gz", "/usr/share/man/man1/mktemp.1.gz", "/usr/share/man/man1/mv.1.gz", "/usr/share/man/man1/nice.1.gz", "/usr/share/man/man1/nl.1.gz", "/usr/share/man/man1/nohup.1.gz", "/usr/share/man/man1/nproc.1.gz", "/usr/share/man/man1/numfmt.1.gz", "/usr/share/man/man1/od.1.gz", "/usr/share/man/man1/paste.1.gz", "/usr/share/man/man1/pathchk.1.gz", "/usr/share/man/man1/pinky.1.gz", "/usr/share/man/man1/pr.1.gz", "/usr/share/man/man1/printenv.1.gz", "/usr/share/man/man1/printf.1.gz", "/usr/share/man/man1/ptx.1.gz", "/usr/share/man/man1/pwd.1.gz", "/usr/share/man/man1/readlink.1.gz", "/usr/share/man/man1/realpath.1.gz", "/usr/share/man/man1/rm.1.gz", "/usr/share/man/man1/rmdir.1.gz", "/usr/share/man/man1/runcon.1.gz", "/usr/share/man/man1/seq.1.gz", "/usr/share/man/man1/sha1sum.1.gz", "/usr/share/man/man1/sha224sum.1.gz", "/usr/share/man/man1/sha256sum.1.gz", "/usr/share/man/man1/sha384sum.1.gz", "/usr/share/man/man1/sha512sum.1.gz", "/usr/share/man/man1/shred.1.gz", "/usr/share/man/man1/shuf.1.gz", "/usr/share/man/man1/sleep.1.gz", "/usr/share/man/man1/sort.1.gz", "/usr/share/man/man1/split.1.gz", "/usr/share/man/man1/stat.1.gz", "/usr/share/man/man1/stdbuf.1.gz", "/usr/share/man/man1/stty.1.gz", "/usr/share/man/man1/sum.1.gz", "/usr/share/man/man1/sync.1.gz", "/usr/share/man/man1/tac.1.gz", "/usr/share/man/man1/tail.1.gz", "/usr/share/man/man1/tee.1.gz", "/usr/share/man/man1/test.1.gz", "/usr/share/man/man1/timeout.1.gz", "/usr/share/man/man1/touch.1.gz", "/usr/share/man/man1/tr.1.gz", "/usr/share/man/man1/true.1.gz", "/usr/share/man/man1/truncate.1.gz", "/usr/share/man/man1/tsort.1.gz", "/usr/share/man/man1/tty.1.gz", "/usr/share/man/man1/uname.1.gz", "/usr/share/man/man1/unexpand.1.gz", "/usr/share/man/man1/uniq.1.gz", "/usr/share/man/man1/unlink.1.gz", "/usr/share/man/man1/users.1.gz", "/usr/share/man/man1/vdir.1.gz", "/usr/share/man/man1/wc.1.gz", "/usr/share/man/man1/who.1.gz", "/usr/share/man/man1/whoami.1.gz", "/usr/share/man/man1/yes.1.gz", "/usr/share/man/man8/chroot.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "curl@8.14.1-2", "Name": "curl", "Identifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "f0fe82f7c7d29b4a" }, "Version": "8.14.1", "Release": "2", "Arch": "amd64", "SrcName": "curl", "SrcVersion": "8.14.1", "SrcRelease": "2", "Licenses": [ "curl", "OLDAP-2.8", "ISC", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "GPL-2+ with Libtool exception", "BSD-3-Clause", "BSD-4-Clause-UC", "FSFULLR", "X11", "GPL-2.0-only" ], "Maintainer": "Debian Curl Maintainers \u003cteam+curl@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libcurl4t64@8.14.1-2", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/bin/curl", "/usr/bin/wcurl", "/usr/share/doc/curl/NEWS.Debian.gz", "/usr/share/doc/curl/README.Debian", "/usr/share/doc/curl/changelog.Debian.gz", "/usr/share/doc/curl/changelog.gz", "/usr/share/doc/curl/copyright", "/usr/share/fish/vendor_completions.d/curl.fish", "/usr/share/man/man1/curl.1.gz", "/usr/share/man/man1/wcurl.1.gz", "/usr/share/zsh/vendor-completions/_curl" ], "AnalyzedBy": "dpkg" }, { "ID": "dash@0.5.12-12", "Name": "dash", "Identifier": { "PURL": "pkg:deb/debian/dash@0.5.12-12?arch=amd64\u0026distro=debian-13.1", "UID": "4990b2098a2a3724" }, "Version": "0.5.12", "Release": "12", "Arch": "amd64", "SrcName": "dash", "SrcVersion": "0.5.12", "SrcRelease": "12", "Licenses": [ "BSD-3-Clause", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Andrej Shadura \u003candrewsh@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debianutils@5.23.2" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/dash", "/usr/share/debianutils/shells.d/dash", "/usr/share/doc/dash/README.Debian.diet", "/usr/share/doc/dash/README.source", "/usr/share/doc/dash/changelog.Debian.gz", "/usr/share/doc/dash/changelog.gz", "/usr/share/doc/dash/copyright", "/usr/share/lintian/overrides/dash", "/usr/share/man/man1/dash.1.gz", "/usr/share/menu/dash" ], "AnalyzedBy": "dpkg" }, { "ID": "debconf@1.5.91", "Name": "debconf", "Identifier": { "PURL": "pkg:deb/debian/debconf@1.5.91?arch=all\u0026distro=debian-13.1", "UID": "f7c8b7ba83ed5cfe" }, "Version": "1.5.91", "Arch": "all", "SrcName": "debconf", "SrcVersion": "1.5.91", "Licenses": [ "BSD-2-Clause" ], "Maintainer": "Debconf Developers \u003cdebconf-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/debconf", "/usr/bin/debconf-apt-progress", "/usr/bin/debconf-communicate", "/usr/bin/debconf-copydb", "/usr/bin/debconf-escape", "/usr/bin/debconf-set-selections", "/usr/bin/debconf-show", "/usr/sbin/dpkg-preconfigure", "/usr/sbin/dpkg-reconfigure", "/usr/share/bash-completion/completions/debconf", "/usr/share/debconf/confmodule", "/usr/share/debconf/confmodule.sh", "/usr/share/debconf/debconf.conf", "/usr/share/debconf/fix_db.pl", "/usr/share/debconf/frontend", "/usr/share/doc/debconf/README.Debian", "/usr/share/doc/debconf/changelog.gz", "/usr/share/doc/debconf/copyright", "/usr/share/lintian/overrides/debconf", "/usr/share/man/man1/debconf-apt-progress.1.gz", "/usr/share/man/man1/debconf-communicate.1.gz", "/usr/share/man/man1/debconf-copydb.1.gz", "/usr/share/man/man1/debconf-escape.1.gz", "/usr/share/man/man1/debconf-set-selections.1.gz", "/usr/share/man/man1/debconf-show.1.gz", "/usr/share/man/man1/debconf.1.gz", "/usr/share/man/man8/dpkg-preconfigure.8.gz", "/usr/share/man/man8/dpkg-reconfigure.8.gz", "/usr/share/perl5/Debconf/AutoSelect.pm", "/usr/share/perl5/Debconf/Base.pm", "/usr/share/perl5/Debconf/Client/ConfModule.pm", "/usr/share/perl5/Debconf/ConfModule.pm", "/usr/share/perl5/Debconf/Config.pm", "/usr/share/perl5/Debconf/Db.pm", "/usr/share/perl5/Debconf/DbDriver.pm", "/usr/share/perl5/Debconf/DbDriver/Backup.pm", "/usr/share/perl5/Debconf/DbDriver/Cache.pm", "/usr/share/perl5/Debconf/DbDriver/Copy.pm", "/usr/share/perl5/Debconf/DbDriver/Debug.pm", "/usr/share/perl5/Debconf/DbDriver/DirTree.pm", "/usr/share/perl5/Debconf/DbDriver/Directory.pm", "/usr/share/perl5/Debconf/DbDriver/File.pm", "/usr/share/perl5/Debconf/DbDriver/LDAP.pm", "/usr/share/perl5/Debconf/DbDriver/PackageDir.pm", "/usr/share/perl5/Debconf/DbDriver/Pipe.pm", "/usr/share/perl5/Debconf/DbDriver/Stack.pm", "/usr/share/perl5/Debconf/Element.pm", "/usr/share/perl5/Debconf/Element/Dialog/Boolean.pm", "/usr/share/perl5/Debconf/Element/Dialog/Error.pm", "/usr/share/perl5/Debconf/Element/Dialog/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Dialog/Note.pm", "/usr/share/perl5/Debconf/Element/Dialog/Password.pm", "/usr/share/perl5/Debconf/Element/Dialog/Progress.pm", "/usr/share/perl5/Debconf/Element/Dialog/Select.pm", "/usr/share/perl5/Debconf/Element/Dialog/String.pm", "/usr/share/perl5/Debconf/Element/Dialog/Text.pm", "/usr/share/perl5/Debconf/Element/Editor/Boolean.pm", "/usr/share/perl5/Debconf/Element/Editor/Error.pm", "/usr/share/perl5/Debconf/Element/Editor/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Editor/Note.pm", "/usr/share/perl5/Debconf/Element/Editor/Password.pm", "/usr/share/perl5/Debconf/Element/Editor/Progress.pm", "/usr/share/perl5/Debconf/Element/Editor/Select.pm", "/usr/share/perl5/Debconf/Element/Editor/String.pm", "/usr/share/perl5/Debconf/Element/Editor/Text.pm", "/usr/share/perl5/Debconf/Element/Gnome.pm", "/usr/share/perl5/Debconf/Element/Gnome/Boolean.pm", "/usr/share/perl5/Debconf/Element/Gnome/Error.pm", "/usr/share/perl5/Debconf/Element/Gnome/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Gnome/Note.pm", "/usr/share/perl5/Debconf/Element/Gnome/Password.pm", "/usr/share/perl5/Debconf/Element/Gnome/Progress.pm", "/usr/share/perl5/Debconf/Element/Gnome/Select.pm", "/usr/share/perl5/Debconf/Element/Gnome/String.pm", "/usr/share/perl5/Debconf/Element/Gnome/Text.pm", "/usr/share/perl5/Debconf/Element/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Noninteractive.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Boolean.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Error.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Note.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Password.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Progress.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Select.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/String.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Text.pm", "/usr/share/perl5/Debconf/Element/Select.pm", "/usr/share/perl5/Debconf/Element/Teletype/Boolean.pm", "/usr/share/perl5/Debconf/Element/Teletype/Error.pm", "/usr/share/perl5/Debconf/Element/Teletype/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Teletype/Note.pm", "/usr/share/perl5/Debconf/Element/Teletype/Password.pm", "/usr/share/perl5/Debconf/Element/Teletype/Progress.pm", "/usr/share/perl5/Debconf/Element/Teletype/Select.pm", "/usr/share/perl5/Debconf/Element/Teletype/String.pm", "/usr/share/perl5/Debconf/Element/Teletype/Text.pm", "/usr/share/perl5/Debconf/Element/Web/Boolean.pm", "/usr/share/perl5/Debconf/Element/Web/Error.pm", "/usr/share/perl5/Debconf/Element/Web/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Web/Note.pm", "/usr/share/perl5/Debconf/Element/Web/Password.pm", "/usr/share/perl5/Debconf/Element/Web/Progress.pm", "/usr/share/perl5/Debconf/Element/Web/Select.pm", "/usr/share/perl5/Debconf/Element/Web/String.pm", "/usr/share/perl5/Debconf/Element/Web/Text.pm", "/usr/share/perl5/Debconf/Encoding.pm", "/usr/share/perl5/Debconf/Format.pm", "/usr/share/perl5/Debconf/Format/822.pm", "/usr/share/perl5/Debconf/FrontEnd.pm", "/usr/share/perl5/Debconf/FrontEnd/Dialog.pm", "/usr/share/perl5/Debconf/FrontEnd/Editor.pm", "/usr/share/perl5/Debconf/FrontEnd/Gnome.pm", "/usr/share/perl5/Debconf/FrontEnd/Kde.pm", "/usr/share/perl5/Debconf/FrontEnd/Noninteractive.pm", "/usr/share/perl5/Debconf/FrontEnd/Passthrough.pm", "/usr/share/perl5/Debconf/FrontEnd/Readline.pm", "/usr/share/perl5/Debconf/FrontEnd/ScreenSize.pm", "/usr/share/perl5/Debconf/FrontEnd/Teletype.pm", "/usr/share/perl5/Debconf/FrontEnd/Text.pm", "/usr/share/perl5/Debconf/FrontEnd/Web.pm", "/usr/share/perl5/Debconf/Gettext.pm", "/usr/share/perl5/Debconf/Iterator.pm", "/usr/share/perl5/Debconf/Log.pm", "/usr/share/perl5/Debconf/Path.pm", "/usr/share/perl5/Debconf/Priority.pm", "/usr/share/perl5/Debconf/Question.pm", "/usr/share/perl5/Debconf/Template.pm", "/usr/share/perl5/Debconf/Template/Transient.pm", "/usr/share/perl5/Debconf/TmpFile.pm", "/usr/share/perl5/Debian/DebConf/Client/ConfModule.pm", "/usr/share/pixmaps/debian-logo.png" ], "AnalyzedBy": "dpkg" }, { "ID": "debian-archive-keyring@2025.1", "Name": "debian-archive-keyring", "Identifier": { "PURL": "pkg:deb/debian/debian-archive-keyring@2025.1?arch=all\u0026distro=debian-13.1", "UID": "a22d861380b1187c" }, "Version": "2025.1", "Arch": "all", "SrcName": "debian-archive-keyring", "SrcVersion": "2025.1", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian Release Team \u003cpackages@release.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/share/doc/debian-archive-keyring/NEWS.Debian.gz", "/usr/share/doc/debian-archive-keyring/README", "/usr/share/doc/debian-archive-keyring/changelog.gz", "/usr/share/doc/debian-archive-keyring/copyright", "/usr/share/keyrings/debian-archive-bookworm-automatic.pgp", "/usr/share/keyrings/debian-archive-bookworm-security-automatic.pgp", "/usr/share/keyrings/debian-archive-bookworm-stable.pgp", "/usr/share/keyrings/debian-archive-bullseye-automatic.pgp", "/usr/share/keyrings/debian-archive-bullseye-security-automatic.pgp", "/usr/share/keyrings/debian-archive-bullseye-stable.pgp", "/usr/share/keyrings/debian-archive-keyring.pgp", "/usr/share/keyrings/debian-archive-removed-keys.pgp", "/usr/share/keyrings/debian-archive-trixie-automatic.pgp", "/usr/share/keyrings/debian-archive-trixie-security-automatic.pgp", "/usr/share/keyrings/debian-archive-trixie-stable.pgp" ], "AnalyzedBy": "dpkg" }, { "ID": "debianutils@5.23.2", "Name": "debianutils", "Identifier": { "PURL": "pkg:deb/debian/debianutils@5.23.2?arch=amd64\u0026distro=debian-13.1", "UID": "3c5d0b66afafddbb" }, "Version": "5.23.2", "Arch": "amd64", "SrcName": "debianutils", "SrcVersion": "5.23.2", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "public-domain", "SMAIL-GPL" ], "Maintainer": "Ileana Dumitrescu \u003cileanadumitrescu95@gmail.com\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/ischroot", "/usr/bin/run-parts", "/usr/bin/savelog", "/usr/bin/tempfile", "/usr/bin/which.debianutils", "/usr/sbin/add-shell", "/usr/sbin/installkernel", "/usr/sbin/remove-shell", "/usr/sbin/update-shells", "/usr/share/debianutils/shells", "/usr/share/doc/debianutils/README.shells", "/usr/share/doc/debianutils/changelog.gz", "/usr/share/doc/debianutils/copyright", "/usr/share/man/de/man1/which.debianutils.1.gz", "/usr/share/man/de/man8/add-shell.8.gz", "/usr/share/man/de/man8/installkernel.8.gz", "/usr/share/man/de/man8/remove-shell.8.gz", "/usr/share/man/de/man8/run-parts.8.gz", "/usr/share/man/de/man8/savelog.8.gz", "/usr/share/man/es/man1/which.debianutils.1.gz", "/usr/share/man/es/man8/add-shell.8.gz", "/usr/share/man/es/man8/installkernel.8.gz", "/usr/share/man/es/man8/remove-shell.8.gz", "/usr/share/man/es/man8/run-parts.8.gz", "/usr/share/man/es/man8/savelog.8.gz", "/usr/share/man/fr/man1/which.debianutils.1.gz", "/usr/share/man/fr/man8/add-shell.8.gz", "/usr/share/man/fr/man8/installkernel.8.gz", "/usr/share/man/fr/man8/remove-shell.8.gz", "/usr/share/man/fr/man8/run-parts.8.gz", "/usr/share/man/fr/man8/savelog.8.gz", "/usr/share/man/it/man1/which.debianutils.1.gz", "/usr/share/man/it/man8/add-shell.8.gz", "/usr/share/man/it/man8/installkernel.8.gz", "/usr/share/man/it/man8/remove-shell.8.gz", "/usr/share/man/it/man8/run-parts.8.gz", "/usr/share/man/it/man8/savelog.8.gz", "/usr/share/man/ja/man1/which.debianutils.1.gz", "/usr/share/man/ja/man8/add-shell.8.gz", "/usr/share/man/ja/man8/installkernel.8.gz", "/usr/share/man/ja/man8/remove-shell.8.gz", "/usr/share/man/ja/man8/run-parts.8.gz", "/usr/share/man/ja/man8/savelog.8.gz", "/usr/share/man/man1/ischroot.1.gz", "/usr/share/man/man1/tempfile.1.gz", "/usr/share/man/man1/which.debianutils.1.gz", "/usr/share/man/man8/add-shell.8.gz", "/usr/share/man/man8/installkernel.8.gz", "/usr/share/man/man8/remove-shell.8.gz", "/usr/share/man/man8/run-parts.8.gz", "/usr/share/man/man8/savelog.8.gz", "/usr/share/man/man8/update-shells.8.gz", "/usr/share/man/pl/man1/which.debianutils.1.gz", "/usr/share/man/pl/man8/add-shell.8.gz", "/usr/share/man/pl/man8/installkernel.8.gz", "/usr/share/man/pl/man8/remove-shell.8.gz", "/usr/share/man/pl/man8/run-parts.8.gz", "/usr/share/man/pl/man8/savelog.8.gz", "/usr/share/man/pt/man1/which.debianutils.1.gz", "/usr/share/man/pt/man8/add-shell.8.gz", "/usr/share/man/pt/man8/installkernel.8.gz", "/usr/share/man/pt/man8/remove-shell.8.gz", "/usr/share/man/pt/man8/run-parts.8.gz", "/usr/share/man/pt/man8/savelog.8.gz", "/usr/share/man/sl/man1/which.debianutils.1.gz", "/usr/share/man/sl/man8/add-shell.8.gz", "/usr/share/man/sl/man8/installkernel.8.gz", "/usr/share/man/sl/man8/remove-shell.8.gz", "/usr/share/man/sl/man8/run-parts.8.gz", "/usr/share/man/sl/man8/savelog.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "diffutils@1:3.10-4", "Name": "diffutils", "Identifier": { "PURL": "pkg:deb/debian/diffutils@3.10-4?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "852f693a78aaa149" }, "Version": "3.10", "Release": "4", "Epoch": 1, "Arch": "amd64", "SrcName": "diffutils", "SrcVersion": "3.10", "SrcRelease": "4", "SrcEpoch": 1, "Licenses": [ "GPL-3.0-or-later", "FSFULLR", "LGPL-2.1-or-later", "GPL-3.0-with-autoconf-exception+", "GPL-3.0-only", "GPL-3+ with texinfo exception", "LGPL-2.0-or-later", "GPL-2.0-or-later", "X11", "FSFAP", "GFDL-1.3-no-invariants-only", "LGPL-3.0-or-later", "LGPL-3.0-only", "public-domain", "LGPL-2.0-only", "LGPL-2.1-only", "GPL-2.0-only", "GFDL-1.3-only" ], "Maintainer": "Santiago Vila \u003csanvila@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/cmp", "/usr/bin/diff", "/usr/bin/diff3", "/usr/bin/sdiff", "/usr/share/doc/diffutils/NEWS.gz", "/usr/share/doc/diffutils/changelog.Debian.gz", "/usr/share/doc/diffutils/changelog.gz", "/usr/share/doc/diffutils/copyright", "/usr/share/info/diffutils.info.gz", "/usr/share/locale/bg/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ca/LC_MESSAGES/diffutils.mo", "/usr/share/locale/cs/LC_MESSAGES/diffutils.mo", "/usr/share/locale/da/LC_MESSAGES/diffutils.mo", "/usr/share/locale/de/LC_MESSAGES/diffutils.mo", "/usr/share/locale/el/LC_MESSAGES/diffutils.mo", "/usr/share/locale/eo/LC_MESSAGES/diffutils.mo", "/usr/share/locale/es/LC_MESSAGES/diffutils.mo", "/usr/share/locale/fi/LC_MESSAGES/diffutils.mo", "/usr/share/locale/fr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ga/LC_MESSAGES/diffutils.mo", "/usr/share/locale/gl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/he/LC_MESSAGES/diffutils.mo", "/usr/share/locale/hr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/hu/LC_MESSAGES/diffutils.mo", "/usr/share/locale/id/LC_MESSAGES/diffutils.mo", "/usr/share/locale/it/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ja/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ka/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ko/LC_MESSAGES/diffutils.mo", "/usr/share/locale/lv/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ms/LC_MESSAGES/diffutils.mo", "/usr/share/locale/nb/LC_MESSAGES/diffutils.mo", "/usr/share/locale/nl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pt/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ro/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ru/LC_MESSAGES/diffutils.mo", "/usr/share/locale/sr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/sv/LC_MESSAGES/diffutils.mo", "/usr/share/locale/tr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/uk/LC_MESSAGES/diffutils.mo", "/usr/share/locale/vi/LC_MESSAGES/diffutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/diffutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/diffutils.mo", "/usr/share/man/man1/cmp.1.gz", "/usr/share/man/man1/diff.1.gz", "/usr/share/man/man1/diff3.1.gz", "/usr/share/man/man1/sdiff.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "dpkg@1.22.21", "Name": "dpkg", "Identifier": { "PURL": "pkg:deb/debian/dpkg@1.22.21?arch=amd64\u0026distro=debian-13.1", "UID": "6552c6e7b1378011" }, "Version": "1.22.21", "Arch": "amd64", "SrcName": "dpkg", "SrcVersion": "1.22.21", "Licenses": [ "GPL-2.0-or-later", "public-domain-s-s-d", "GPL-2.0-only" ], "Maintainer": "Dpkg Developers \u003cdebian-dpkg@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "tar@1.35+dfsg-3.1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/dpkg", "/usr/bin/dpkg-deb", "/usr/bin/dpkg-divert", "/usr/bin/dpkg-maintscript-helper", "/usr/bin/dpkg-query", "/usr/bin/dpkg-realpath", "/usr/bin/dpkg-split", "/usr/bin/dpkg-statoverride", "/usr/bin/dpkg-trigger", "/usr/bin/update-alternatives", "/usr/lib/systemd/system/dpkg-db-backup.service", "/usr/lib/systemd/system/dpkg-db-backup.timer", "/usr/libexec/dpkg/dpkg-db-backup", "/usr/libexec/dpkg/dpkg-db-keeper", "/usr/sbin/start-stop-daemon", "/usr/share/doc/dpkg/AUTHORS", "/usr/share/doc/dpkg/README.api", "/usr/share/doc/dpkg/README.bug-usertags.gz", "/usr/share/doc/dpkg/README.feature-removal-schedule.gz", "/usr/share/doc/dpkg/THANKS.gz", "/usr/share/doc/dpkg/changelog.gz", "/usr/share/doc/dpkg/copyright", "/usr/share/dpkg/abitable", "/usr/share/dpkg/cputable", "/usr/share/dpkg/ostable", "/usr/share/dpkg/sh/dpkg-error.sh", "/usr/share/dpkg/tupletable", "/usr/share/lintian/overrides/dpkg", "/usr/share/lintian/profiles/dpkg/main.profile", "/usr/share/locale/ast/LC_MESSAGES/dpkg.mo", "/usr/share/locale/bs/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ca/LC_MESSAGES/dpkg.mo", "/usr/share/locale/cs/LC_MESSAGES/dpkg.mo", "/usr/share/locale/da/LC_MESSAGES/dpkg.mo", "/usr/share/locale/de/LC_MESSAGES/dpkg.mo", "/usr/share/locale/dz/LC_MESSAGES/dpkg.mo", "/usr/share/locale/el/LC_MESSAGES/dpkg.mo", "/usr/share/locale/eo/LC_MESSAGES/dpkg.mo", "/usr/share/locale/es/LC_MESSAGES/dpkg.mo", "/usr/share/locale/et/LC_MESSAGES/dpkg.mo", "/usr/share/locale/eu/LC_MESSAGES/dpkg.mo", "/usr/share/locale/fr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/gl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/hu/LC_MESSAGES/dpkg.mo", "/usr/share/locale/id/LC_MESSAGES/dpkg.mo", "/usr/share/locale/it/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ja/LC_MESSAGES/dpkg.mo", "/usr/share/locale/km/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ko/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ku/LC_MESSAGES/dpkg.mo", "/usr/share/locale/lt/LC_MESSAGES/dpkg.mo", "/usr/share/locale/mr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nb/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ne/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nn/LC_MESSAGES/dpkg.mo", "/usr/share/locale/oc/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pa/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pt/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ro/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ru/LC_MESSAGES/dpkg.mo", "/usr/share/locale/sk/LC_MESSAGES/dpkg.mo", "/usr/share/locale/sv/LC_MESSAGES/dpkg.mo", "/usr/share/locale/th/LC_MESSAGES/dpkg.mo", "/usr/share/locale/tl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/tr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/vi/LC_MESSAGES/dpkg.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/dpkg.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/dpkg.mo", "/usr/share/man/de/man1/dpkg-deb.1.gz", "/usr/share/man/de/man1/dpkg-divert.1.gz", "/usr/share/man/de/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/de/man1/dpkg-query.1.gz", "/usr/share/man/de/man1/dpkg-realpath.1.gz", "/usr/share/man/de/man1/dpkg-split.1.gz", "/usr/share/man/de/man1/dpkg-statoverride.1.gz", "/usr/share/man/de/man1/dpkg-trigger.1.gz", "/usr/share/man/de/man1/dpkg.1.gz", "/usr/share/man/de/man1/update-alternatives.1.gz", "/usr/share/man/de/man5/dpkg.cfg.5.gz", "/usr/share/man/de/man8/start-stop-daemon.8.gz", "/usr/share/man/es/man5/dpkg.cfg.5.gz", "/usr/share/man/fr/man1/dpkg-divert.1.gz", "/usr/share/man/fr/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/fr/man1/dpkg-query.1.gz", "/usr/share/man/fr/man1/dpkg-realpath.1.gz", "/usr/share/man/fr/man1/dpkg-split.1.gz", "/usr/share/man/fr/man1/dpkg-trigger.1.gz", "/usr/share/man/fr/man1/update-alternatives.1.gz", "/usr/share/man/fr/man5/dpkg.cfg.5.gz", "/usr/share/man/fr/man8/start-stop-daemon.8.gz", "/usr/share/man/it/man5/dpkg.cfg.5.gz", "/usr/share/man/ja/man5/dpkg.cfg.5.gz", "/usr/share/man/man1/dpkg-deb.1.gz", "/usr/share/man/man1/dpkg-divert.1.gz", "/usr/share/man/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/man1/dpkg-query.1.gz", "/usr/share/man/man1/dpkg-realpath.1.gz", "/usr/share/man/man1/dpkg-split.1.gz", "/usr/share/man/man1/dpkg-statoverride.1.gz", "/usr/share/man/man1/dpkg-trigger.1.gz", "/usr/share/man/man1/dpkg.1.gz", "/usr/share/man/man1/update-alternatives.1.gz", "/usr/share/man/man5/dpkg.cfg.5.gz", "/usr/share/man/man8/start-stop-daemon.8.gz", "/usr/share/man/nl/man1/dpkg-deb.1.gz", "/usr/share/man/nl/man1/dpkg-divert.1.gz", "/usr/share/man/nl/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/nl/man1/dpkg-query.1.gz", "/usr/share/man/nl/man1/dpkg-realpath.1.gz", "/usr/share/man/nl/man1/dpkg-split.1.gz", "/usr/share/man/nl/man1/dpkg-statoverride.1.gz", "/usr/share/man/nl/man1/dpkg-trigger.1.gz", "/usr/share/man/nl/man1/dpkg.1.gz", "/usr/share/man/nl/man1/update-alternatives.1.gz", "/usr/share/man/nl/man5/dpkg.cfg.5.gz", "/usr/share/man/nl/man8/start-stop-daemon.8.gz", "/usr/share/man/pl/man5/dpkg.cfg.5.gz", "/usr/share/man/pt/man1/dpkg-deb.1.gz", "/usr/share/man/pt/man1/dpkg-divert.1.gz", "/usr/share/man/pt/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/pt/man1/dpkg-query.1.gz", "/usr/share/man/pt/man1/dpkg-realpath.1.gz", "/usr/share/man/pt/man1/dpkg-split.1.gz", "/usr/share/man/pt/man1/dpkg-statoverride.1.gz", "/usr/share/man/pt/man1/dpkg-trigger.1.gz", "/usr/share/man/pt/man1/dpkg.1.gz", "/usr/share/man/pt/man1/update-alternatives.1.gz", "/usr/share/man/pt/man5/dpkg.cfg.5.gz", "/usr/share/man/pt/man8/start-stop-daemon.8.gz", "/usr/share/man/sv/man1/dpkg-deb.1.gz", "/usr/share/man/sv/man1/dpkg-divert.1.gz", "/usr/share/man/sv/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/sv/man1/dpkg-query.1.gz", "/usr/share/man/sv/man1/dpkg-realpath.1.gz", "/usr/share/man/sv/man1/dpkg-split.1.gz", "/usr/share/man/sv/man1/dpkg-statoverride.1.gz", "/usr/share/man/sv/man1/dpkg-trigger.1.gz", "/usr/share/man/sv/man1/dpkg.1.gz", "/usr/share/man/sv/man1/update-alternatives.1.gz", "/usr/share/man/sv/man5/dpkg.cfg.5.gz", "/usr/share/man/sv/man8/start-stop-daemon.8.gz", "/usr/share/polkit-1/actions/org.dpkg.pkexec.update-alternatives.policy" ], "AnalyzedBy": "dpkg" }, { "ID": "findutils@4.10.0-3", "Name": "findutils", "Identifier": { "PURL": "pkg:deb/debian/findutils@4.10.0-3?arch=amd64\u0026distro=debian-13.1", "UID": "12e741692291b42a" }, "Version": "4.10.0", "Release": "3", "Arch": "amd64", "SrcName": "findutils", "SrcVersion": "4.10.0", "SrcRelease": "3", "Licenses": [ "GFDL-1.3-no-invariants-or-later", "GPL-3.0-or-later", "FSFAP", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "FSFULLR", "GPL-2.0-or-later", "X11", "public-domain", "LGPL-2.1-or-later", "GPL with automake exception", "LGPL-2.0-or-later", "LGPL-3.0-or-later", "BSD-3-Clause", "GPL-3+ with Bison-2.2 exception", "LGPL-3.0-only", "ISC", "GFDL-1.3-only", "GPL-2.0-only", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Andreas Metzler \u003cametzler@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/find", "/usr/bin/xargs", "/usr/share/doc-base/findutils.findutils", "/usr/share/doc/findutils/NEWS.gz", "/usr/share/doc/findutils/README.gz", "/usr/share/doc/findutils/TODO", "/usr/share/doc/findutils/changelog.Debian.gz", "/usr/share/doc/findutils/changelog.gz", "/usr/share/doc/findutils/copyright", "/usr/share/info/find-maint.info.gz", "/usr/share/info/find.info.gz", "/usr/share/locale/be/LC_MESSAGES/findutils.mo", "/usr/share/locale/bg/LC_MESSAGES/findutils.mo", "/usr/share/locale/ca/LC_MESSAGES/findutils.mo", "/usr/share/locale/cs/LC_MESSAGES/findutils.mo", "/usr/share/locale/da/LC_MESSAGES/findutils.mo", "/usr/share/locale/de/LC_MESSAGES/findutils.mo", "/usr/share/locale/el/LC_MESSAGES/findutils.mo", "/usr/share/locale/eo/LC_MESSAGES/findutils.mo", "/usr/share/locale/es/LC_MESSAGES/findutils.mo", "/usr/share/locale/et/LC_MESSAGES/findutils.mo", "/usr/share/locale/fi/LC_MESSAGES/findutils.mo", "/usr/share/locale/fr/LC_MESSAGES/findutils.mo", "/usr/share/locale/ga/LC_MESSAGES/findutils.mo", "/usr/share/locale/gl/LC_MESSAGES/findutils.mo", "/usr/share/locale/hr/LC_MESSAGES/findutils.mo", "/usr/share/locale/hu/LC_MESSAGES/findutils.mo", "/usr/share/locale/id/LC_MESSAGES/findutils.mo", "/usr/share/locale/it/LC_MESSAGES/findutils.mo", "/usr/share/locale/ja/LC_MESSAGES/findutils.mo", "/usr/share/locale/ka/LC_MESSAGES/findutils.mo", "/usr/share/locale/ko/LC_MESSAGES/findutils.mo", "/usr/share/locale/lg/LC_MESSAGES/findutils.mo", "/usr/share/locale/lt/LC_MESSAGES/findutils.mo", "/usr/share/locale/ms/LC_MESSAGES/findutils.mo", "/usr/share/locale/nb/LC_MESSAGES/findutils.mo", "/usr/share/locale/nl/LC_MESSAGES/findutils.mo", "/usr/share/locale/pl/LC_MESSAGES/findutils.mo", "/usr/share/locale/pt/LC_MESSAGES/findutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/findutils.mo", "/usr/share/locale/ro/LC_MESSAGES/findutils.mo", "/usr/share/locale/ru/LC_MESSAGES/findutils.mo", "/usr/share/locale/sk/LC_MESSAGES/findutils.mo", "/usr/share/locale/sl/LC_MESSAGES/findutils.mo", "/usr/share/locale/sr/LC_MESSAGES/findutils.mo", "/usr/share/locale/sv/LC_MESSAGES/findutils.mo", "/usr/share/locale/tr/LC_MESSAGES/findutils.mo", "/usr/share/locale/uk/LC_MESSAGES/findutils.mo", "/usr/share/locale/vi/LC_MESSAGES/findutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/findutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/findutils.mo", "/usr/share/man/man1/find.1.gz", "/usr/share/man/man1/xargs.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gcc-14-base@14.2.0-19", "Name": "gcc-14-base", "Identifier": { "PURL": "pkg:deb/debian/gcc-14-base@14.2.0-19?arch=amd64\u0026distro=debian-13.1", "UID": "371c061d08215a1b" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Licenses": [ "GPL-2.0-or-later", "GPL-3.0-only", "GFDL-1.2-only", "Artistic-2.0", "LGPL-2.0-or-later" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/share/doc/gcc-14-base/README.Debian.amd64.gz", "/usr/share/doc/gcc-14-base/TODO.Debian", "/usr/share/doc/gcc-14-base/changelog.Debian.gz", "/usr/share/doc/gcc-14-base/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "grep@3.11-4", "Name": "grep", "Identifier": { "PURL": "pkg:deb/debian/grep@3.11-4?arch=amd64\u0026distro=debian-13.1", "UID": "6ce8b4eed9c0d137" }, "Version": "3.11", "Release": "4", "Arch": "amd64", "SrcName": "grep", "SrcVersion": "3.11", "SrcRelease": "4", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/egrep", "/usr/bin/fgrep", "/usr/bin/grep", "/usr/bin/rgrep", "/usr/share/doc/grep/AUTHORS", "/usr/share/doc/grep/NEWS.Debian.gz", "/usr/share/doc/grep/NEWS.gz", "/usr/share/doc/grep/README", "/usr/share/doc/grep/THANKS.gz", "/usr/share/doc/grep/TODO.gz", "/usr/share/doc/grep/changelog.Debian.gz", "/usr/share/doc/grep/changelog.gz", "/usr/share/doc/grep/copyright", "/usr/share/info/grep.info.gz", "/usr/share/locale/af/LC_MESSAGES/grep.mo", "/usr/share/locale/be/LC_MESSAGES/grep.mo", "/usr/share/locale/bg/LC_MESSAGES/grep.mo", "/usr/share/locale/ca/LC_MESSAGES/grep.mo", "/usr/share/locale/cs/LC_MESSAGES/grep.mo", "/usr/share/locale/da/LC_MESSAGES/grep.mo", "/usr/share/locale/de/LC_MESSAGES/grep.mo", "/usr/share/locale/el/LC_MESSAGES/grep.mo", "/usr/share/locale/eo/LC_MESSAGES/grep.mo", "/usr/share/locale/es/LC_MESSAGES/grep.mo", "/usr/share/locale/et/LC_MESSAGES/grep.mo", "/usr/share/locale/eu/LC_MESSAGES/grep.mo", "/usr/share/locale/fi/LC_MESSAGES/grep.mo", "/usr/share/locale/fr/LC_MESSAGES/grep.mo", "/usr/share/locale/ga/LC_MESSAGES/grep.mo", "/usr/share/locale/gl/LC_MESSAGES/grep.mo", "/usr/share/locale/he/LC_MESSAGES/grep.mo", "/usr/share/locale/hr/LC_MESSAGES/grep.mo", "/usr/share/locale/hu/LC_MESSAGES/grep.mo", "/usr/share/locale/id/LC_MESSAGES/grep.mo", "/usr/share/locale/it/LC_MESSAGES/grep.mo", "/usr/share/locale/ja/LC_MESSAGES/grep.mo", "/usr/share/locale/ka/LC_MESSAGES/grep.mo", "/usr/share/locale/ko/LC_MESSAGES/grep.mo", "/usr/share/locale/ky/LC_MESSAGES/grep.mo", "/usr/share/locale/lt/LC_MESSAGES/grep.mo", "/usr/share/locale/nb/LC_MESSAGES/grep.mo", "/usr/share/locale/nl/LC_MESSAGES/grep.mo", "/usr/share/locale/pa/LC_MESSAGES/grep.mo", "/usr/share/locale/pl/LC_MESSAGES/grep.mo", "/usr/share/locale/pt/LC_MESSAGES/grep.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/grep.mo", "/usr/share/locale/ro/LC_MESSAGES/grep.mo", "/usr/share/locale/ru/LC_MESSAGES/grep.mo", "/usr/share/locale/sk/LC_MESSAGES/grep.mo", "/usr/share/locale/sl/LC_MESSAGES/grep.mo", "/usr/share/locale/sr/LC_MESSAGES/grep.mo", "/usr/share/locale/sv/LC_MESSAGES/grep.mo", "/usr/share/locale/ta/LC_MESSAGES/grep.mo", "/usr/share/locale/th/LC_MESSAGES/grep.mo", "/usr/share/locale/tr/LC_MESSAGES/grep.mo", "/usr/share/locale/uk/LC_MESSAGES/grep.mo", "/usr/share/locale/vi/LC_MESSAGES/grep.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/grep.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/grep.mo", "/usr/share/man/man1/grep.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gzip@1.13-1", "Name": "gzip", "Identifier": { "PURL": "pkg:deb/debian/gzip@1.13-1?arch=amd64\u0026distro=debian-13.1", "UID": "954545ce99bc687e" }, "Version": "1.13", "Release": "1", "Arch": "amd64", "SrcName": "gzip", "SrcVersion": "1.13", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "GFDL-1.3+-no-invariant", "FSF-manpages", "GPL-3.0-only", "GFDL-3" ], "Maintainer": "Milan Kupcevic \u003cmilan@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/gunzip", "/usr/bin/gzexe", "/usr/bin/gzip", "/usr/bin/zcat", "/usr/bin/zcmp", "/usr/bin/zdiff", "/usr/bin/zegrep", "/usr/bin/zfgrep", "/usr/bin/zforce", "/usr/bin/zgrep", "/usr/bin/zless", "/usr/bin/zmore", "/usr/bin/znew", "/usr/share/doc/gzip/NEWS.gz", "/usr/share/doc/gzip/README.gz", "/usr/share/doc/gzip/TODO", "/usr/share/doc/gzip/changelog.Debian.gz", "/usr/share/doc/gzip/changelog.gz", "/usr/share/doc/gzip/copyright", "/usr/share/info/gzip.info.gz", "/usr/share/man/man1/gzexe.1.gz", "/usr/share/man/man1/gzip.1.gz", "/usr/share/man/man1/zdiff.1.gz", "/usr/share/man/man1/zforce.1.gz", "/usr/share/man/man1/zgrep.1.gz", "/usr/share/man/man1/zless.1.gz", "/usr/share/man/man1/zmore.1.gz", "/usr/share/man/man1/znew.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "hostname@3.25", "Name": "hostname", "Identifier": { "PURL": "pkg:deb/debian/hostname@3.25?arch=amd64\u0026distro=debian-13.1", "UID": "641772722328aedf" }, "Version": "3.25", "Arch": "amd64", "SrcName": "hostname", "SrcVersion": "3.25", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Michael Meskes \u003cmeskes@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/hostname", "/usr/share/doc/hostname/changelog.gz", "/usr/share/doc/hostname/copyright", "/usr/share/man/man1/hostname.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "init-system-helpers@1.69~deb13u1", "Name": "init-system-helpers", "Identifier": { "PURL": "pkg:deb/debian/init-system-helpers@1.69~deb13u1?arch=all\u0026distro=debian-13.1", "UID": "cb52819ec2f1a236" }, "Version": "1.69~deb13u1", "Arch": "all", "SrcName": "init-system-helpers", "SrcVersion": "1.69~deb13u1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/deb-systemd-helper", "/usr/bin/deb-systemd-invoke", "/usr/sbin/invoke-rc.d", "/usr/sbin/service", "/usr/sbin/update-rc.d", "/usr/share/bug/init-system-helpers/control", "/usr/share/doc/init-system-helpers/README.invoke-rc.d.gz", "/usr/share/doc/init-system-helpers/README.policy-rc.d.gz", "/usr/share/doc/init-system-helpers/changelog.gz", "/usr/share/doc/init-system-helpers/copyright", "/usr/share/lintian/overrides/init-system-helpers", "/usr/share/man/man1/deb-systemd-helper.1p.gz", "/usr/share/man/man1/deb-systemd-invoke.1p.gz", "/usr/share/man/man8/invoke-rc.d.8.gz", "/usr/share/man/man8/service.8.gz", "/usr/share/man/man8/update-rc.d.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "krb5-locales@1.21.3-5", "Name": "krb5-locales", "Identifier": { "PURL": "pkg:deb/debian/krb5-locales@1.21.3-5?arch=all\u0026distro=debian-13.1", "UID": "781b645aa442b3df" }, "Version": "1.21.3", "Release": "5", "Arch": "all", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/share/doc/krb5-locales/changelog.Debian.gz", "/usr/share/doc/krb5-locales/copyright", "/usr/share/locale/de/LC_MESSAGES/mit-krb5.mo", "/usr/share/locale/en_US/LC_MESSAGES/mit-krb5.mo", "/usr/share/locale/ka/LC_MESSAGES/mit-krb5.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libacl1@2.3.2-2+b1", "Name": "libacl1", "Identifier": { "PURL": "pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64\u0026distro=debian-13.1", "UID": "3f80157315b2dfd8" }, "Version": "2.3.2", "Release": "2+b1", "Arch": "amd64", "SrcName": "acl", "SrcVersion": "2.3.2", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.1-only" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libacl.so.1.1.2302", "/usr/share/doc/libacl1/changelog.Debian.amd64.gz", "/usr/share/doc/libacl1/changelog.Debian.gz", "/usr/share/doc/libacl1/changelog.gz", "/usr/share/doc/libacl1/copyright", "/usr/share/lintian/overrides/libacl1" ], "AnalyzedBy": "dpkg" }, { "ID": "libapt-pkg7.0@3.0.3", "Name": "libapt-pkg7.0", "Identifier": { "PURL": "pkg:deb/debian/libapt-pkg7.0@3.0.3?arch=amd64\u0026distro=debian-13.1", "UID": "8d0831c9d06c644b" }, "Version": "3.0.3", "Arch": "amd64", "SrcName": "apt", "SrcVersion": "3.0.3", "Licenses": [ "GPL-2.0-or-later", "curl", "BSD-3-Clause", "MIT", "GPL-2.0-only" ], "Maintainer": "APT Development Team \u003cdeity@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-6", "libc6@2.41-12", "libgcc-s1@14.2.0-19", "liblz4-1@1.10.0-4", "liblzma5@5.8.1-1", "libssl3t64@3.5.1-1+deb13u1", "libstdc++6@14.2.0-19", "libsystemd0@257.8-1~deb13u2", "libudev1@257.8-1~deb13u2", "libxxhash0@0.8.3-2", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libapt-pkg.so.7.0.0", "/usr/share/doc/libapt-pkg7.0/NEWS.Debian.gz", "/usr/share/doc/libapt-pkg7.0/changelog.gz", "/usr/share/doc/libapt-pkg7.0/copyright", "/usr/share/locale/ar/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ast/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/bg/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/bs/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ca/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/cs/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/cy/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/da/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/de/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/dz/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/el/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/es/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/eu/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/fi/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/fr/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/gl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/hu/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/it/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ja/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/km/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ko/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ku/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/lt/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/mr/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/nb/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ne/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/nl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/nn/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/pl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/pt/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ro/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ru/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/sk/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/sl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/sv/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/th/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/tl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/tr/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/uk/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/vi/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/libapt-pkg7.0.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libattr1@1:2.5.2-3", "Name": "libattr1", "Identifier": { "PURL": "pkg:deb/debian/libattr1@2.5.2-3?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "e32395a63da949e5" }, "Version": "2.5.2", "Release": "3", "Epoch": 1, "Arch": "amd64", "SrcName": "attr", "SrcVersion": "2.5.2", "SrcRelease": "3", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.1-only" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libattr.so.1.1.2502", "/usr/share/doc/libattr1/changelog.Debian.gz", "/usr/share/doc/libattr1/changelog.gz", "/usr/share/doc/libattr1/copyright", "/usr/share/lintian/overrides/libattr1" ], "AnalyzedBy": "dpkg" }, { "ID": "libaudit-common@1:4.0.2-2", "Name": "libaudit-common", "Identifier": { "PURL": "pkg:deb/debian/libaudit-common@4.0.2-2?arch=all\u0026distro=debian-13.1\u0026epoch=1", "UID": "d20cd9a11d8e018d" }, "Version": "4.0.2", "Release": "2", "Epoch": 1, "Arch": "all", "SrcName": "audit", "SrcVersion": "4.0.2", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only", "GPL-1.0-only" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/share/doc/libaudit-common/changelog.Debian.gz", "/usr/share/doc/libaudit-common/changelog.gz", "/usr/share/doc/libaudit-common/copyright", "/usr/share/man/man5/libaudit.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libaudit1@1:4.0.2-2+b2", "Name": "libaudit1", "Identifier": { "PURL": "pkg:deb/debian/libaudit1@4.0.2-2%2Bb2?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "a51413ce7ab5d66e" }, "Version": "4.0.2", "Release": "2+b2", "Epoch": 1, "Arch": "amd64", "SrcName": "audit", "SrcVersion": "4.0.2", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only", "GPL-1.0-only" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit-common@1:4.0.2-2", "libc6@2.41-12", "libcap-ng0@0.8.5-4+b1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0", "/usr/share/doc/libaudit1/changelog.Debian.amd64.gz", "/usr/share/doc/libaudit1/changelog.Debian.gz", "/usr/share/doc/libaudit1/changelog.gz", "/usr/share/doc/libaudit1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libblkid1@2.41-5", "Name": "libblkid1", "Identifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "5e2de859106ae047" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0", "/usr/share/doc/libblkid1/NEWS.Debian.gz", "/usr/share/doc/libblkid1/changelog.Debian.gz", "/usr/share/doc/libblkid1/changelog.gz", "/usr/share/doc/libblkid1/copyright", "/usr/share/lintian/overrides/libblkid1" ], "AnalyzedBy": "dpkg" }, { "ID": "libbrotli1@1.1.0-2+b7", "Name": "libbrotli1", "Identifier": { "PURL": "pkg:deb/debian/libbrotli1@1.1.0-2%2Bb7?arch=amd64\u0026distro=debian-13.1", "UID": "1cb11302e523b78" }, "Version": "1.1.0", "Release": "2+b7", "Arch": "amd64", "SrcName": "brotli", "SrcVersion": "1.1.0", "SrcRelease": "2", "Licenses": [ "MIT" ], "Maintainer": "Tomasz Buchert \u003ctomasz@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbrotlicommon.so.1.1.0", "/usr/lib/x86_64-linux-gnu/libbrotlidec.so.1.1.0", "/usr/lib/x86_64-linux-gnu/libbrotlienc.so.1.1.0", "/usr/share/doc/libbrotli1/changelog.Debian.amd64.gz", "/usr/share/doc/libbrotli1/changelog.Debian.gz", "/usr/share/doc/libbrotli1/changelog.gz", "/usr/share/doc/libbrotli1/copyright", "/usr/share/lintian/overrides/libbrotli1" ], "AnalyzedBy": "dpkg" }, { "ID": "libbsd0@0.12.2-2", "Name": "libbsd0", "Identifier": { "PURL": "pkg:deb/debian/libbsd0@0.12.2-2?arch=amd64\u0026distro=debian-13.1", "UID": "5581efd2e712ea28" }, "Version": "0.12.2", "Release": "2", "Arch": "amd64", "SrcName": "libbsd", "SrcVersion": "0.12.2", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-Regents", "BSD-2-Clause-NetBSD", "BSD-3-clause-author", "BSD-3-clause-John-Birrell", "BSD-5-clause-Peter-Wemm", "BSD-2-Clause", "BSD-2-clause-verbatim", "BSD-2-clause-author", "ISC", "ISC-Original", "MIT", "public-domain", "Beerware" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libmd0@1.1.0-2+b1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbsd.so.0.12.2", "/usr/share/doc/libbsd0/changelog.Debian.gz", "/usr/share/doc/libbsd0/changelog.gz", "/usr/share/doc/libbsd0/copyright", "/usr/share/lintian/overrides/libbsd0" ], "AnalyzedBy": "dpkg" }, { "ID": "libbz2-1.0@1.0.8-6", "Name": "libbz2-1.0", "Identifier": { "PURL": "pkg:deb/debian/libbz2-1.0@1.0.8-6?arch=amd64\u0026distro=debian-13.1", "UID": "ff3f890d714285f9" }, "Version": "1.0.8", "Release": "6", "Arch": "amd64", "SrcName": "bzip2", "SrcVersion": "1.0.8", "SrcRelease": "6", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbz2.so.1.0.4", "/usr/share/doc/libbz2-1.0/changelog.Debian.gz", "/usr/share/doc/libbz2-1.0/changelog.gz", "/usr/share/doc/libbz2-1.0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libc-bin@2.41-12", "Name": "libc-bin", "Identifier": { "PURL": "pkg:deb/debian/libc-bin@2.41-12?arch=amd64\u0026distro=debian-13.1", "UID": "e5be7a8f49ec2ffe" }, "Version": "2.41", "Release": "12", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.41", "SrcRelease": "12", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.0-or-later", "LGPL-2.1+-with-link-exception", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2+-with-link-exception", "GPL-2.0-only", "GPL-3.0-or-later", "FSFAP", "Carnegie", "Inner-Net", "MIT-like-Lord", "BSD-like-Spencer", "PCRE", "BSD-3-clause-Carnegie", "Unicode-DFS-2016", "BSL-1.0", "SunPro", "CORE-MATH", "BSD-3-clause-Berkeley", "BSD-3-clause-WIDE", "BSD-2-Clause", "BSD-3-clause-Oracle", "DEC", "IBM", "ISC", "Univ-Coimbra", "public-domain", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/getconf", "/usr/bin/getent", "/usr/bin/iconv", "/usr/bin/ldd", "/usr/bin/locale", "/usr/bin/localedef", "/usr/bin/pldd", "/usr/bin/tzselect", "/usr/bin/zdump", "/usr/lib/locale/C.utf8/LC_ADDRESS", "/usr/lib/locale/C.utf8/LC_COLLATE", "/usr/lib/locale/C.utf8/LC_CTYPE", "/usr/lib/locale/C.utf8/LC_IDENTIFICATION", "/usr/lib/locale/C.utf8/LC_MEASUREMENT", "/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES", "/usr/lib/locale/C.utf8/LC_MONETARY", "/usr/lib/locale/C.utf8/LC_NAME", "/usr/lib/locale/C.utf8/LC_NUMERIC", "/usr/lib/locale/C.utf8/LC_PAPER", "/usr/lib/locale/C.utf8/LC_TELEPHONE", "/usr/lib/locale/C.utf8/LC_TIME", "/usr/sbin/iconvconfig", "/usr/sbin/ldconfig", "/usr/sbin/zic", "/usr/share/doc/libc-bin/changelog.Debian.gz", "/usr/share/doc/libc-bin/changelog.gz", "/usr/share/doc/libc-bin/copyright", "/usr/share/libc-bin/nsswitch.conf", "/usr/share/lintian/overrides/libc-bin", "/usr/share/man/man1/getconf.1.gz", "/usr/share/man/man1/tzselect.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libc6@2.41-12", "Name": "libc6", "Identifier": { "PURL": "pkg:deb/debian/libc6@2.41-12?arch=amd64\u0026distro=debian-13.1", "UID": "c44248feef1d2dd6" }, "Version": "2.41", "Release": "12", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.41", "SrcRelease": "12", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.0-or-later", "LGPL-2.1+-with-link-exception", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2+-with-link-exception", "GPL-2.0-only", "GPL-3.0-or-later", "FSFAP", "Carnegie", "Inner-Net", "MIT-like-Lord", "BSD-like-Spencer", "PCRE", "BSD-3-clause-Carnegie", "Unicode-DFS-2016", "BSL-1.0", "SunPro", "CORE-MATH", "BSD-3-clause-Berkeley", "BSD-3-clause-WIDE", "BSD-2-Clause", "BSD-3-clause-Oracle", "DEC", "IBM", "ISC", "Univ-Coimbra", "public-domain", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/gconv/ANSI_X3.110.so", "/usr/lib/x86_64-linux-gnu/gconv/ARMSCII-8.so", "/usr/lib/x86_64-linux-gnu/gconv/ASMO_449.so", "/usr/lib/x86_64-linux-gnu/gconv/BIG5.so", "/usr/lib/x86_64-linux-gnu/gconv/BIG5HKSCS.so", "/usr/lib/x86_64-linux-gnu/gconv/BRF.so", "/usr/lib/x86_64-linux-gnu/gconv/CP10007.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1125.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1250.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1251.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1252.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1253.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1254.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1255.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1256.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1257.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1258.so", "/usr/lib/x86_64-linux-gnu/gconv/CP737.so", "/usr/lib/x86_64-linux-gnu/gconv/CP770.so", "/usr/lib/x86_64-linux-gnu/gconv/CP771.so", "/usr/lib/x86_64-linux-gnu/gconv/CP772.so", "/usr/lib/x86_64-linux-gnu/gconv/CP773.so", "/usr/lib/x86_64-linux-gnu/gconv/CP774.so", "/usr/lib/x86_64-linux-gnu/gconv/CP775.so", "/usr/lib/x86_64-linux-gnu/gconv/CP932.so", "/usr/lib/x86_64-linux-gnu/gconv/CSN_369103.so", "/usr/lib/x86_64-linux-gnu/gconv/CWI.so", "/usr/lib/x86_64-linux-gnu/gconv/DEC-MCS.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-AT-DE-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-AT-DE.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-CA-FR.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-DK-NO-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-DK-NO.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES-S.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FI-SE-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FI-SE.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FR.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-IS-FRISS.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-IT.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-PT.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-UK.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-US.so", "/usr/lib/x86_64-linux-gnu/gconv/ECMA-CYRILLIC.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-CN.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JP-MS.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JP.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-KR.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-TW.so", "/usr/lib/x86_64-linux-gnu/gconv/GB18030.so", "/usr/lib/x86_64-linux-gnu/gconv/GBBIG5.so", "/usr/lib/x86_64-linux-gnu/gconv/GBGBK.so", "/usr/lib/x86_64-linux-gnu/gconv/GBK.so", "/usr/lib/x86_64-linux-gnu/gconv/GEORGIAN-ACADEMY.so", "/usr/lib/x86_64-linux-gnu/gconv/GEORGIAN-PS.so", "/usr/lib/x86_64-linux-gnu/gconv/GOST_19768-74.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK-CCITT.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK7-OLD.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK7.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-GREEK8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-ROMAN8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-ROMAN9.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-THAI8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-TURKISH8.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM037.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM038.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1004.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1008.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1008_420.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1025.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1026.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1046.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1047.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1097.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1112.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1122.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1123.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1124.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1129.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1130.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1132.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1133.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1137.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1140.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1141.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1142.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1143.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1144.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1145.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1146.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1147.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1148.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1149.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1153.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1154.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1155.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1156.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1157.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1158.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1160.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1161.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1162.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1163.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1164.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1166.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1167.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM12712.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1364.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1371.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1388.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1390.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1399.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM16804.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM256.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM273.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM274.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM275.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM277.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM278.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM280.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM281.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM284.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM285.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM290.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM297.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM420.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM423.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM424.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM437.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4517.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4899.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4909.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4971.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM500.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM5347.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM803.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM850.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM851.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM852.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM855.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM856.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM857.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM858.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM860.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM861.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM862.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM863.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM864.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM865.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM866.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM866NAV.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM868.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM869.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM870.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM871.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM874.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM875.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM880.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM891.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM901.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM902.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM903.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9030.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM904.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM905.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9066.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM918.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM921.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM922.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM930.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM932.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM933.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM935.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM937.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM939.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM943.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9448.so", "/usr/lib/x86_64-linux-gnu/gconv/IEC_P27-1.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS-8.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS-CYRILLIC.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS.so", "/usr/lib/x86_64-linux-gnu/gconv/ISIRI-3342.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-CN-EXT.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-CN.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-JP-3.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-JP.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-KR.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-IR-197.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-IR-209.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO646.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-1.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-10.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-11.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-13.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-14.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-15.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-16.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-2.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-3.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-4.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-5.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-6.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-7.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-8.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-9.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-9E.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_10367-BOX.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_11548-1.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_2033.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5427-EXT.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5427.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5428.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_6937-2.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_6937.so", "/usr/lib/x86_64-linux-gnu/gconv/JOHAB.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI-8.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-R.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-RU.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-T.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-U.so", "/usr/lib/x86_64-linux-gnu/gconv/LATIN-GREEK-1.so", "/usr/lib/x86_64-linux-gnu/gconv/LATIN-GREEK.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-CENTRALEUROPE.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-IS.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-SAMI.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-UK.so", "/usr/lib/x86_64-linux-gnu/gconv/MACINTOSH.so", "/usr/lib/x86_64-linux-gnu/gconv/MIK.so", "/usr/lib/x86_64-linux-gnu/gconv/NATS-DANO.so", "/usr/lib/x86_64-linux-gnu/gconv/NATS-SEFI.so", "/usr/lib/x86_64-linux-gnu/gconv/PT154.so", "/usr/lib/x86_64-linux-gnu/gconv/RK1048.so", "/usr/lib/x86_64-linux-gnu/gconv/SAMI-WS2.so", "/usr/lib/x86_64-linux-gnu/gconv/SHIFT_JISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/SJIS.so", "/usr/lib/x86_64-linux-gnu/gconv/T.61.so", "/usr/lib/x86_64-linux-gnu/gconv/TCVN5712-1.so", "/usr/lib/x86_64-linux-gnu/gconv/TIS-620.so", "/usr/lib/x86_64-linux-gnu/gconv/TSCII.so", "/usr/lib/x86_64-linux-gnu/gconv/UHC.so", "/usr/lib/x86_64-linux-gnu/gconv/UNICODE.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-16.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-32.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-7.so", "/usr/lib/x86_64-linux-gnu/gconv/VISCII.so", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.d/gconv-modules-extra.conf", "/usr/lib/x86_64-linux-gnu/gconv/libCNS.so", "/usr/lib/x86_64-linux-gnu/gconv/libGB.so", "/usr/lib/x86_64-linux-gnu/gconv/libISOIR165.so", "/usr/lib/x86_64-linux-gnu/gconv/libJIS.so", "/usr/lib/x86_64-linux-gnu/gconv/libJISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/libKSC.so", "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", "/usr/lib/x86_64-linux-gnu/libBrokenLocale.so.1", "/usr/lib/x86_64-linux-gnu/libanl.so.1", "/usr/lib/x86_64-linux-gnu/libc.so.6", "/usr/lib/x86_64-linux-gnu/libc_malloc_debug.so.0", "/usr/lib/x86_64-linux-gnu/libdl.so.2", "/usr/lib/x86_64-linux-gnu/libm.so.6", "/usr/lib/x86_64-linux-gnu/libmemusage.so", "/usr/lib/x86_64-linux-gnu/libmvec.so.1", "/usr/lib/x86_64-linux-gnu/libnsl.so.1", "/usr/lib/x86_64-linux-gnu/libnss_compat.so.2", "/usr/lib/x86_64-linux-gnu/libnss_dns.so.2", "/usr/lib/x86_64-linux-gnu/libnss_files.so.2", "/usr/lib/x86_64-linux-gnu/libnss_hesiod.so.2", "/usr/lib/x86_64-linux-gnu/libpcprofile.so", "/usr/lib/x86_64-linux-gnu/libpthread.so.0", "/usr/lib/x86_64-linux-gnu/libresolv.so.2", "/usr/lib/x86_64-linux-gnu/librt.so.1", "/usr/lib/x86_64-linux-gnu/libthread_db.so.1", "/usr/lib/x86_64-linux-gnu/libutil.so.1", "/usr/share/doc/libc6/NEWS.Debian.gz", "/usr/share/doc/libc6/NEWS.gz", "/usr/share/doc/libc6/README.Debian.gz", "/usr/share/doc/libc6/README.hesiod.gz", "/usr/share/doc/libc6/changelog.Debian.gz", "/usr/share/doc/libc6/changelog.gz", "/usr/share/doc/libc6/copyright", "/usr/share/lintian/overrides/libc6" ], "AnalyzedBy": "dpkg" }, { "ID": "libcap-ng0@0.8.5-4+b1", "Name": "libcap-ng0", "Identifier": { "PURL": "pkg:deb/debian/libcap-ng0@0.8.5-4%2Bb1?arch=amd64\u0026distro=debian-13.1", "UID": "aa98db0a469cd857" }, "Version": "0.8.5", "Release": "4+b1", "Arch": "amd64", "SrcName": "libcap-ng", "SrcVersion": "0.8.5", "SrcRelease": "4", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later", "GPL-3.0-only", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Håvard F. Aasen \u003chavard.f.aasen@pfft.no\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0", "/usr/lib/x86_64-linux-gnu/libdrop_ambient.so.0.0.0", "/usr/share/doc/libcap-ng0/changelog.Debian.amd64.gz", "/usr/share/doc/libcap-ng0/changelog.Debian.gz", "/usr/share/doc/libcap-ng0/changelog.gz", "/usr/share/doc/libcap-ng0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcap2@1:2.75-10+b1", "Name": "libcap2", "Identifier": { "PURL": "pkg:deb/debian/libcap2@2.75-10%2Bb1?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "c7a667e13ed1a878" }, "Version": "2.75", "Release": "10+b1", "Epoch": 1, "Arch": "amd64", "SrcName": "libcap2", "SrcVersion": "2.75", "SrcRelease": "10", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Christian Kastner \u003cckk@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcap.so.2.75", "/usr/lib/x86_64-linux-gnu/libpsx.so.2.75", "/usr/share/doc/libcap2/changelog.Debian.amd64.gz", "/usr/share/doc/libcap2/changelog.Debian.gz", "/usr/share/doc/libcap2/changelog.gz", "/usr/share/doc/libcap2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcom-err2@1.47.2-3+b3", "Name": "libcom-err2", "Identifier": { "PURL": "pkg:deb/debian/libcom-err2@1.47.2-3%2Bb3?arch=amd64\u0026distro=debian-13.1", "UID": "4eb83d27fd3dc115" }, "Version": "1.47.2", "Release": "3+b3", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.2", "SrcRelease": "3", "Licenses": [ "GPL-2.0-only", "GPL-2.0-or-later", "0BSD", "MIT", "BSD-3-Clause-Variant", "BSD-3-Clause", "BSD-4-Clause-CMU", "LGPL-2.0-only", "Apache-2.0", "ISC", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcom_err.so.2.1", "/usr/share/doc/libcom-err2/changelog.Debian.amd64.gz", "/usr/share/doc/libcom-err2/changelog.Debian.gz", "/usr/share/doc/libcom-err2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcrypt1@1:4.4.38-1", "Name": "libcrypt1", "Identifier": { "PURL": "pkg:deb/debian/libcrypt1@4.4.38-1?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "f9c6e7578ca52dab" }, "Version": "4.4.38", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxcrypt", "SrcVersion": "4.4.38", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcrypt.so.1.1.0", "/usr/share/doc/libcrypt1/changelog.Debian.gz", "/usr/share/doc/libcrypt1/changelog.gz", "/usr/share/doc/libcrypt1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcurl4t64@8.14.1-2", "Name": "libcurl4t64", "Identifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "63107564cba8ba64" }, "Version": "8.14.1", "Release": "2", "Arch": "amd64", "SrcName": "curl", "SrcVersion": "8.14.1", "SrcRelease": "2", "Licenses": [ "curl", "OLDAP-2.8", "ISC", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "GPL-2+ with Libtool exception", "BSD-3-Clause", "BSD-4-Clause-UC", "FSFULLR", "X11", "GPL-2.0-only" ], "Maintainer": "Debian Curl Maintainers \u003cteam+curl@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbrotli1@1.1.0-2+b7", "libc6@2.41-12", "libgssapi-krb5-2@1.21.3-5", "libidn2-0@2.3.8-2", "libldap2@2.6.10+dfsg-1", "libnghttp2-14@1.64.0-1.1", "libnghttp3-9@1.8.0-1", "libpsl5t64@0.21.2-1.1+b1", "librtmp1@2.4+20151223.gitfa8646d.1-2+b5", "libssh2-1t64@1.11.1-1", "libssl3t64@3.5.1-1+deb13u1", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcurl.so.4.8.0", "/usr/share/doc/libcurl4t64/changelog.Debian.gz", "/usr/share/doc/libcurl4t64/changelog.gz", "/usr/share/doc/libcurl4t64/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdb5.3t64@5.3.28+dfsg2-9", "Name": "libdb5.3t64", "Identifier": { "PURL": "pkg:deb/debian/libdb5.3t64@5.3.28%2Bdfsg2-9?arch=amd64\u0026distro=debian-13.1", "UID": "d23f3bf17dc18bc" }, "Version": "5.3.28+dfsg2", "Release": "9", "Arch": "amd64", "SrcName": "db5.3", "SrcVersion": "5.3.28+dfsg2", "SrcRelease": "9", "Licenses": [ "Sleepycat", "BSD-3-Clause", "MS-PL", "GPL-2.0-or-later", "Artistic-2.0", "X11", "MIT-old", "TCL-like", "BSD-3-clause-fjord", "GPL-3.0-only", "Zlib" ], "Maintainer": "Debian QA Group \u003cpackages@qa.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdb-5.3.so", "/usr/share/doc/libdb5.3t64/build_signature_amd64.txt", "/usr/share/doc/libdb5.3t64/changelog.Debian.gz", "/usr/share/doc/libdb5.3t64/copyright", "/usr/share/lintian/overrides/libdb5.3t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libdebconfclient0@0.280", "Name": "libdebconfclient0", "Identifier": { "PURL": "pkg:deb/debian/libdebconfclient0@0.280?arch=amd64\u0026distro=debian-13.1", "UID": "572c80dd848f6778" }, "Version": "0.280", "Arch": "amd64", "SrcName": "cdebconf", "SrcVersion": "0.280", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Install System Team \u003cdebian-boot@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdebconfclient.so.0.0.0", "/usr/share/doc/libdebconfclient0/changelog.gz", "/usr/share/doc/libdebconfclient0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libffi8@3.4.8-2", "Name": "libffi8", "Identifier": { "PURL": "pkg:deb/debian/libffi8@3.4.8-2?arch=amd64\u0026distro=debian-13.1", "UID": "ab14fed1aefa74e3" }, "Version": "3.4.8", "Release": "2", "Arch": "amd64", "SrcName": "libffi", "SrcVersion": "3.4.8", "SrcRelease": "2", "Licenses": [ "MIT", "X11", "GPL-2.0-or-later", "GPL-3.0-or-later", "MPL-1.1", "LGPL-2.1-or-later", "public-domain" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libffi.so.8.1.4", "/usr/share/doc/libffi8/changelog.Debian.gz", "/usr/share/doc/libffi8/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgcc-s1@14.2.0-19", "Name": "libgcc-s1", "Identifier": { "PURL": "pkg:deb/debian/libgcc-s1@14.2.0-19?arch=amd64\u0026distro=debian-13.1", "UID": "a6b5e2370cfe8ea" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgcc_s.so.1", "/usr/share/lintian/overrides/libgcc-s1" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdbm6t64@1.24-2", "Name": "libgdbm6t64", "Identifier": { "PURL": "pkg:deb/debian/libgdbm6t64@1.24-2?arch=amd64\u0026distro=debian-13.1", "UID": "81d225c9970c587d" }, "Version": "1.24", "Release": "2", "Arch": "amd64", "SrcName": "gdbm", "SrcVersion": "1.24", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-2.0-or-later", "GFDL-1.3-no-invariants-or-later", "GPL-3.0-only", "GPL-2.0-only" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgdbm.so.6.0.0", "/usr/share/doc/libgdbm6t64/changelog.Debian.gz", "/usr/share/doc/libgdbm6t64/changelog.gz", "/usr/share/doc/libgdbm6t64/copyright", "/usr/share/lintian/overrides/libgdbm6t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libgmp10@2:6.3.0+dfsg-3", "Name": "libgmp10", "Identifier": { "PURL": "pkg:deb/debian/libgmp10@6.3.0%2Bdfsg-3?arch=amd64\u0026distro=debian-13.1\u0026epoch=2", "UID": "e281a9b3aaee4bc7" }, "Version": "6.3.0+dfsg", "Release": "3", "Epoch": 2, "Arch": "amd64", "SrcName": "gmp", "SrcVersion": "6.3.0+dfsg", "SrcRelease": "3", "SrcEpoch": 2, "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later", "GPL-3.0-or-later", "GPL-3+ with Bison exception", "GPL-2.0-only", "GPL-3.0-only", "LGPL-3.0-only" ], "Maintainer": "Debian Science Maintainers \u003cdebian-science-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgmp.so.10.5.0", "/usr/share/doc/libgmp10/README.Debian", "/usr/share/doc/libgmp10/changelog.Debian.gz", "/usr/share/doc/libgmp10/changelog.gz", "/usr/share/doc/libgmp10/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgnutls30t64@3.8.9-3", "Name": "libgnutls30t64", "Identifier": { "PURL": "pkg:deb/debian/libgnutls30t64@3.8.9-3?arch=amd64\u0026distro=debian-13.1", "UID": "9749e8948ee81e44" }, "Version": "3.8.9", "Release": "3", "Arch": "amd64", "SrcName": "gnutls28", "SrcVersion": "3.8.9", "SrcRelease": "3", "Licenses": [ "LGPL-2.1-only", "LGPL-2.0-or-later", "LGPL-3.0-only", "GPL-2.0-or-later", "GPL-3.0-only", "GFDL-1.3-only", "CC0-1.0", "MIT", "Apache-2.0", "LGPL-3.0-or-later", "LGPL-2.1-or-later", "GPL-3.0-or-later", "BSD-3-Clause", "FSFAP" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libgmp10@2:6.3.0+dfsg-3", "libhogweed6t64@3.10.1-1", "libidn2-0@2.3.8-2", "libnettle8t64@3.10.1-1", "libp11-kit0@0.25.5-3", "libtasn1-6@4.20.0-2", "libunistring5@1.3-2" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgnutls.so.30.40.3", "/usr/share/doc/libgnutls30t64/AUTHORS.gz", "/usr/share/doc/libgnutls30t64/NEWS.gz", "/usr/share/doc/libgnutls30t64/README.md.gz", "/usr/share/doc/libgnutls30t64/THANKS.gz", "/usr/share/doc/libgnutls30t64/changelog.Debian.gz", "/usr/share/doc/libgnutls30t64/changelog.gz", "/usr/share/doc/libgnutls30t64/copyright", "/usr/share/lintian/overrides/libgnutls30t64", "/usr/share/locale/cs/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/de/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/eo/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/es/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/fi/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/fr/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/it/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ka/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ms/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/nl/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/pl/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ro/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/sr/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/sv/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/uk/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/vi/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/gnutls30.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libgssapi-krb5-2@1.21.3-5", "Name": "libgssapi-krb5-2", "Identifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.21.3-5?arch=amd64\u0026distro=debian-13.1", "UID": "952ae322c229f4bb" }, "Version": "1.21.3", "Release": "5", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libcom-err2@1.47.2-3+b3", "libk5crypto3@1.21.3-5", "libkrb5-3@1.21.3-5", "libkrb5support0@1.21.3-5" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2", "/usr/share/doc/libgssapi-krb5-2/changelog.Debian.gz", "/usr/share/doc/libgssapi-krb5-2/copyright", "/usr/share/lintian/overrides/libgssapi-krb5-2" ], "AnalyzedBy": "dpkg" }, { "ID": "libhogweed6t64@3.10.1-1", "Name": "libhogweed6t64", "Identifier": { "PURL": "pkg:deb/debian/libhogweed6t64@3.10.1-1?arch=amd64\u0026distro=debian-13.1", "UID": "6190e10cc5f25430" }, "Version": "3.10.1", "Release": "1", "Arch": "amd64", "SrcName": "nettle", "SrcVersion": "3.10.1", "SrcRelease": "1", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "MIT", "GPL-3.0-with-autoconf-exception+", "public-domain", "GPL-2.0-only", "GAP" ], "Maintainer": "Magnus Holmgren \u003cholmgren@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libgmp10@2:6.3.0+dfsg-3", "libnettle8t64@3.10.1-1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhogweed.so.6.10", "/usr/share/doc/libhogweed6t64/changelog.Debian.gz", "/usr/share/doc/libhogweed6t64/changelog.gz", "/usr/share/doc/libhogweed6t64/copyright", "/usr/share/lintian/overrides/libhogweed6t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libidn2-0@2.3.8-2", "Name": "libidn2-0", "Identifier": { "PURL": "pkg:deb/debian/libidn2-0@2.3.8-2?arch=amd64\u0026distro=debian-13.1", "UID": "2fb20750d9082b6b" }, "Version": "2.3.8", "Release": "2", "Arch": "amd64", "SrcName": "libidn2", "SrcVersion": "2.3.8", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "LGPL-3.0-or-later", "GPL-2.0-or-later", "MIT", "Unicode", "GPL-3.0-only", "GPL-2.0-only", "LGPL-3.0-only" ], "Maintainer": "Debian Libidn team \u003chelp-libidn@gnu.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libunistring5@1.3-2" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libidn2.so.0.4.0", "/usr/share/doc/libidn2-0/AUTHORS", "/usr/share/doc/libidn2-0/NEWS.gz", "/usr/share/doc/libidn2-0/README.md.gz", "/usr/share/doc/libidn2-0/changelog.Debian.gz", "/usr/share/doc/libidn2-0/copyright", "/usr/share/lintian/overrides/libidn2-0", "/usr/share/locale/cs/LC_MESSAGES/libidn2.mo", "/usr/share/locale/da/LC_MESSAGES/libidn2.mo", "/usr/share/locale/de/LC_MESSAGES/libidn2.mo", "/usr/share/locale/eo/LC_MESSAGES/libidn2.mo", "/usr/share/locale/es/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fi/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fur/LC_MESSAGES/libidn2.mo", "/usr/share/locale/hr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/hu/LC_MESSAGES/libidn2.mo", "/usr/share/locale/id/LC_MESSAGES/libidn2.mo", "/usr/share/locale/it/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ja/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ka/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ko/LC_MESSAGES/libidn2.mo", "/usr/share/locale/lv/LC_MESSAGES/libidn2.mo", "/usr/share/locale/nl/LC_MESSAGES/libidn2.mo", "/usr/share/locale/pl/LC_MESSAGES/libidn2.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ro/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ru/LC_MESSAGES/libidn2.mo", "/usr/share/locale/sr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/sv/LC_MESSAGES/libidn2.mo", "/usr/share/locale/uk/LC_MESSAGES/libidn2.mo", "/usr/share/locale/vi/LC_MESSAGES/libidn2.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/libidn2.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libk5crypto3@1.21.3-5", "Name": "libk5crypto3", "Identifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.21.3-5?arch=amd64\u0026distro=debian-13.1", "UID": "c22ed782493a2e31" }, "Version": "1.21.3", "Release": "5", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libkrb5support0@1.21.3-5" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1", "/usr/share/doc/libk5crypto3/changelog.Debian.gz", "/usr/share/doc/libk5crypto3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libkeyutils1@1.6.3-6", "Name": "libkeyutils1", "Identifier": { "PURL": "pkg:deb/debian/libkeyutils1@1.6.3-6?arch=amd64\u0026distro=debian-13.1", "UID": "30aa19837cffafa8" }, "Version": "1.6.3", "Release": "6", "Arch": "amd64", "SrcName": "keyutils", "SrcVersion": "1.6.3", "SrcRelease": "6", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only" ], "Maintainer": "Christian Kastner \u003cckk@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libkeyutils.so.1.10", "/usr/share/doc/libkeyutils1/changelog.Debian.gz", "/usr/share/doc/libkeyutils1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libkrb5-3@1.21.3-5", "Name": "libkrb5-3", "Identifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.21.3-5?arch=amd64\u0026distro=debian-13.1", "UID": "a12badb8866b6f15" }, "Version": "1.21.3", "Release": "5", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libcom-err2@1.47.2-3+b3", "libk5crypto3@1.21.3-5", "libkeyutils1@1.6.3-6", "libkrb5support0@1.21.3-5", "libssl3t64@3.5.1-1+deb13u1" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so", "/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3", "/usr/share/doc/libkrb5-3/README.Debian", "/usr/share/doc/libkrb5-3/README.gz", "/usr/share/doc/libkrb5-3/changelog.Debian.gz", "/usr/share/doc/libkrb5-3/copyright", "/usr/share/lintian/overrides/libkrb5-3" ], "AnalyzedBy": "dpkg" }, { "ID": "libkrb5support0@1.21.3-5", "Name": "libkrb5support0", "Identifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.21.3-5?arch=amd64\u0026distro=debian-13.1", "UID": "395b8991f5efaa79" }, "Version": "1.21.3", "Release": "5", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1", "/usr/share/doc/libkrb5support0/changelog.Debian.gz", "/usr/share/doc/libkrb5support0/copyright", "/usr/share/lintian/overrides/libkrb5support0" ], "AnalyzedBy": "dpkg" }, { "ID": "liblastlog2-2@2.41-5", "Name": "liblastlog2-2", "Identifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "e729248341b6f11f" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libsqlite3-0@3.46.1-7" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblastlog2.so.2.0.0", "/usr/share/doc/liblastlog2-2/NEWS.Debian.gz", "/usr/share/doc/liblastlog2-2/changelog.Debian.gz", "/usr/share/doc/liblastlog2-2/changelog.gz", "/usr/share/doc/liblastlog2-2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libldap-common@2.6.10+dfsg-1", "Name": "libldap-common", "Identifier": { "PURL": "pkg:deb/debian/libldap-common@2.6.10%2Bdfsg-1?arch=all\u0026distro=debian-13.1", "UID": "b8051d7f8b53e9a" }, "Version": "2.6.10+dfsg", "Release": "1", "Arch": "all", "SrcName": "openldap", "SrcVersion": "2.6.10+dfsg", "SrcRelease": "1", "Licenses": [ "OpenLDAP-2.8", "FSF-unlimited", "GPL-2.0-with-autoconf-exception+", "GPL-3.0-with-autoconf-exception+", "GPL-2+ with Libtool exception", "GPL-3+ with Libtool exception", "GPL-3.0-or-later", "GPL-2.0-or-later", "UMich", "F5", "JCG", "MIT-XC", "NeoSoft-permissive", "BSD-3-Clause", "Beerware", "public-domain", "BSD-4-clause-California", "BSD-3-clause-variant", "Expat-ISC", "Expat-UNM", "MIT", "BSD-3-clause-California", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian OpenLDAP Maintainers \u003cpkg-openldap-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/share/doc/libldap-common/NEWS.Debian.gz", "/usr/share/doc/libldap-common/changelog.Debian.gz", "/usr/share/doc/libldap-common/changelog.gz", "/usr/share/doc/libldap-common/copyright", "/usr/share/man/man5/ldap.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libldap2@2.6.10+dfsg-1", "Name": "libldap2", "Identifier": { "PURL": "pkg:deb/debian/libldap2@2.6.10%2Bdfsg-1?arch=amd64\u0026distro=debian-13.1", "UID": "9e505f09c587a8d8" }, "Version": "2.6.10+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "openldap", "SrcVersion": "2.6.10+dfsg", "SrcRelease": "1", "Licenses": [ "OpenLDAP-2.8", "FSF-unlimited", "GPL-2.0-with-autoconf-exception+", "GPL-3.0-with-autoconf-exception+", "GPL-2+ with Libtool exception", "GPL-3+ with Libtool exception", "GPL-3.0-or-later", "GPL-2.0-or-later", "UMich", "F5", "JCG", "MIT-XC", "NeoSoft-permissive", "BSD-3-Clause", "Beerware", "public-domain", "BSD-4-clause-California", "BSD-3-clause-variant", "Expat-ISC", "Expat-UNM", "MIT", "BSD-3-clause-California", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian OpenLDAP Maintainers \u003cpkg-openldap-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libsasl2-2@2.1.28+dfsg1-9", "libssl3t64@3.5.1-1+deb13u1" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblber.so.2.0.200", "/usr/lib/x86_64-linux-gnu/libldap.so.2.0.200", "/usr/share/doc/libldap2/NEWS.Debian.gz", "/usr/share/doc/libldap2/changelog.Debian.gz", "/usr/share/doc/libldap2/changelog.gz", "/usr/share/doc/libldap2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblz4-1@1.10.0-4", "Name": "liblz4-1", "Identifier": { "PURL": "pkg:deb/debian/liblz4-1@1.10.0-4?arch=amd64\u0026distro=debian-13.1", "UID": "5a1effc97ecd8f0a" }, "Version": "1.10.0", "Release": "4", "Arch": "amd64", "SrcName": "lz4", "SrcVersion": "1.10.0", "SrcRelease": "4", "Licenses": [ "GPL-2.0-or-later", "BSD-2-Clause", "GPL-2.0-only" ], "Maintainer": "Nobuhiro Iwamatsu \u003ciwamatsu@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libxxhash0@0.8.3-2" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblz4.so.1.10.0", "/usr/share/doc/liblz4-1/changelog.Debian.gz", "/usr/share/doc/liblz4-1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblzma5@5.8.1-1", "Name": "liblzma5", "Identifier": { "PURL": "pkg:deb/debian/liblzma5@5.8.1-1?arch=amd64\u0026distro=debian-13.1", "UID": "a1aeba0cb1cb2810" }, "Version": "5.8.1", "Release": "1", "Arch": "amd64", "SrcName": "xz-utils", "SrcVersion": "5.8.1", "SrcRelease": "1", "Licenses": [ "0BSD", "GPL-2.0-or-later", "LGPL-2.1-or-later", "FSFULLR", "GPL-3.0-or-later-WITH-Autoconf-exception-macro", "none", "PD", "permissive-nowarranty", "FSFUL", "noderivs", "PD-debian", "LGPL-2.1-only", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Sebastian Andrzej Siewior \u003csebastian@breakpoint.cc\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblzma.so.5.8.1", "/usr/share/doc/liblzma5/AUTHORS", "/usr/share/doc/liblzma5/NEWS.gz", "/usr/share/doc/liblzma5/THANKS.gz", "/usr/share/doc/liblzma5/changelog.Debian.gz", "/usr/share/doc/liblzma5/changelog.gz", "/usr/share/doc/liblzma5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmd0@1.1.0-2+b1", "Name": "libmd0", "Identifier": { "PURL": "pkg:deb/debian/libmd0@1.1.0-2%2Bb1?arch=amd64\u0026distro=debian-13.1", "UID": "5bcc4a263128eabc" }, "Version": "1.1.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libmd", "SrcVersion": "1.1.0", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-Aaron-D-Gifford", "BSD-2-Clause", "BSD-2-Clause-NetBSD", "ISC", "Beerware", "public-domain-md4", "public-domain-md5", "public-domain-sha1" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmd.so.0.1.0", "/usr/share/doc/libmd0/changelog.Debian.amd64.gz", "/usr/share/doc/libmd0/changelog.Debian.gz", "/usr/share/doc/libmd0/changelog.gz", "/usr/share/doc/libmd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmount1@2.41-5", "Name": "libmount1", "Identifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "74c05ea16cd704b6" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libblkid1@2.41-5", "libc6@2.41-12", "libselinux1@3.8.1-1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmount.so.1.1.0", "/usr/share/doc/libmount1/NEWS.Debian.gz", "/usr/share/doc/libmount1/changelog.Debian.gz", "/usr/share/doc/libmount1/changelog.gz", "/usr/share/doc/libmount1/copyright", "/usr/share/lintian/overrides/libmount1" ], "AnalyzedBy": "dpkg" }, { "ID": "libncursesw6@6.5+20250216-2", "Name": "libncursesw6", "Identifier": { "PURL": "pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.1", "UID": "b634c296f8d31a6a" }, "Version": "6.5+20250216", "Release": "2", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libtinfo6@6.5+20250216-2" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libformw.so.6.5", "/usr/lib/x86_64-linux-gnu/libmenuw.so.6.5", "/usr/lib/x86_64-linux-gnu/libncursesw.so.6.5", "/usr/lib/x86_64-linux-gnu/libpanelw.so.6.5" ], "AnalyzedBy": "dpkg" }, { "ID": "libnettle8t64@3.10.1-1", "Name": "libnettle8t64", "Identifier": { "PURL": "pkg:deb/debian/libnettle8t64@3.10.1-1?arch=amd64\u0026distro=debian-13.1", "UID": "dfef5141cb95658" }, "Version": "3.10.1", "Release": "1", "Arch": "amd64", "SrcName": "nettle", "SrcVersion": "3.10.1", "SrcRelease": "1", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "MIT", "GPL-3.0-with-autoconf-exception+", "public-domain", "GPL-2.0-only", "GAP" ], "Maintainer": "Magnus Holmgren \u003cholmgren@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnettle.so.8.10", "/usr/share/doc/libnettle8t64/NEWS.gz", "/usr/share/doc/libnettle8t64/README", "/usr/share/doc/libnettle8t64/changelog.Debian.gz", "/usr/share/doc/libnettle8t64/changelog.gz", "/usr/share/doc/libnettle8t64/copyright", "/usr/share/lintian/overrides/libnettle8t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libnghttp2-14@1.64.0-1.1", "Name": "libnghttp2-14", "Identifier": { "PURL": "pkg:deb/debian/libnghttp2-14@1.64.0-1.1?arch=amd64\u0026distro=debian-13.1", "UID": "e61f81d9706a56c1" }, "Version": "1.64.0", "Release": "1.1", "Arch": "amd64", "SrcName": "nghttp2", "SrcVersion": "1.64.0", "SrcRelease": "1.1", "Licenses": [ "MIT", "all-permissive", "GPL-3.0-with-autoconf-exception+", "BSD-2-Clause", "GPL-3.0-only" ], "Maintainer": "Tomasz Buchert \u003ctomasz@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnghttp2.so.14.28.3", "/usr/share/doc/libnghttp2-14/AUTHORS", "/usr/share/doc/libnghttp2-14/README.rst.gz", "/usr/share/doc/libnghttp2-14/changelog.Debian.gz", "/usr/share/doc/libnghttp2-14/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libnghttp3-9@1.8.0-1", "Name": "libnghttp3-9", "Identifier": { "PURL": "pkg:deb/debian/libnghttp3-9@1.8.0-1?arch=amd64\u0026distro=debian-13.1", "UID": "8c79eac4786a7b40" }, "Version": "1.8.0", "Release": "1", "Arch": "amd64", "SrcName": "nghttp3", "SrcVersion": "1.8.0", "SrcRelease": "1", "Licenses": [ "MIT", "FSFULLR", "GPL-3+ with Autoconf generic exception", "FSFUL", "GPL-2+ with Autoconf generic exception", "FSFAP", "GPL-2+ with Libtool Exception", "GPL-3.0-or-later", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Curl Maintainers \u003cteam+curl@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnghttp3.so.9.2.6", "/usr/share/doc/libnghttp3-9/changelog.Debian.gz", "/usr/share/doc/libnghttp3-9/changelog.gz", "/usr/share/doc/libnghttp3-9/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libp11-kit0@0.25.5-3", "Name": "libp11-kit0", "Identifier": { "PURL": "pkg:deb/debian/libp11-kit0@0.25.5-3?arch=amd64\u0026distro=debian-13.1", "UID": "f9bf9578b6864679" }, "Version": "0.25.5", "Release": "3", "Arch": "amd64", "SrcName": "p11-kit", "SrcVersion": "0.25.5", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause", "FSFULLR", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "X11", "ISC", "customFSFULLRWD", "LGPL-2.1-or-later", "Apache-2.0", "customFSFUL", "FSFAP", "LGPL-2.1-only" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libffi8@3.4.8-2" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libp11-kit.so.0.4.1", "/usr/share/doc/libp11-kit0/changelog.Debian.gz", "/usr/share/doc/libp11-kit0/changelog.gz", "/usr/share/doc/libp11-kit0/copyright", "/usr/share/doc/libp11-kit0/examples/pkcs11.conf.example" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-modules@1.7.0-5", "Name": "libpam-modules", "Identifier": { "PURL": "pkg:deb/debian/libpam-modules@1.7.0-5?arch=amd64\u0026distro=debian-13.1", "UID": "274a704398461ef0" }, "Version": "1.7.0", "Release": "5", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/security/pam_access.so", "/usr/lib/x86_64-linux-gnu/security/pam_canonicalize_user.so", "/usr/lib/x86_64-linux-gnu/security/pam_debug.so", "/usr/lib/x86_64-linux-gnu/security/pam_deny.so", "/usr/lib/x86_64-linux-gnu/security/pam_echo.so", "/usr/lib/x86_64-linux-gnu/security/pam_env.so", "/usr/lib/x86_64-linux-gnu/security/pam_exec.so", "/usr/lib/x86_64-linux-gnu/security/pam_faildelay.so", "/usr/lib/x86_64-linux-gnu/security/pam_faillock.so", "/usr/lib/x86_64-linux-gnu/security/pam_filter.so", "/usr/lib/x86_64-linux-gnu/security/pam_ftp.so", "/usr/lib/x86_64-linux-gnu/security/pam_group.so", "/usr/lib/x86_64-linux-gnu/security/pam_issue.so", "/usr/lib/x86_64-linux-gnu/security/pam_keyinit.so", "/usr/lib/x86_64-linux-gnu/security/pam_limits.so", "/usr/lib/x86_64-linux-gnu/security/pam_listfile.so", "/usr/lib/x86_64-linux-gnu/security/pam_localuser.so", "/usr/lib/x86_64-linux-gnu/security/pam_loginuid.so", "/usr/lib/x86_64-linux-gnu/security/pam_mail.so", "/usr/lib/x86_64-linux-gnu/security/pam_mkhomedir.so", "/usr/lib/x86_64-linux-gnu/security/pam_motd.so", "/usr/lib/x86_64-linux-gnu/security/pam_namespace.so", "/usr/lib/x86_64-linux-gnu/security/pam_nologin.so", "/usr/lib/x86_64-linux-gnu/security/pam_permit.so", "/usr/lib/x86_64-linux-gnu/security/pam_pwhistory.so", "/usr/lib/x86_64-linux-gnu/security/pam_rhosts.so", "/usr/lib/x86_64-linux-gnu/security/pam_rootok.so", "/usr/lib/x86_64-linux-gnu/security/pam_securetty.so", "/usr/lib/x86_64-linux-gnu/security/pam_selinux.so", "/usr/lib/x86_64-linux-gnu/security/pam_sepermit.so", "/usr/lib/x86_64-linux-gnu/security/pam_setquota.so", "/usr/lib/x86_64-linux-gnu/security/pam_shells.so", "/usr/lib/x86_64-linux-gnu/security/pam_stress.so", "/usr/lib/x86_64-linux-gnu/security/pam_succeed_if.so", "/usr/lib/x86_64-linux-gnu/security/pam_time.so", "/usr/lib/x86_64-linux-gnu/security/pam_timestamp.so", "/usr/lib/x86_64-linux-gnu/security/pam_tty_audit.so", "/usr/lib/x86_64-linux-gnu/security/pam_umask.so", "/usr/lib/x86_64-linux-gnu/security/pam_unix.so", "/usr/lib/x86_64-linux-gnu/security/pam_userdb.so", "/usr/lib/x86_64-linux-gnu/security/pam_usertype.so", "/usr/lib/x86_64-linux-gnu/security/pam_warn.so", "/usr/lib/x86_64-linux-gnu/security/pam_wheel.so", "/usr/lib/x86_64-linux-gnu/security/pam_xauth.so", "/usr/share/doc/libpam-modules/NEWS.Debian.gz", "/usr/share/doc/libpam-modules/changelog.Debian.gz", "/usr/share/doc/libpam-modules/changelog.gz", "/usr/share/doc/libpam-modules/copyright", "/usr/share/doc/libpam-modules/examples/upperLOWER.c", "/usr/share/lintian/overrides/libpam-modules", "/usr/share/pam-configs/mkhomedir" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-modules-bin@1.7.0-5", "Name": "libpam-modules-bin", "Identifier": { "PURL": "pkg:deb/debian/libpam-modules-bin@1.7.0-5?arch=amd64\u0026distro=debian-13.1", "UID": "d9e66638879d0359" }, "Version": "1.7.0", "Release": "5", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:4.0.2-2+b2", "libc6@2.41-12", "libcrypt1@1:4.4.38-1", "libpam0g@1.7.0-5", "libselinux1@3.8.1-1", "libsystemd0@257.8-1~deb13u2" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/systemd/system/pam_namespace.service", "/usr/sbin/faillock", "/usr/sbin/mkhomedir_helper", "/usr/sbin/pam_namespace_helper", "/usr/sbin/pam_timestamp_check", "/usr/sbin/pwhistory_helper", "/usr/sbin/unix_chkpwd", "/usr/sbin/unix_update", "/usr/share/doc/libpam-modules-bin/changelog.Debian.gz", "/usr/share/doc/libpam-modules-bin/changelog.gz", "/usr/share/doc/libpam-modules-bin/copyright", "/usr/share/lintian/overrides/libpam-modules-bin" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-runtime@1.7.0-5", "Name": "libpam-runtime", "Identifier": { "PURL": "pkg:deb/debian/libpam-runtime@1.7.0-5?arch=all\u0026distro=debian-13.1", "UID": "1d4f3eaf1c0f9548" }, "Version": "1.7.0", "Release": "5", "Arch": "all", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "libpam-modules@1.7.0-5" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/sbin/pam-auth-update", "/usr/sbin/pam_getenv", "/usr/share/doc/libpam-runtime/changelog.Debian.gz", "/usr/share/doc/libpam-runtime/changelog.gz", "/usr/share/doc/libpam-runtime/copyright", "/usr/share/lintian/overrides/libpam-runtime", "/usr/share/locale/af/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/am/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ar/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/as/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/az/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/be/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bg/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bn_IN/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bs/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ca/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/cs/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/cy/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/da/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/de/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/de_CH/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/el/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/eo/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/es/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/et/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/eu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fa/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ga/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/gl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/gu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/he/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ia/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/id/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/is/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/it/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ja/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ka/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/km/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ko/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kw_GB/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ky/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/lt/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/lv/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ml/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ms/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/my/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nb/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ne/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/or/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pa/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pt/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ro/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ru/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/si/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sq/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sr@latin/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sv/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ta/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/te/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/tg/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/th/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/tr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/uk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ur/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/vi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/yo/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_HK/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/man/man5/access.conf.5.gz", "/usr/share/man/man5/faillock.conf.5.gz", "/usr/share/man/man5/group.conf.5.gz", "/usr/share/man/man5/limits.conf.5.gz", "/usr/share/man/man5/namespace.conf.5.gz", "/usr/share/man/man5/pam.conf.5.gz", "/usr/share/man/man5/pam_env.conf.5.gz", "/usr/share/man/man5/pwhistory.conf.5.gz", "/usr/share/man/man5/sepermit.conf.5.gz", "/usr/share/man/man5/time.conf.5.gz", "/usr/share/man/man7/PAM.7.gz", "/usr/share/man/man8/faillock.8.gz", "/usr/share/man/man8/mkhomedir_helper.8.gz", "/usr/share/man/man8/pam-auth-update.8.gz", "/usr/share/man/man8/pam_access.8.gz", "/usr/share/man/man8/pam_canonicalize_user.8.gz", "/usr/share/man/man8/pam_debug.8.gz", "/usr/share/man/man8/pam_deny.8.gz", "/usr/share/man/man8/pam_echo.8.gz", "/usr/share/man/man8/pam_env.8.gz", "/usr/share/man/man8/pam_exec.8.gz", "/usr/share/man/man8/pam_faildelay.8.gz", "/usr/share/man/man8/pam_faillock.8.gz", "/usr/share/man/man8/pam_filter.8.gz", "/usr/share/man/man8/pam_ftp.8.gz", "/usr/share/man/man8/pam_getenv.8.gz", "/usr/share/man/man8/pam_group.8.gz", "/usr/share/man/man8/pam_issue.8.gz", "/usr/share/man/man8/pam_keyinit.8.gz", "/usr/share/man/man8/pam_limits.8.gz", "/usr/share/man/man8/pam_listfile.8.gz", "/usr/share/man/man8/pam_localuser.8.gz", "/usr/share/man/man8/pam_loginuid.8.gz", "/usr/share/man/man8/pam_mail.8.gz", "/usr/share/man/man8/pam_mkhomedir.8.gz", "/usr/share/man/man8/pam_motd.8.gz", "/usr/share/man/man8/pam_namespace.8.gz", "/usr/share/man/man8/pam_namespace_helper.8.gz", "/usr/share/man/man8/pam_nologin.8.gz", "/usr/share/man/man8/pam_permit.8.gz", "/usr/share/man/man8/pam_pwhistory.8.gz", "/usr/share/man/man8/pam_rhosts.8.gz", "/usr/share/man/man8/pam_rootok.8.gz", "/usr/share/man/man8/pam_securetty.8.gz", "/usr/share/man/man8/pam_selinux.8.gz", "/usr/share/man/man8/pam_sepermit.8.gz", "/usr/share/man/man8/pam_setquota.8.gz", "/usr/share/man/man8/pam_shells.8.gz", "/usr/share/man/man8/pam_stress.8.gz", "/usr/share/man/man8/pam_succeed_if.8.gz", "/usr/share/man/man8/pam_time.8.gz", "/usr/share/man/man8/pam_timestamp.8.gz", "/usr/share/man/man8/pam_timestamp_check.8.gz", "/usr/share/man/man8/pam_tty_audit.8.gz", "/usr/share/man/man8/pam_umask.8.gz", "/usr/share/man/man8/pam_unix.8.gz", "/usr/share/man/man8/pam_userdb.8.gz", "/usr/share/man/man8/pam_usertype.8.gz", "/usr/share/man/man8/pam_warn.8.gz", "/usr/share/man/man8/pam_wheel.8.gz", "/usr/share/man/man8/pam_xauth.8.gz", "/usr/share/man/man8/pwhistory_helper.8.gz", "/usr/share/man/man8/unix_chkpwd.8.gz", "/usr/share/man/man8/unix_update.8.gz", "/usr/share/pam-configs/unix", "/usr/share/pam/common-account", "/usr/share/pam/common-account.md5sums", "/usr/share/pam/common-auth", "/usr/share/pam/common-auth.md5sums", "/usr/share/pam/common-password", "/usr/share/pam/common-password.md5sums", "/usr/share/pam/common-session", "/usr/share/pam/common-session-noninteractive", "/usr/share/pam/common-session-noninteractive.md5sums", "/usr/share/pam/common-session.md5sums" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam0g@1.7.0-5", "Name": "libpam0g", "Identifier": { "PURL": "pkg:deb/debian/libpam0g@1.7.0-5?arch=amd64\u0026distro=debian-13.1", "UID": "2934472182711f35" }, "Version": "1.7.0", "Release": "5", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "libaudit1@1:4.0.2-2+b2", "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1", "/usr/lib/x86_64-linux-gnu/libpam_misc.so.0.82.1", "/usr/lib/x86_64-linux-gnu/libpamc.so.0.82.1", "/usr/share/doc/libpam0g/Debian-PAM-MiniPolicy.gz", "/usr/share/doc/libpam0g/README", "/usr/share/doc/libpam0g/README.Debian", "/usr/share/doc/libpam0g/TODO.Debian", "/usr/share/doc/libpam0g/changelog.Debian.gz", "/usr/share/doc/libpam0g/changelog.gz", "/usr/share/doc/libpam0g/copyright", "/usr/share/lintian/overrides/libpam0g" ], "AnalyzedBy": "dpkg" }, { "ID": "libpcre2-8-0@10.46-1~deb13u1", "Name": "libpcre2-8-0", "Identifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "67c004712a78b8c2" }, "Version": "10.46", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "pcre2", "SrcVersion": "10.46", "SrcRelease": "1~deb13u1", "Licenses": [ "BSD-3-clause-Cambridge with BINARY LIBRARY-LIKE PACKAGES exception", "BSD-3-Clause", "X11", "BSD-2-Clause", "public-domain" ], "Maintainer": "Matthew Vernon \u003cmatthew@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.14.0", "/usr/share/doc/libpcre2-8-0/README.Debian", "/usr/share/doc/libpcre2-8-0/changelog.Debian.gz", "/usr/share/doc/libpcre2-8-0/changelog.gz", "/usr/share/doc/libpcre2-8-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpsl5t64@0.21.2-1.1+b1", "Name": "libpsl5t64", "Identifier": { "PURL": "pkg:deb/debian/libpsl5t64@0.21.2-1.1%2Bb1?arch=amd64\u0026distro=debian-13.1", "UID": "3d44648e51188a7" }, "Version": "0.21.2", "Release": "1.1+b1", "Arch": "amd64", "SrcName": "libpsl", "SrcVersion": "0.21.2", "SrcRelease": "1.1", "Licenses": [ "MIT", "gnulib", "Chromium" ], "Maintainer": "Tim Rühsen \u003ctim.ruehsen@gmx.de\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libidn2-0@2.3.8-2", "libunistring5@1.3-2" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpsl.so.5.3.4", "/usr/share/doc/libpsl5t64/changelog.Debian.amd64.gz", "/usr/share/doc/libpsl5t64/changelog.Debian.gz", "/usr/share/doc/libpsl5t64/changelog.gz", "/usr/share/doc/libpsl5t64/copyright", "/usr/share/lintian/overrides/libpsl5t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libreadline8t64@8.2-6", "Name": "libreadline8t64", "Identifier": { "PURL": "pkg:deb/debian/libreadline8t64@8.2-6?arch=amd64\u0026distro=debian-13.1", "UID": "e042344a443fe6ce" }, "Version": "8.2", "Release": "6", "Arch": "amd64", "SrcName": "readline", "SrcVersion": "8.2", "SrcRelease": "6", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-or-later", "ISC-no-attribution" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libtinfo6@6.5+20250216-2", "readline-common@8.2-6" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhistory.so.8.2", "/usr/lib/x86_64-linux-gnu/libreadline.so.8.2", "/usr/share/doc/libreadline8t64/README.Debian", "/usr/share/doc/libreadline8t64/USAGE", "/usr/share/doc/libreadline8t64/changelog.Debian.gz", "/usr/share/doc/libreadline8t64/changelog.gz", "/usr/share/doc/libreadline8t64/copyright", "/usr/share/doc/libreadline8t64/examples/Inputrc", "/usr/share/doc/libreadline8t64/inputrc.arrows" ], "AnalyzedBy": "dpkg" }, { "ID": "librtmp1@2.4+20151223.gitfa8646d.1-2+b5", "Name": "librtmp1", "Identifier": { "PURL": "pkg:deb/debian/librtmp1@2.4%2B20151223.gitfa8646d.1-2%2Bb5?arch=amd64\u0026distro=debian-13.1", "UID": "cfba90cadcfe190" }, "Version": "2.4+20151223.gitfa8646d.1", "Release": "2+b5", "Arch": "amd64", "SrcName": "rtmpdump", "SrcVersion": "2.4+20151223.gitfa8646d.1", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libgmp10@2:6.3.0+dfsg-3", "libgnutls30t64@3.8.9-3", "libhogweed6t64@3.10.1-1", "libnettle8t64@3.10.1-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librtmp.so.1", "/usr/share/doc/librtmp1/changelog.Debian.amd64.gz", "/usr/share/doc/librtmp1/changelog.Debian.gz", "/usr/share/doc/librtmp1/changelog.gz", "/usr/share/doc/librtmp1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsasl2-2@2.1.28+dfsg1-9", "Name": "libsasl2-2", "Identifier": { "PURL": "pkg:deb/debian/libsasl2-2@2.1.28%2Bdfsg1-9?arch=amd64\u0026distro=debian-13.1", "UID": "7f75ce6cd34bc17a" }, "Version": "2.1.28+dfsg1", "Release": "9", "Arch": "amd64", "SrcName": "cyrus-sasl2", "SrcVersion": "2.1.28+dfsg1", "SrcRelease": "9", "Licenses": [ "BSD-3-Clause-Attribution", "BSD-3-Clause", "BSD-2-Clause", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-4-Clause-UC", "RSA-MD", "text://BSD-3-Clause-Attribution and IBM-as-is", "BSD-3-clause-JANET", "BSD-3-clause-PADL", "MIT-OpenVision", "OpenLDAP", "FSFULLR", "MIT-CMU", "MIT-Export", "BSD-2.2-clause", "text://IBM-as-is" ], "Maintainer": "Debian Cyrus Team \u003cteam+cyrus@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libsasl2-modules-db@2.1.28+dfsg1-9", "libssl3t64@3.5.1-1+deb13u1" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsasl2.so.2.0.25", "/usr/share/doc/libsasl2-2/README.Debian", "/usr/share/doc/libsasl2-2/changelog.Debian.gz", "/usr/share/doc/libsasl2-2/copyright", "/usr/share/man/man5/libsasl.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libsasl2-modules@2.1.28+dfsg1-9", "Name": "libsasl2-modules", "Identifier": { "PURL": "pkg:deb/debian/libsasl2-modules@2.1.28%2Bdfsg1-9?arch=amd64\u0026distro=debian-13.1", "UID": "cc4035c537ea5963" }, "Version": "2.1.28+dfsg1", "Release": "9", "Arch": "amd64", "SrcName": "cyrus-sasl2", "SrcVersion": "2.1.28+dfsg1", "SrcRelease": "9", "Licenses": [ "BSD-3-Clause-Attribution", "BSD-3-Clause", "BSD-2-Clause", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-4-Clause-UC", "RSA-MD", "text://BSD-3-Clause-Attribution and IBM-as-is", "BSD-3-clause-JANET", "BSD-3-clause-PADL", "MIT-OpenVision", "OpenLDAP", "FSFULLR", "MIT-CMU", "MIT-Export", "BSD-2.2-clause", "text://IBM-as-is" ], "Maintainer": "Debian Cyrus Team \u003cteam+cyrus@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libssl3t64@3.5.1-1+deb13u1" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/sasl2/libanonymous.so.2.0.25", "/usr/lib/x86_64-linux-gnu/sasl2/libcrammd5.so.2.0.25", "/usr/lib/x86_64-linux-gnu/sasl2/libdigestmd5.so.2.0.25", "/usr/lib/x86_64-linux-gnu/sasl2/liblogin.so.2.0.25", "/usr/lib/x86_64-linux-gnu/sasl2/libntlm.so.2.0.25", "/usr/lib/x86_64-linux-gnu/sasl2/libplain.so.2.0.25", "/usr/lib/x86_64-linux-gnu/sasl2/libscram.so.2.0.25", "/usr/share/doc/libsasl2-modules/changelog.Debian.gz", "/usr/share/doc/libsasl2-modules/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsasl2-modules-db@2.1.28+dfsg1-9", "Name": "libsasl2-modules-db", "Identifier": { "PURL": "pkg:deb/debian/libsasl2-modules-db@2.1.28%2Bdfsg1-9?arch=amd64\u0026distro=debian-13.1", "UID": "ab3593ca942348a4" }, "Version": "2.1.28+dfsg1", "Release": "9", "Arch": "amd64", "SrcName": "cyrus-sasl2", "SrcVersion": "2.1.28+dfsg1", "SrcRelease": "9", "Licenses": [ "BSD-3-Clause-Attribution", "BSD-3-Clause", "BSD-2-Clause", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-4-Clause-UC", "RSA-MD", "text://BSD-3-Clause-Attribution and IBM-as-is", "BSD-3-clause-JANET", "BSD-3-clause-PADL", "MIT-OpenVision", "OpenLDAP", "FSFULLR", "MIT-CMU", "MIT-Export", "BSD-2.2-clause", "text://IBM-as-is" ], "Maintainer": "Debian Cyrus Team \u003cteam+cyrus@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libdb5.3t64@5.3.28+dfsg2-9" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/sasl2/libsasldb.so.2.0.25", "/usr/share/doc/libsasl2-modules-db/changelog.Debian.gz", "/usr/share/doc/libsasl2-modules-db/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libseccomp2@2.6.0-2", "Name": "libseccomp2", "Identifier": { "PURL": "pkg:deb/debian/libseccomp2@2.6.0-2?arch=amd64\u0026distro=debian-13.1", "UID": "7c1b86c702e95bfe" }, "Version": "2.6.0", "Release": "2", "Arch": "amd64", "SrcName": "libseccomp", "SrcVersion": "2.6.0", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Kees Cook \u003ckees@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libseccomp.so.2.6.0", "/usr/share/doc/libseccomp2/changelog.Debian.gz", "/usr/share/doc/libseccomp2/changelog.gz", "/usr/share/doc/libseccomp2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libselinux1@3.8.1-1", "Name": "libselinux1", "Identifier": { "PURL": "pkg:deb/debian/libselinux1@3.8.1-1?arch=amd64\u0026distro=debian-13.1", "UID": "9d8a3e2b56cf39f8" }, "Version": "3.8.1", "Release": "1", "Arch": "amd64", "SrcName": "libselinux", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "public-domain", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libpcre2-8-0@10.46-1~deb13u1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/tmpfiles.d/libselinux1.conf", "/usr/lib/x86_64-linux-gnu/libselinux.so.1", "/usr/share/doc/libselinux1/changelog.Debian.gz", "/usr/share/doc/libselinux1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsemanage-common@3.8.1-1", "Name": "libsemanage-common", "Identifier": { "PURL": "pkg:deb/debian/libsemanage-common@3.8.1-1?arch=all\u0026distro=debian-13.1", "UID": "ecc6b54d8bc6318c" }, "Version": "3.8.1", "Release": "1", "Arch": "all", "SrcName": "libsemanage", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/share/doc/libsemanage-common/changelog.Debian.gz", "/usr/share/doc/libsemanage-common/copyright", "/usr/share/man/man5/semanage.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libsemanage2@3.8.1-1", "Name": "libsemanage2", "Identifier": { "PURL": "pkg:deb/debian/libsemanage2@3.8.1-1?arch=amd64\u0026distro=debian-13.1", "UID": "fe185fa0f24aa323" }, "Version": "3.8.1", "Release": "1", "Arch": "amd64", "SrcName": "libsemanage", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:4.0.2-2+b2", "libbz2-1.0@1.0.8-6", "libc6@2.41-12", "libselinux1@3.8.1-1", "libsemanage-common@3.8.1-1", "libsepol2@3.8.1-1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsemanage.so.2", "/usr/share/doc/libsemanage2/changelog.Debian.gz", "/usr/share/doc/libsemanage2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsepol2@3.8.1-1", "Name": "libsepol2", "Identifier": { "PURL": "pkg:deb/debian/libsepol2@3.8.1-1?arch=amd64\u0026distro=debian-13.1", "UID": "321d056c716081fc" }, "Version": "3.8.1", "Release": "1", "Arch": "amd64", "SrcName": "libsepol", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "Zlib", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsepol.so.2", "/usr/share/doc/libsepol2/changelog.Debian.gz", "/usr/share/doc/libsepol2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsmartcols1@2.41-5", "Name": "libsmartcols1", "Identifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "7707866bf21cbb62" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsmartcols.so.1.1.0", "/usr/share/doc/libsmartcols1/NEWS.Debian.gz", "/usr/share/doc/libsmartcols1/changelog.Debian.gz", "/usr/share/doc/libsmartcols1/changelog.gz", "/usr/share/doc/libsmartcols1/copyright", "/usr/share/lintian/overrides/libsmartcols1" ], "AnalyzedBy": "dpkg" }, { "ID": "libsqlite3-0@3.46.1-7", "Name": "libsqlite3-0", "Identifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7?arch=amd64\u0026distro=debian-13.1", "UID": "8f79e2c4d0625e33" }, "Version": "3.46.1", "Release": "7", "Arch": "amd64", "SrcName": "sqlite3", "SrcVersion": "3.46.1", "SrcRelease": "7", "Licenses": [ "public-domain", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6", "/usr/share/doc/libsqlite3-0/README.Debian", "/usr/share/doc/libsqlite3-0/changelog.Debian.gz", "/usr/share/doc/libsqlite3-0/changelog.gz", "/usr/share/doc/libsqlite3-0/changelog.html.gz", "/usr/share/doc/libsqlite3-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libssh2-1t64@1.11.1-1", "Name": "libssh2-1t64", "Identifier": { "PURL": "pkg:deb/debian/libssh2-1t64@1.11.1-1?arch=amd64\u0026distro=debian-13.1", "UID": "748bb5a160a66e58" }, "Version": "1.11.1", "Release": "1", "Arch": "amd64", "SrcName": "libssh2", "SrcVersion": "1.11.1", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "ISC" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libssl3t64@3.5.1-1+deb13u1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libssh2.so.1.0.1", "/usr/share/doc/libssh2-1t64/AUTHORS", "/usr/share/doc/libssh2-1t64/RELEASE-NOTES.gz", "/usr/share/doc/libssh2-1t64/changelog.Debian.gz", "/usr/share/doc/libssh2-1t64/changelog.gz", "/usr/share/doc/libssh2-1t64/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libssl3t64@3.5.1-1+deb13u1", "Name": "libssl3t64", "Identifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "c1c971e12cfd8b07" }, "Version": "3.5.1", "Release": "1+deb13u1", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.5.1", "SrcRelease": "1+deb13u1", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libzstd1@1.5.7+dfsg-1", "openssl-provider-legacy@3.5.1-1+deb13u1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/engines-3/afalg.so", "/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so", "/usr/lib/x86_64-linux-gnu/engines-3/padlock.so", "/usr/lib/x86_64-linux-gnu/libcrypto.so.3", "/usr/lib/x86_64-linux-gnu/libssl.so.3", "/usr/share/doc/libssl3t64/NEWS.Debian.gz", "/usr/share/doc/libssl3t64/changelog.Debian.gz", "/usr/share/doc/libssl3t64/changelog.gz", "/usr/share/doc/libssl3t64/copyright", "/usr/share/lintian/overrides/libssl3t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libstdc++6@14.2.0-19", "Name": "libstdc++6", "Identifier": { "PURL": "pkg:deb/debian/libstdc%2B%2B6@14.2.0-19?arch=amd64\u0026distro=debian-13.1", "UID": "45711be21c33dab9" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12", "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.33", "/usr/share/gcc/python/libstdcxx/__init__.py", "/usr/share/gcc/python/libstdcxx/v6/__init__.py", "/usr/share/gcc/python/libstdcxx/v6/printers.py", "/usr/share/gcc/python/libstdcxx/v6/xmethods.py", "/usr/share/gdb/auto-load/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.33-gdb.py" ], "AnalyzedBy": "dpkg" }, { "ID": "libsystemd0@257.8-1~deb13u2", "Name": "libsystemd0", "Identifier": { "PURL": "pkg:deb/debian/libsystemd0@257.8-1~deb13u2?arch=amd64\u0026distro=debian-13.1", "UID": "5a0862dbd32f489e" }, "Version": "257.8", "Release": "1~deb13u2", "Arch": "amd64", "SrcName": "systemd", "SrcVersion": "257.8", "SrcRelease": "1~deb13u2", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "GPL-2 with Linux-syscall-note exception", "MIT", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libcap2@1:2.75-10+b1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsystemd.so.0.40.0", "/usr/share/doc/libsystemd0/NEWS.Debian.gz", "/usr/share/doc/libsystemd0/changelog.Debian.gz", "/usr/share/doc/libsystemd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtasn1-6@4.20.0-2", "Name": "libtasn1-6", "Identifier": { "PURL": "pkg:deb/debian/libtasn1-6@4.20.0-2?arch=amd64\u0026distro=debian-13.1", "UID": "e598a56ad90a2686" }, "Version": "4.20.0", "Release": "2", "Arch": "amd64", "SrcName": "libtasn1-6", "SrcVersion": "4.20.0", "SrcRelease": "2", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-only", "GPL-3.0-only", "GFDL-1.3-only" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtasn1.so.6.6.4", "/usr/share/doc/libtasn1-6/AUTHORS", "/usr/share/doc/libtasn1-6/README.md", "/usr/share/doc/libtasn1-6/THANKS", "/usr/share/doc/libtasn1-6/changelog.Debian.gz", "/usr/share/doc/libtasn1-6/changelog.gz", "/usr/share/doc/libtasn1-6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtinfo6@6.5+20250216-2", "Name": "libtinfo6", "Identifier": { "PURL": "pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.1", "UID": "2106ba75d7633f0b" }, "Version": "6.5+20250216", "Release": "2", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtic.so.6.5", "/usr/lib/x86_64-linux-gnu/libtinfo.so.6.5", "/usr/share/doc/libtinfo6/changelog.Debian.gz", "/usr/share/doc/libtinfo6/changelog.gz", "/usr/share/doc/libtinfo6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libudev1@257.8-1~deb13u2", "Name": "libudev1", "Identifier": { "PURL": "pkg:deb/debian/libudev1@257.8-1~deb13u2?arch=amd64\u0026distro=debian-13.1", "UID": "e178852f9582c8a9" }, "Version": "257.8", "Release": "1~deb13u2", "Arch": "amd64", "SrcName": "systemd", "SrcVersion": "257.8", "SrcRelease": "1~deb13u2", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "GPL-2 with Linux-syscall-note exception", "MIT", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libcap2@1:2.75-10+b1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libudev.so.1.7.10", "/usr/share/doc/libudev1/NEWS.Debian.gz", "/usr/share/doc/libudev1/changelog.Debian.gz", "/usr/share/doc/libudev1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libunistring5@1.3-2", "Name": "libunistring5", "Identifier": { "PURL": "pkg:deb/debian/libunistring5@1.3-2?arch=amd64\u0026distro=debian-13.1", "UID": "bfb9871468ef2da9" }, "Version": "1.3", "Release": "2", "Arch": "amd64", "SrcName": "libunistring", "SrcVersion": "1.3", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "LGPL-3.0-or-later", "LGPL-2.0-or-later", "GFDL-1.3-or-later", "GFDL-1.2-or-later", "LGPL-3.0-only", "LGPL-2.1-or-later", "BSD-3-Clause", "ISC", "Unicode-DFS-2016", "public-domain", "FreeSoftware", "GPL-2.0-or-later", "GPL-2+ with distribution exception", "MIT", "X11", "GPL-3.0-only", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Jörg Frings-Fürst \u003cdebian@jff.email\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libunistring.so.5.2.0", "/usr/share/doc/libunistring5/changelog.Debian.gz", "/usr/share/doc/libunistring5/changelog.gz", "/usr/share/doc/libunistring5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libuuid1@2.41-5", "Name": "libuuid1", "Identifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "4071f16978620954" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0", "/usr/share/doc/libuuid1/NEWS.Debian.gz", "/usr/share/doc/libuuid1/changelog.Debian.gz", "/usr/share/doc/libuuid1/changelog.gz", "/usr/share/doc/libuuid1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxxhash0@0.8.3-2", "Name": "libxxhash0", "Identifier": { "PURL": "pkg:deb/debian/libxxhash0@0.8.3-2?arch=amd64\u0026distro=debian-13.1", "UID": "ba09f0a5a10f2590" }, "Version": "0.8.3", "Release": "2", "Arch": "amd64", "SrcName": "xxhash", "SrcVersion": "0.8.3", "SrcRelease": "2", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Josue Ortega \u003cjosue@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxxhash.so.0.8.3", "/usr/share/doc/libxxhash0/changelog.Debian.gz", "/usr/share/doc/libxxhash0/changelog.gz", "/usr/share/doc/libxxhash0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzstd1@1.5.7+dfsg-1", "Name": "libzstd1", "Identifier": { "PURL": "pkg:deb/debian/libzstd1@1.5.7%2Bdfsg-1?arch=amd64\u0026distro=debian-13.1", "UID": "b8270358399400aa" }, "Version": "1.5.7+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "libzstd", "SrcVersion": "1.5.7+dfsg", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "Zlib", "MIT" ], "Maintainer": "RPM packaging team \u003cteam+pkg-rpm@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzstd.so.1.5.7", "/usr/share/doc/libzstd1/changelog.Debian.gz", "/usr/share/doc/libzstd1/changelog.gz", "/usr/share/doc/libzstd1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "login@1:4.16.0-2+really2.41-5", "Name": "login", "Identifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "52c13d997b14a282" }, "Version": "4.16.0-2+really2.41", "Release": "5", "Epoch": 1, "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:4.0.2-2+b2", "libc6@2.41-12", "libcrypt1@1:4.4.38-1", "libpam-modules@1.7.0-5", "libpam-runtime@1.7.0-5", "libpam0g@1.7.0-5" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/login", "/usr/bin/newgrp", "/usr/sbin/nologin", "/usr/share/bash-completion/completions/newgrp", "/usr/share/doc/login/NEWS.Debian.gz", "/usr/share/doc/login/changelog.Debian.gz", "/usr/share/doc/login/changelog.gz", "/usr/share/doc/login/copyright", "/usr/share/lintian/overrides/login", "/usr/share/man/de/man1/login.1.gz", "/usr/share/man/de/man8/nologin.8.gz", "/usr/share/man/fr/man1/login.1.gz", "/usr/share/man/man1/login.1.gz", "/usr/share/man/man1/newgrp.1.gz", "/usr/share/man/man8/nologin.8.gz", "/usr/share/man/pl/man1/login.1.gz", "/usr/share/man/pl/man1/newgrp.1.gz", "/usr/share/man/pl/man8/nologin.8.gz", "/usr/share/man/ro/man1/login.1.gz", "/usr/share/man/ro/man1/newgrp.1.gz", "/usr/share/man/ro/man8/nologin.8.gz", "/usr/share/man/sr/man1/login.1.gz", "/usr/share/man/sr/man8/nologin.8.gz", "/usr/share/man/uk/man1/login.1.gz", "/usr/share/man/uk/man1/newgrp.1.gz", "/usr/share/man/uk/man8/nologin.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "login.defs@1:4.17.4-2", "Name": "login.defs", "Identifier": { "PURL": "pkg:deb/debian/login.defs@4.17.4-2?arch=all\u0026distro=debian-13.1\u0026epoch=1", "UID": "b6a337588c67d5a3" }, "Version": "4.17.4", "Release": "2", "Epoch": 1, "Arch": "all", "SrcName": "shadow", "SrcVersion": "4.17.4", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-1.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/share/doc/login.defs/NEWS.Debian.gz", "/usr/share/doc/login.defs/changelog.Debian.gz", "/usr/share/doc/login.defs/changelog.gz", "/usr/share/doc/login.defs/copyright", "/usr/share/man/de/man5/login.defs.5.gz", "/usr/share/man/fr/man5/login.defs.5.gz", "/usr/share/man/it/man5/login.defs.5.gz", "/usr/share/man/ja/man5/login.defs.5.gz", "/usr/share/man/man5/login.defs.5.gz", "/usr/share/man/ru/man5/login.defs.5.gz", "/usr/share/man/uk/man5/login.defs.5.gz", "/usr/share/man/zh_CN/man5/login.defs.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "mawk@1.3.4.20250131-1", "Name": "mawk", "Identifier": { "PURL": "pkg:deb/debian/mawk@1.3.4.20250131-1?arch=amd64\u0026distro=debian-13.1", "UID": "62198507acd5b899" }, "Version": "1.3.4.20250131", "Release": "1", "Arch": "amd64", "SrcName": "mawk", "SrcVersion": "1.3.4.20250131", "SrcRelease": "1", "Licenses": [ "GPL-2.0-only", "X11", "CC-BY-3.0" ], "Maintainer": "Boyuan Yang \u003cbyang@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/mawk", "/usr/share/doc/mawk/ACKNOWLEDGMENT", "/usr/share/doc/mawk/README", "/usr/share/doc/mawk/changelog.Debian.gz", "/usr/share/doc/mawk/changelog.gz", "/usr/share/doc/mawk/copyright", "/usr/share/doc/mawk/examples/ct_length.awk", "/usr/share/doc/mawk/examples/decl.awk", "/usr/share/doc/mawk/examples/deps.awk", "/usr/share/doc/mawk/examples/eatc.awk", "/usr/share/doc/mawk/examples/gdecl.awk", "/usr/share/doc/mawk/examples/hcal", "/usr/share/doc/mawk/examples/hical", "/usr/share/doc/mawk/examples/nocomment.awk", "/usr/share/doc/mawk/examples/primes.awk", "/usr/share/doc/mawk/examples/qsort.awk", "/usr/share/man/man1/mawk.1.gz", "/usr/share/man/man7/mawk-arrays.7.gz", "/usr/share/man/man7/mawk-code.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "mount@2.41-5", "Name": "mount", "Identifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "55c835c674d0a0e5" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/mount", "/usr/bin/umount", "/usr/sbin/losetup", "/usr/sbin/swapoff", "/usr/sbin/swapon", "/usr/share/bash-completion/completions/losetup", "/usr/share/bash-completion/completions/mount", "/usr/share/bash-completion/completions/swapoff", "/usr/share/bash-completion/completions/swapon", "/usr/share/bash-completion/completions/umount", "/usr/share/doc/mount/NEWS.Debian.gz", "/usr/share/doc/mount/changelog.Debian.gz", "/usr/share/doc/mount/changelog.gz", "/usr/share/doc/mount/copyright", "/usr/share/doc/mount/examples/filesystems", "/usr/share/doc/mount/examples/fstab", "/usr/share/doc/mount/examples/mount.fstab", "/usr/share/doc/mount/mount.txt", "/usr/share/lintian/overrides/mount", "/usr/share/man/man5/fstab.5.gz", "/usr/share/man/man8/losetup.8.gz", "/usr/share/man/man8/mount.8.gz", "/usr/share/man/man8/swapon.8.gz", "/usr/share/man/man8/umount.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ncurses-base@6.5+20250216-2", "Name": "ncurses-base", "Identifier": { "PURL": "pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all\u0026distro=debian-13.1", "UID": "767a0231348a5cb5" }, "Version": "6.5+20250216", "Release": "2", "Arch": "all", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/share/doc/ncurses-base/FAQ", "/usr/share/doc/ncurses-base/TODO.Debian", "/usr/share/doc/ncurses-base/changelog.Debian.gz", "/usr/share/doc/ncurses-base/changelog.gz", "/usr/share/doc/ncurses-base/copyright", "/usr/share/lintian/overrides/ncurses-base", "/usr/share/tabset/std", "/usr/share/tabset/stdcrt", "/usr/share/tabset/vt100", "/usr/share/tabset/vt300", "/usr/share/terminfo/E/Eterm", "/usr/share/terminfo/a/ansi", "/usr/share/terminfo/c/cons25", "/usr/share/terminfo/c/cygwin", "/usr/share/terminfo/d/dumb", "/usr/share/terminfo/h/hurd", "/usr/share/terminfo/l/linux", "/usr/share/terminfo/m/mach", "/usr/share/terminfo/m/mach-bold", "/usr/share/terminfo/m/mach-color", "/usr/share/terminfo/m/mach-gnu", "/usr/share/terminfo/m/mach-gnu-color", "/usr/share/terminfo/p/pcansi", "/usr/share/terminfo/r/rxvt", "/usr/share/terminfo/r/rxvt-basic", "/usr/share/terminfo/r/rxvt-unicode", "/usr/share/terminfo/r/rxvt-unicode-256color", "/usr/share/terminfo/s/screen", "/usr/share/terminfo/s/screen-256color", "/usr/share/terminfo/s/screen-256color-bce", "/usr/share/terminfo/s/screen-bce", "/usr/share/terminfo/s/screen-s", "/usr/share/terminfo/s/screen-w", "/usr/share/terminfo/s/screen.xterm-256color", "/usr/share/terminfo/s/sun", "/usr/share/terminfo/t/tmux", "/usr/share/terminfo/t/tmux-256color", "/usr/share/terminfo/v/vt100", "/usr/share/terminfo/v/vt102", "/usr/share/terminfo/v/vt220", "/usr/share/terminfo/v/vt52", "/usr/share/terminfo/w/wsvt25", "/usr/share/terminfo/w/wsvt25m", "/usr/share/terminfo/x/xterm", "/usr/share/terminfo/x/xterm-256color", "/usr/share/terminfo/x/xterm-color", "/usr/share/terminfo/x/xterm-mono", "/usr/share/terminfo/x/xterm-r5", "/usr/share/terminfo/x/xterm-r6", "/usr/share/terminfo/x/xterm-vt220", "/usr/share/terminfo/x/xterm-xfree86" ], "AnalyzedBy": "dpkg" }, { "ID": "ncurses-bin@6.5+20250216-2", "Name": "ncurses-bin", "Identifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.1", "UID": "5b541563cf6587e5" }, "Version": "6.5+20250216", "Release": "2", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/clear", "/usr/bin/infocmp", "/usr/bin/tabs", "/usr/bin/tic", "/usr/bin/toe", "/usr/bin/tput", "/usr/bin/tset", "/usr/share/doc/ncurses-bin/changelog.Debian.gz", "/usr/share/doc/ncurses-bin/changelog.gz", "/usr/share/doc/ncurses-bin/copyright", "/usr/share/man/man1/captoinfo.1.gz", "/usr/share/man/man1/clear.1.gz", "/usr/share/man/man1/infocmp.1.gz", "/usr/share/man/man1/infotocap.1.gz", "/usr/share/man/man1/tabs.1.gz", "/usr/share/man/man1/tic.1.gz", "/usr/share/man/man1/toe.1.gz", "/usr/share/man/man1/tput.1.gz", "/usr/share/man/man1/tset.1.gz", "/usr/share/man/man5/scr_dump.5.gz", "/usr/share/man/man5/term.5.gz", "/usr/share/man/man5/terminfo.5.gz", "/usr/share/man/man5/user_caps.5.gz", "/usr/share/man/man7/term.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "netbase@6.5", "Name": "netbase", "Identifier": { "PURL": "pkg:deb/debian/netbase@6.5?arch=all\u0026distro=debian-13.1", "UID": "9929ff265179fc61" }, "Version": "6.5", "Arch": "all", "SrcName": "netbase", "SrcVersion": "6.5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "InstalledFiles": [ "/usr/share/doc/netbase/changelog.gz", "/usr/share/doc/netbase/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "openssl@3.5.1-1+deb13u1", "Name": "openssl", "Identifier": { "PURL": "pkg:deb/debian/openssl@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "bb3df0b626c57a91" }, "Version": "3.5.1", "Release": "1+deb13u1", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.5.1", "SrcRelease": "1+deb13u1", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libssl3t64@3.5.1-1+deb13u1" ], "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "InstalledFiles": [ "/usr/bin/c_rehash", "/usr/bin/openssl", "/usr/lib/ssl/misc/CA.pl", "/usr/lib/ssl/misc/tsget.pl", "/usr/share/doc/openssl/HOWTO/certificates.txt.gz", "/usr/share/doc/openssl/HOWTO/documenting-functions-and-macros.md.gz", "/usr/share/doc/openssl/HOWTO/keys.txt.gz", "/usr/share/doc/openssl/NEWS.md.gz", "/usr/share/doc/openssl/README-ENGINES.md.gz", "/usr/share/doc/openssl/README-PROVIDERS.md.gz", "/usr/share/doc/openssl/README-QUIC.md.gz", "/usr/share/doc/openssl/README.Debian", "/usr/share/doc/openssl/README.md.gz", "/usr/share/doc/openssl/changelog.Debian.gz", "/usr/share/doc/openssl/changelog.gz", "/usr/share/doc/openssl/copyright", "/usr/share/doc/openssl/fingerprints.txt", "/usr/share/lintian/overrides/openssl", "/usr/share/man/man1/CA.pl.1ssl.gz", "/usr/share/man/man1/openssl-asn1parse.1ssl.gz", "/usr/share/man/man1/openssl-ca.1ssl.gz", "/usr/share/man/man1/openssl-ciphers.1ssl.gz", "/usr/share/man/man1/openssl-cmds.1ssl.gz", "/usr/share/man/man1/openssl-cmp.1ssl.gz", "/usr/share/man/man1/openssl-cms.1ssl.gz", "/usr/share/man/man1/openssl-crl.1ssl.gz", "/usr/share/man/man1/openssl-crl2pkcs7.1ssl.gz", "/usr/share/man/man1/openssl-dgst.1ssl.gz", "/usr/share/man/man1/openssl-dhparam.1ssl.gz", "/usr/share/man/man1/openssl-dsa.1ssl.gz", "/usr/share/man/man1/openssl-dsaparam.1ssl.gz", "/usr/share/man/man1/openssl-ec.1ssl.gz", "/usr/share/man/man1/openssl-ecparam.1ssl.gz", "/usr/share/man/man1/openssl-enc.1ssl.gz", "/usr/share/man/man1/openssl-engine.1ssl.gz", "/usr/share/man/man1/openssl-errstr.1ssl.gz", "/usr/share/man/man1/openssl-fipsinstall.1ssl.gz", "/usr/share/man/man1/openssl-format-options.1ssl.gz", "/usr/share/man/man1/openssl-gendsa.1ssl.gz", "/usr/share/man/man1/openssl-genpkey.1ssl.gz", "/usr/share/man/man1/openssl-genrsa.1ssl.gz", "/usr/share/man/man1/openssl-info.1ssl.gz", "/usr/share/man/man1/openssl-kdf.1ssl.gz", "/usr/share/man/man1/openssl-list.1ssl.gz", "/usr/share/man/man1/openssl-mac.1ssl.gz", "/usr/share/man/man1/openssl-namedisplay-options.1ssl.gz", "/usr/share/man/man1/openssl-nseq.1ssl.gz", "/usr/share/man/man1/openssl-ocsp.1ssl.gz", "/usr/share/man/man1/openssl-passphrase-options.1ssl.gz", "/usr/share/man/man1/openssl-passwd.1ssl.gz", "/usr/share/man/man1/openssl-pkcs12.1ssl.gz", "/usr/share/man/man1/openssl-pkcs7.1ssl.gz", "/usr/share/man/man1/openssl-pkcs8.1ssl.gz", "/usr/share/man/man1/openssl-pkey.1ssl.gz", "/usr/share/man/man1/openssl-pkeyparam.1ssl.gz", "/usr/share/man/man1/openssl-pkeyutl.1ssl.gz", "/usr/share/man/man1/openssl-prime.1ssl.gz", "/usr/share/man/man1/openssl-rand.1ssl.gz", "/usr/share/man/man1/openssl-rehash.1ssl.gz", "/usr/share/man/man1/openssl-req.1ssl.gz", "/usr/share/man/man1/openssl-rsa.1ssl.gz", "/usr/share/man/man1/openssl-rsautl.1ssl.gz", "/usr/share/man/man1/openssl-s_client.1ssl.gz", "/usr/share/man/man1/openssl-s_server.1ssl.gz", "/usr/share/man/man1/openssl-s_time.1ssl.gz", "/usr/share/man/man1/openssl-sess_id.1ssl.gz", "/usr/share/man/man1/openssl-skeyutl.1ssl.gz", "/usr/share/man/man1/openssl-smime.1ssl.gz", "/usr/share/man/man1/openssl-speed.1ssl.gz", "/usr/share/man/man1/openssl-spkac.1ssl.gz", "/usr/share/man/man1/openssl-srp.1ssl.gz", "/usr/share/man/man1/openssl-storeutl.1ssl.gz", "/usr/share/man/man1/openssl-ts.1ssl.gz", "/usr/share/man/man1/openssl-verification-options.1ssl.gz", "/usr/share/man/man1/openssl-verify.1ssl.gz", "/usr/share/man/man1/openssl-version.1ssl.gz", "/usr/share/man/man1/openssl-x509.1ssl.gz", "/usr/share/man/man1/openssl.1ssl.gz", "/usr/share/man/man1/tsget.1ssl.gz", "/usr/share/man/man5/config.5ssl.gz", "/usr/share/man/man5/fips_config.5ssl.gz", "/usr/share/man/man5/x509v3_config.5ssl.gz", "/usr/share/man/man7/EVP_ASYM_CIPHER-RSA.7ssl.gz", "/usr/share/man/man7/EVP_ASYM_CIPHER-SM2.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-AES.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-ARIA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-BLOWFISH.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CAMELLIA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CAST.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CHACHA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-DES.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-IDEA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-NULL.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC2.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC4.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC5.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-SEED.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-SM4.7ssl.gz", "/usr/share/man/man7/EVP_KDF-ARGON2.7ssl.gz", "/usr/share/man/man7/EVP_KDF-HKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-HMAC-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_KDF-KB.7ssl.gz", "/usr/share/man/man7/EVP_KDF-KRB5KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PBKDF1.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PBKDF2.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PKCS12KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PVKKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SCRYPT.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SS.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SSHKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-TLS13_KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-TLS1_PRF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X942-ASN1.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X942-CONCAT.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X963.7ssl.gz", "/usr/share/man/man7/EVP_KEM-EC.7ssl.gz", "/usr/share/man/man7/EVP_KEM-ML-KEM.7ssl.gz", "/usr/share/man/man7/EVP_KEM-RSA.7ssl.gz", "/usr/share/man/man7/EVP_KEM-X25519.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-DH.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-ECDH.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-X25519.7ssl.gz", "/usr/share/man/man7/EVP_MAC-BLAKE2.7ssl.gz", "/usr/share/man/man7/EVP_MAC-CMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-GMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-KMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-Poly1305.7ssl.gz", "/usr/share/man/man7/EVP_MAC-Siphash.7ssl.gz", "/usr/share/man/man7/EVP_MD-BLAKE2.7ssl.gz", "/usr/share/man/man7/EVP_MD-KECCAK.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD2.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD4.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD5-SHA1.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD5.7ssl.gz", "/usr/share/man/man7/EVP_MD-MDC2.7ssl.gz", "/usr/share/man/man7/EVP_MD-NULL.7ssl.gz", "/usr/share/man/man7/EVP_MD-RIPEMD160.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA1.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA2.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA3.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHAKE.7ssl.gz", "/usr/share/man/man7/EVP_MD-SM3.7ssl.gz", "/usr/share/man/man7/EVP_MD-WHIRLPOOL.7ssl.gz", "/usr/share/man/man7/EVP_MD-common.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-DH.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-EC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-FFC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-ML-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-ML-KEM.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-RSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-SLH-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-SM2.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-X25519.7ssl.gz", "/usr/share/man/man7/EVP_RAND-CRNG-TEST.7ssl.gz", "/usr/share/man/man7/EVP_RAND-CTR-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-HASH-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-HMAC-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-JITTER.7ssl.gz", "/usr/share/man/man7/EVP_RAND-SEED-SRC.7ssl.gz", "/usr/share/man/man7/EVP_RAND-TEST-RAND.7ssl.gz", "/usr/share/man/man7/EVP_RAND.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-DSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ECDSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ED25519.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ML-DSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-RSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-SLH-DSA.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-FIPS.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-base.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-default.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-legacy.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-null.7ssl.gz", "/usr/share/man/man7/OSSL_STORE-winstore.7ssl.gz", "/usr/share/man/man7/RAND.7ssl.gz", "/usr/share/man/man7/RSA-PSS.7ssl.gz", "/usr/share/man/man7/X25519.7ssl.gz", "/usr/share/man/man7/bio.7ssl.gz", "/usr/share/man/man7/ct.7ssl.gz", "/usr/share/man/man7/des_modes.7ssl.gz", "/usr/share/man/man7/evp.7ssl.gz", "/usr/share/man/man7/fips_module.7ssl.gz", "/usr/share/man/man7/life_cycle-cipher.7ssl.gz", "/usr/share/man/man7/life_cycle-digest.7ssl.gz", "/usr/share/man/man7/life_cycle-kdf.7ssl.gz", "/usr/share/man/man7/life_cycle-mac.7ssl.gz", "/usr/share/man/man7/life_cycle-pkey.7ssl.gz", "/usr/share/man/man7/life_cycle-rand.7ssl.gz", "/usr/share/man/man7/openssl-core.h.7ssl.gz", "/usr/share/man/man7/openssl-core_dispatch.h.7ssl.gz", "/usr/share/man/man7/openssl-core_names.h.7ssl.gz", "/usr/share/man/man7/openssl-env.7ssl.gz", "/usr/share/man/man7/openssl-glossary.7ssl.gz", "/usr/share/man/man7/openssl-qlog.7ssl.gz", "/usr/share/man/man7/openssl-quic-concurrency.7ssl.gz", "/usr/share/man/man7/openssl-quic.7ssl.gz", "/usr/share/man/man7/openssl-threads.7ssl.gz", "/usr/share/man/man7/openssl_user_macros.7ssl.gz", "/usr/share/man/man7/ossl-guide-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-libcrypto-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-libraries-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-libssl-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-migration.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-client-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-client-non-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-multi-stream.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-server-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-server-non-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-client-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-client-non-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-server-block.7ssl.gz", "/usr/share/man/man7/ossl_store-file.7ssl.gz", "/usr/share/man/man7/ossl_store.7ssl.gz", "/usr/share/man/man7/passphrase-encoding.7ssl.gz", "/usr/share/man/man7/property.7ssl.gz", "/usr/share/man/man7/provider-asym_cipher.7ssl.gz", "/usr/share/man/man7/provider-base.7ssl.gz", "/usr/share/man/man7/provider-cipher.7ssl.gz", "/usr/share/man/man7/provider-decoder.7ssl.gz", "/usr/share/man/man7/provider-digest.7ssl.gz", "/usr/share/man/man7/provider-encoder.7ssl.gz", "/usr/share/man/man7/provider-kdf.7ssl.gz", "/usr/share/man/man7/provider-kem.7ssl.gz", "/usr/share/man/man7/provider-keyexch.7ssl.gz", "/usr/share/man/man7/provider-keymgmt.7ssl.gz", "/usr/share/man/man7/provider-mac.7ssl.gz", "/usr/share/man/man7/provider-object.7ssl.gz", "/usr/share/man/man7/provider-rand.7ssl.gz", "/usr/share/man/man7/provider-signature.7ssl.gz", "/usr/share/man/man7/provider-skeymgmt.7ssl.gz", "/usr/share/man/man7/provider-storemgmt.7ssl.gz", "/usr/share/man/man7/provider.7ssl.gz", "/usr/share/man/man7/proxy-certificates.7ssl.gz", "/usr/share/man/man7/x509.7ssl.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "openssl-provider-legacy@3.5.1-1+deb13u1", "Name": "openssl-provider-legacy", "Identifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "317b92010de10747" }, "Version": "3.5.1", "Release": "1+deb13u1", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.5.1", "SrcRelease": "1+deb13u1", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libssl3t64@3.5.1-1+deb13u1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so", "/usr/share/doc/openssl-provider-legacy/changelog.Debian.gz", "/usr/share/doc/openssl-provider-legacy/changelog.gz", "/usr/share/doc/openssl-provider-legacy/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "passwd@1:4.17.4-2", "Name": "passwd", "Identifier": { "PURL": "pkg:deb/debian/passwd@4.17.4-2?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "2e845022a605458d" }, "Version": "4.17.4", "Release": "2", "Epoch": 1, "Arch": "amd64", "SrcName": "shadow", "SrcVersion": "4.17.4", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-1.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "base-passwd@3.6.7", "libacl1@2.3.2-2+b1", "libattr1@1:2.5.2-3", "libaudit1@1:4.0.2-2+b2", "libbsd0@0.12.2-2", "libc6@2.41-12", "libcrypt1@1:4.4.38-1", "libpam-modules@1.7.0-5", "libpam0g@1.7.0-5", "libselinux1@3.8.1-1", "libsemanage2@3.8.1-1", "login.defs@1:4.17.4-2" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/chage", "/usr/bin/chfn", "/usr/bin/chsh", "/usr/bin/expiry", "/usr/bin/gpasswd", "/usr/bin/passwd", "/usr/lib/tmpfiles.d/passwd.conf", "/usr/sbin/chgpasswd", "/usr/sbin/chpasswd", "/usr/sbin/groupadd", "/usr/sbin/groupdel", "/usr/sbin/groupmod", "/usr/sbin/grpck", "/usr/sbin/grpconv", "/usr/sbin/grpunconv", "/usr/sbin/newusers", "/usr/sbin/pwck", "/usr/sbin/pwconv", "/usr/sbin/pwunconv", "/usr/sbin/shadowconfig", "/usr/sbin/useradd", "/usr/sbin/userdel", "/usr/sbin/usermod", "/usr/sbin/vipw", "/usr/share/doc/passwd/NEWS.Debian.gz", "/usr/share/doc/passwd/README.Debian", "/usr/share/doc/passwd/TODO.Debian", "/usr/share/doc/passwd/changelog.Debian.gz", "/usr/share/doc/passwd/changelog.gz", "/usr/share/doc/passwd/copyright", "/usr/share/doc/passwd/examples/passwd.expire.cron", "/usr/share/lintian/overrides/passwd", "/usr/share/locale/bs/LC_MESSAGES/shadow.mo", "/usr/share/locale/ca/LC_MESSAGES/shadow.mo", "/usr/share/locale/cs/LC_MESSAGES/shadow.mo", "/usr/share/locale/da/LC_MESSAGES/shadow.mo", "/usr/share/locale/de/LC_MESSAGES/shadow.mo", "/usr/share/locale/dz/LC_MESSAGES/shadow.mo", "/usr/share/locale/el/LC_MESSAGES/shadow.mo", "/usr/share/locale/es/LC_MESSAGES/shadow.mo", "/usr/share/locale/eu/LC_MESSAGES/shadow.mo", "/usr/share/locale/fi/LC_MESSAGES/shadow.mo", "/usr/share/locale/fr/LC_MESSAGES/shadow.mo", "/usr/share/locale/gl/LC_MESSAGES/shadow.mo", "/usr/share/locale/he/LC_MESSAGES/shadow.mo", "/usr/share/locale/hu/LC_MESSAGES/shadow.mo", "/usr/share/locale/id/LC_MESSAGES/shadow.mo", "/usr/share/locale/it/LC_MESSAGES/shadow.mo", "/usr/share/locale/ja/LC_MESSAGES/shadow.mo", "/usr/share/locale/ka/LC_MESSAGES/shadow.mo", "/usr/share/locale/kk/LC_MESSAGES/shadow.mo", "/usr/share/locale/km/LC_MESSAGES/shadow.mo", "/usr/share/locale/ko/LC_MESSAGES/shadow.mo", "/usr/share/locale/nb/LC_MESSAGES/shadow.mo", "/usr/share/locale/ne/LC_MESSAGES/shadow.mo", "/usr/share/locale/nl/LC_MESSAGES/shadow.mo", "/usr/share/locale/nn/LC_MESSAGES/shadow.mo", "/usr/share/locale/pl/LC_MESSAGES/shadow.mo", "/usr/share/locale/pt/LC_MESSAGES/shadow.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/shadow.mo", "/usr/share/locale/ro/LC_MESSAGES/shadow.mo", "/usr/share/locale/ru/LC_MESSAGES/shadow.mo", "/usr/share/locale/sk/LC_MESSAGES/shadow.mo", "/usr/share/locale/sq/LC_MESSAGES/shadow.mo", "/usr/share/locale/sv/LC_MESSAGES/shadow.mo", "/usr/share/locale/tl/LC_MESSAGES/shadow.mo", "/usr/share/locale/tr/LC_MESSAGES/shadow.mo", "/usr/share/locale/uk/LC_MESSAGES/shadow.mo", "/usr/share/locale/vi/LC_MESSAGES/shadow.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/shadow.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/shadow.mo", "/usr/share/man/cs/man1/expiry.1.gz", "/usr/share/man/cs/man1/gpasswd.1.gz", "/usr/share/man/cs/man5/gshadow.5.gz", "/usr/share/man/cs/man5/passwd.5.gz", "/usr/share/man/cs/man5/shadow.5.gz", "/usr/share/man/cs/man8/groupadd.8.gz", "/usr/share/man/cs/man8/groupdel.8.gz", "/usr/share/man/cs/man8/groupmod.8.gz", "/usr/share/man/cs/man8/grpck.8.gz", "/usr/share/man/cs/man8/vipw.8.gz", "/usr/share/man/da/man1/chfn.1.gz", "/usr/share/man/da/man5/gshadow.5.gz", "/usr/share/man/da/man8/groupdel.8.gz", "/usr/share/man/da/man8/vipw.8.gz", "/usr/share/man/de/man1/chage.1.gz", "/usr/share/man/de/man1/chfn.1.gz", "/usr/share/man/de/man1/chsh.1.gz", "/usr/share/man/de/man1/expiry.1.gz", "/usr/share/man/de/man1/gpasswd.1.gz", "/usr/share/man/de/man1/passwd.1.gz", "/usr/share/man/de/man5/gshadow.5.gz", "/usr/share/man/de/man5/passwd.5.gz", "/usr/share/man/de/man5/shadow.5.gz", "/usr/share/man/de/man8/chgpasswd.8.gz", "/usr/share/man/de/man8/chpasswd.8.gz", "/usr/share/man/de/man8/groupadd.8.gz", "/usr/share/man/de/man8/groupdel.8.gz", "/usr/share/man/de/man8/groupmod.8.gz", "/usr/share/man/de/man8/grpck.8.gz", "/usr/share/man/de/man8/newusers.8.gz", "/usr/share/man/de/man8/pwck.8.gz", "/usr/share/man/de/man8/pwconv.8.gz", "/usr/share/man/de/man8/useradd.8.gz", "/usr/share/man/de/man8/userdel.8.gz", "/usr/share/man/de/man8/usermod.8.gz", "/usr/share/man/de/man8/vipw.8.gz", "/usr/share/man/fi/man1/chfn.1.gz", "/usr/share/man/fi/man1/chsh.1.gz", "/usr/share/man/fr/man1/chage.1.gz", "/usr/share/man/fr/man1/chfn.1.gz", "/usr/share/man/fr/man1/chsh.1.gz", "/usr/share/man/fr/man1/expiry.1.gz", "/usr/share/man/fr/man1/gpasswd.1.gz", "/usr/share/man/fr/man1/passwd.1.gz", "/usr/share/man/fr/man5/gshadow.5.gz", "/usr/share/man/fr/man5/passwd.5.gz", "/usr/share/man/fr/man5/shadow.5.gz", "/usr/share/man/fr/man5/subgid.5.gz", "/usr/share/man/fr/man5/subuid.5.gz", "/usr/share/man/fr/man8/chgpasswd.8.gz", "/usr/share/man/fr/man8/chpasswd.8.gz", "/usr/share/man/fr/man8/groupadd.8.gz", "/usr/share/man/fr/man8/groupdel.8.gz", "/usr/share/man/fr/man8/groupmod.8.gz", "/usr/share/man/fr/man8/grpck.8.gz", "/usr/share/man/fr/man8/newusers.8.gz", "/usr/share/man/fr/man8/pwck.8.gz", "/usr/share/man/fr/man8/pwconv.8.gz", "/usr/share/man/fr/man8/useradd.8.gz", "/usr/share/man/fr/man8/userdel.8.gz", "/usr/share/man/fr/man8/usermod.8.gz", "/usr/share/man/fr/man8/vipw.8.gz", "/usr/share/man/hu/man1/chsh.1.gz", "/usr/share/man/hu/man1/gpasswd.1.gz", "/usr/share/man/hu/man1/passwd.1.gz", "/usr/share/man/hu/man5/passwd.5.gz", "/usr/share/man/id/man1/chsh.1.gz", "/usr/share/man/id/man8/useradd.8.gz", "/usr/share/man/it/man1/chage.1.gz", "/usr/share/man/it/man1/chfn.1.gz", "/usr/share/man/it/man1/chsh.1.gz", "/usr/share/man/it/man1/expiry.1.gz", "/usr/share/man/it/man1/gpasswd.1.gz", "/usr/share/man/it/man1/passwd.1.gz", "/usr/share/man/it/man5/gshadow.5.gz", "/usr/share/man/it/man5/passwd.5.gz", "/usr/share/man/it/man5/shadow.5.gz", "/usr/share/man/it/man8/chgpasswd.8.gz", "/usr/share/man/it/man8/chpasswd.8.gz", "/usr/share/man/it/man8/groupadd.8.gz", "/usr/share/man/it/man8/groupdel.8.gz", "/usr/share/man/it/man8/groupmod.8.gz", "/usr/share/man/it/man8/grpck.8.gz", "/usr/share/man/it/man8/newusers.8.gz", "/usr/share/man/it/man8/pwck.8.gz", "/usr/share/man/it/man8/pwconv.8.gz", "/usr/share/man/it/man8/useradd.8.gz", "/usr/share/man/it/man8/userdel.8.gz", "/usr/share/man/it/man8/usermod.8.gz", "/usr/share/man/it/man8/vipw.8.gz", "/usr/share/man/ja/man1/chage.1.gz", "/usr/share/man/ja/man1/chfn.1.gz", "/usr/share/man/ja/man1/chsh.1.gz", "/usr/share/man/ja/man1/expiry.1.gz", "/usr/share/man/ja/man1/gpasswd.1.gz", "/usr/share/man/ja/man1/passwd.1.gz", "/usr/share/man/ja/man5/passwd.5.gz", "/usr/share/man/ja/man5/shadow.5.gz", "/usr/share/man/ja/man8/chpasswd.8.gz", "/usr/share/man/ja/man8/groupadd.8.gz", "/usr/share/man/ja/man8/groupdel.8.gz", "/usr/share/man/ja/man8/groupmod.8.gz", "/usr/share/man/ja/man8/grpck.8.gz", "/usr/share/man/ja/man8/newusers.8.gz", "/usr/share/man/ja/man8/pwck.8.gz", "/usr/share/man/ja/man8/pwconv.8.gz", "/usr/share/man/ja/man8/useradd.8.gz", "/usr/share/man/ja/man8/userdel.8.gz", "/usr/share/man/ja/man8/usermod.8.gz", "/usr/share/man/ja/man8/vipw.8.gz", "/usr/share/man/ko/man1/chfn.1.gz", "/usr/share/man/ko/man1/chsh.1.gz", "/usr/share/man/ko/man5/passwd.5.gz", "/usr/share/man/ko/man8/vipw.8.gz", "/usr/share/man/man1/chage.1.gz", "/usr/share/man/man1/chfn.1.gz", "/usr/share/man/man1/chsh.1.gz", "/usr/share/man/man1/expiry.1.gz", "/usr/share/man/man1/gpasswd.1.gz", "/usr/share/man/man1/passwd.1.gz", "/usr/share/man/man5/gshadow.5.gz", "/usr/share/man/man5/passwd.5.gz", "/usr/share/man/man5/shadow.5.gz", "/usr/share/man/man5/subgid.5.gz", "/usr/share/man/man5/subuid.5.gz", "/usr/share/man/man8/chgpasswd.8.gz", "/usr/share/man/man8/chpasswd.8.gz", "/usr/share/man/man8/groupadd.8.gz", "/usr/share/man/man8/groupdel.8.gz", "/usr/share/man/man8/groupmod.8.gz", "/usr/share/man/man8/grpck.8.gz", "/usr/share/man/man8/newusers.8.gz", "/usr/share/man/man8/pwck.8.gz", "/usr/share/man/man8/pwconv.8.gz", "/usr/share/man/man8/shadowconfig.8.gz", "/usr/share/man/man8/useradd.8.gz", "/usr/share/man/man8/userdel.8.gz", "/usr/share/man/man8/usermod.8.gz", "/usr/share/man/man8/vipw.8.gz", "/usr/share/man/pl/man1/chage.1.gz", "/usr/share/man/pl/man1/chsh.1.gz", "/usr/share/man/pl/man1/expiry.1.gz", "/usr/share/man/pl/man8/groupadd.8.gz", "/usr/share/man/pl/man8/groupdel.8.gz", "/usr/share/man/pl/man8/groupmod.8.gz", "/usr/share/man/pl/man8/grpck.8.gz", "/usr/share/man/pl/man8/userdel.8.gz", "/usr/share/man/pl/man8/usermod.8.gz", "/usr/share/man/pl/man8/vipw.8.gz", "/usr/share/man/pt_BR/man1/gpasswd.1.gz", "/usr/share/man/pt_BR/man5/passwd.5.gz", "/usr/share/man/pt_BR/man5/shadow.5.gz", "/usr/share/man/pt_BR/man8/groupadd.8.gz", "/usr/share/man/pt_BR/man8/groupdel.8.gz", "/usr/share/man/pt_BR/man8/groupmod.8.gz", "/usr/share/man/ru/man1/chage.1.gz", "/usr/share/man/ru/man1/chfn.1.gz", "/usr/share/man/ru/man1/chsh.1.gz", "/usr/share/man/ru/man1/expiry.1.gz", "/usr/share/man/ru/man1/gpasswd.1.gz", "/usr/share/man/ru/man1/passwd.1.gz", "/usr/share/man/ru/man5/gshadow.5.gz", "/usr/share/man/ru/man5/passwd.5.gz", "/usr/share/man/ru/man5/shadow.5.gz", "/usr/share/man/ru/man8/chgpasswd.8.gz", "/usr/share/man/ru/man8/chpasswd.8.gz", "/usr/share/man/ru/man8/groupadd.8.gz", "/usr/share/man/ru/man8/groupdel.8.gz", "/usr/share/man/ru/man8/groupmod.8.gz", "/usr/share/man/ru/man8/grpck.8.gz", "/usr/share/man/ru/man8/newusers.8.gz", "/usr/share/man/ru/man8/pwck.8.gz", "/usr/share/man/ru/man8/pwconv.8.gz", "/usr/share/man/ru/man8/useradd.8.gz", "/usr/share/man/ru/man8/userdel.8.gz", "/usr/share/man/ru/man8/usermod.8.gz", "/usr/share/man/ru/man8/vipw.8.gz", "/usr/share/man/sv/man1/chage.1.gz", "/usr/share/man/sv/man1/chsh.1.gz", "/usr/share/man/sv/man1/expiry.1.gz", "/usr/share/man/sv/man1/passwd.1.gz", "/usr/share/man/sv/man5/gshadow.5.gz", "/usr/share/man/sv/man5/passwd.5.gz", "/usr/share/man/sv/man8/groupadd.8.gz", "/usr/share/man/sv/man8/groupdel.8.gz", "/usr/share/man/sv/man8/groupmod.8.gz", "/usr/share/man/sv/man8/grpck.8.gz", "/usr/share/man/sv/man8/pwck.8.gz", "/usr/share/man/sv/man8/userdel.8.gz", "/usr/share/man/sv/man8/vipw.8.gz", "/usr/share/man/tr/man1/chage.1.gz", "/usr/share/man/tr/man1/chfn.1.gz", "/usr/share/man/tr/man1/passwd.1.gz", "/usr/share/man/tr/man5/passwd.5.gz", "/usr/share/man/tr/man5/shadow.5.gz", "/usr/share/man/tr/man8/groupadd.8.gz", "/usr/share/man/tr/man8/groupdel.8.gz", "/usr/share/man/tr/man8/groupmod.8.gz", "/usr/share/man/tr/man8/useradd.8.gz", "/usr/share/man/tr/man8/userdel.8.gz", "/usr/share/man/tr/man8/usermod.8.gz", "/usr/share/man/uk/man1/chage.1.gz", "/usr/share/man/uk/man1/chfn.1.gz", "/usr/share/man/uk/man1/chsh.1.gz", "/usr/share/man/uk/man1/expiry.1.gz", "/usr/share/man/uk/man1/gpasswd.1.gz", "/usr/share/man/uk/man1/passwd.1.gz", "/usr/share/man/uk/man5/gshadow.5.gz", "/usr/share/man/uk/man5/passwd.5.gz", "/usr/share/man/uk/man5/shadow.5.gz", "/usr/share/man/uk/man8/chgpasswd.8.gz", "/usr/share/man/uk/man8/chpasswd.8.gz", "/usr/share/man/uk/man8/groupadd.8.gz", "/usr/share/man/uk/man8/groupdel.8.gz", "/usr/share/man/uk/man8/groupmod.8.gz", "/usr/share/man/uk/man8/grpck.8.gz", "/usr/share/man/uk/man8/newusers.8.gz", "/usr/share/man/uk/man8/pwck.8.gz", "/usr/share/man/uk/man8/pwconv.8.gz", "/usr/share/man/uk/man8/useradd.8.gz", "/usr/share/man/uk/man8/userdel.8.gz", "/usr/share/man/uk/man8/usermod.8.gz", "/usr/share/man/uk/man8/vipw.8.gz", "/usr/share/man/zh_CN/man1/chage.1.gz", "/usr/share/man/zh_CN/man1/chfn.1.gz", "/usr/share/man/zh_CN/man1/chsh.1.gz", "/usr/share/man/zh_CN/man1/expiry.1.gz", "/usr/share/man/zh_CN/man1/gpasswd.1.gz", "/usr/share/man/zh_CN/man1/passwd.1.gz", "/usr/share/man/zh_CN/man5/gshadow.5.gz", "/usr/share/man/zh_CN/man5/passwd.5.gz", "/usr/share/man/zh_CN/man5/shadow.5.gz", "/usr/share/man/zh_CN/man8/chgpasswd.8.gz", "/usr/share/man/zh_CN/man8/chpasswd.8.gz", "/usr/share/man/zh_CN/man8/groupadd.8.gz", "/usr/share/man/zh_CN/man8/groupdel.8.gz", "/usr/share/man/zh_CN/man8/groupmod.8.gz", "/usr/share/man/zh_CN/man8/grpck.8.gz", "/usr/share/man/zh_CN/man8/newusers.8.gz", "/usr/share/man/zh_CN/man8/pwck.8.gz", "/usr/share/man/zh_CN/man8/pwconv.8.gz", "/usr/share/man/zh_CN/man8/useradd.8.gz", "/usr/share/man/zh_CN/man8/userdel.8.gz", "/usr/share/man/zh_CN/man8/usermod.8.gz", "/usr/share/man/zh_CN/man8/vipw.8.gz", "/usr/share/man/zh_TW/man1/chfn.1.gz", "/usr/share/man/zh_TW/man1/chsh.1.gz", "/usr/share/man/zh_TW/man5/passwd.5.gz", "/usr/share/man/zh_TW/man8/chpasswd.8.gz", "/usr/share/man/zh_TW/man8/groupadd.8.gz", "/usr/share/man/zh_TW/man8/groupdel.8.gz", "/usr/share/man/zh_TW/man8/groupmod.8.gz", "/usr/share/man/zh_TW/man8/useradd.8.gz", "/usr/share/man/zh_TW/man8/userdel.8.gz", "/usr/share/man/zh_TW/man8/usermod.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "perl-base@5.40.1-6", "Name": "perl-base", "Identifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.1", "UID": "546ba1bdcd66d61" }, "Version": "5.40.1", "Release": "6", "Arch": "amd64", "SrcName": "perl", "SrcVersion": "5.40.1", "SrcRelease": "6", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "FSFAP", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/perl", "/usr/bin/perl5.40.1", "/usr/lib/x86_64-linux-gnu/perl-base/AutoLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Carp.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Carp/Heavy.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Config.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Config_git.pl", "/usr/lib/x86_64-linux-gnu/perl-base/Config_heavy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/Cwd.pm", "/usr/lib/x86_64-linux-gnu/perl-base/DynaLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Errno.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Exporter.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Exporter/Heavy.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Fcntl.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Basename.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Glob.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Path.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Spec.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Spec/Unix.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Temp.pm", "/usr/lib/x86_64-linux-gnu/perl-base/FileHandle.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Getopt/Long.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Getopt/Long/Parser.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Hash/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/File.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Handle.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Pipe.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Seekable.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Select.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/INET.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/IP.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/UNIX.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open2.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm", "/usr/lib/x86_64-linux-gnu/perl-base/List/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/POSIX.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Scalar/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/SelectSaver.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Symbol.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/ParseWords.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/Tabs.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/Wrap.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Tie/Hash.pm", "/usr/lib/x86_64-linux-gnu/perl-base/XSLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/attributes.pm", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Cwd/Cwd.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Fcntl/Fcntl.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/File/Glob/Glob.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Hash/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/IO/IO.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/List/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/POSIX/POSIX.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Socket/Socket.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/attributes/attributes.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/re/re.so", "/usr/lib/x86_64-linux-gnu/perl-base/base.pm", "/usr/lib/x86_64-linux-gnu/perl-base/builtin.pm", "/usr/lib/x86_64-linux-gnu/perl-base/bytes.pm", "/usr/lib/x86_64-linux-gnu/perl-base/constant.pm", "/usr/lib/x86_64-linux-gnu/perl-base/feature.pm", "/usr/lib/x86_64-linux-gnu/perl-base/fields.pm", "/usr/lib/x86_64-linux-gnu/perl-base/integer.pm", "/usr/lib/x86_64-linux-gnu/perl-base/lib.pm", "/usr/lib/x86_64-linux-gnu/perl-base/locale.pm", "/usr/lib/x86_64-linux-gnu/perl-base/overload.pm", "/usr/lib/x86_64-linux-gnu/perl-base/overloading.pm", "/usr/lib/x86_64-linux-gnu/perl-base/parent.pm", "/usr/lib/x86_64-linux-gnu/perl-base/re.pm", "/usr/lib/x86_64-linux-gnu/perl-base/strict.pm", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Age.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bmg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bpb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bpt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Cf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Ea.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/EqUIdeo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/GCB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Gc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Hst.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Identif2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Identifi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/InPC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/InSC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Isc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Jg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Jt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Lb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Lc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFCQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFDQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKCCF.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKCQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKDQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Na1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NameAlia.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Nt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Nv.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/PerlDeci.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/SB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Sc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Scx.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Tc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Uc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Vo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/WB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/_PerlLB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/_PerlSCX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V100.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V11.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V110.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V120.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V130.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V140.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V150.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V20.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V30.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V31.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V32.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V40.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V41.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V50.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V51.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V52.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V60.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V61.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V70.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V80.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V90.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Alpha/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/AN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/B.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/BN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/CS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/EN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ES.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ET.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/NSM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ON.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/WS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/BidiC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/BidiM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Blk/NB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/O.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CE/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CI/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWCF/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWCM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWKCF/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWL/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWT/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWU/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Cased/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/A.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/AR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/ATAR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/B.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/BR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/DB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/NK.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/NR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/OV.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/VR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CompEx/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/DI/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dash/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dep/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dia/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Com.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Enc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Fin.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Font.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Init.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Iso.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Med.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Nar.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Nb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/NonCanon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sqr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sub.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sup.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Vert.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EBase/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EComp/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EPres/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/A.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/H.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/Na.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/W.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Emoji/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ext/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/ExtPict/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/CN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/LV.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/LVT.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/PP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/SM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Cf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Cn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/LC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Ll.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/M.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Mc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Me.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Mn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Nd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Nl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/No.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/P.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pe.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Po.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Ps.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/S.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sk.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/So.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Z.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Zs.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GrBase/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GrExt/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hex/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hst/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hyphen/T.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IDC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IDS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdStatus/Allowed.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdStatus/Restrict.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/DefaultI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Exclusio.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Inclusio.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/LimitedU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotChara.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotNFKC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotXID.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Obsolete.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Recommen.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Technica.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Uncommon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ideo/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/10_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/11_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/12_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/12_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/13_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/14_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/15_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/2_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/2_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/4_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/4_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/7_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/8_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/9_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Bottom.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/BottomAn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Left.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/LeftAndR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Overstru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Right.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Top.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndBo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndL2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndLe.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndRi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/VisualOr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Avagraha.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Bindu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Cantilla.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona5.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona7.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona9.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consonan.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Geminati.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Invisibl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Nukta.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Number.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Other.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/PureKill.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Syllable.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/ToneMark.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Virama.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Visarga.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Vowel.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/VowelDep.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/VowelInd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Ain.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Alef.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Beh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Dal.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/FarsiYeh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Feh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Gaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Hah.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/HanifiRo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Kaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Lam.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/NoJoinin.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Noon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Qaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Reh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Sad.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Seen.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Tah.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Waw.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Yeh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/D.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/T.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/U.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/AI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/BA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/BB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CJ.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/GL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/ID.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/IN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/IS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/NS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/OP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/PO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/PR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/QU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/SA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lower/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Math/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFCQC/M.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFCQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFDQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFDQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKCQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKCQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKDQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKDQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/Di.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/None.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/Nu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/10.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/100.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/10000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/100000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/11.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/12.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/13.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/14.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/15.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/17.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/18.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/19.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/20.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/200.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/20000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/30.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/300.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/30000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3_16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3_4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/40.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/400.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/4000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/40000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/5.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/50.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/500.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/5000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/50000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/60.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/600.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/6000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/60000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/7.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/70.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/700.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/7000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/70000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/80.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/800.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/8000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/80000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/9.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/90.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/900.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/9000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/90000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/PCM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/PatSyn/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Alnum.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Assigned.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Blank.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Graph.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/PerlWord.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/PosixPun.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Print.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/SpacePer.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Title.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Word.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/XPosixPu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlAny.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlCh2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlCha.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlFol.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIDC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIDS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIsI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlNch.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPat.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPr2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPro.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlQuo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/QMark/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/AT.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/CL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/FO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/LE.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/LO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/SC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/ST.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/Sp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/UP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SD/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/STerm/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Arab.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Beng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Cprt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Cyrl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Deva.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Dupl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Geor.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Glag.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gonm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gran.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Grek.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gujr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Guru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Han.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Hang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Hira.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Kana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Knda.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Latn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Limb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Linb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mlym.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mult.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Orya.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Sinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Syrc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Taml.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Telu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Zinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Zyyy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Adlm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Arab.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Armn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Beng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Bhks.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Bopo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cakm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cham.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Copt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cprt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cyrl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Deva.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Diak.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Dupl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Ethi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Geor.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Glag.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gonm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gran.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Grek.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gujr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Guru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Han.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hebr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hira.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hmng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hmnp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Kana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khar.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khmr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khoj.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Knda.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Kthi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lao.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Latn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Limb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lina.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Linb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mlym.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mult.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mymr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Nand.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Nko.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Orya.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Phlp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Rohg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Shrd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Sind.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Sinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Syrc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tagb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Takr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Talu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Taml.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Telu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Thaa.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tibt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tirh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Vith.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Xsux.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Yezi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Yi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zyyy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zzzz.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Term/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/UIdeo/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Upper/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/VS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/Tr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/Tu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/U.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/Extend.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/FO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/HL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/KA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/LE.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/MB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/ML.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/MN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/WSegSpac.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/XIDC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/XIDS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/utf8.pm", "/usr/lib/x86_64-linux-gnu/perl-base/vars.pm", "/usr/lib/x86_64-linux-gnu/perl-base/warnings.pm", "/usr/lib/x86_64-linux-gnu/perl-base/warnings/register.pm", "/usr/share/doc/perl-base/changelog.Debian.gz", "/usr/share/doc/perl-base/changelog.gz", "/usr/share/doc/perl-base/copyright", "/usr/share/doc/perl/AUTHORS.gz", "/usr/share/doc/perl/Documentation", "/usr/share/lintian/overrides/perl-base", "/usr/share/man/man1/perl.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "publicsuffix@20250328.1952-0.1", "Name": "publicsuffix", "Identifier": { "PURL": "pkg:deb/debian/publicsuffix@20250328.1952-0.1?arch=all\u0026distro=debian-13.1", "UID": "982622384f0179ae" }, "Version": "20250328.1952", "Release": "0.1", "Arch": "all", "SrcName": "publicsuffix", "SrcVersion": "20250328.1952", "SrcRelease": "0.1", "Licenses": [ "MPL-2.0", "CC0-1.0" ], "Maintainer": "Daniel Kahn Gillmor \u003cdkg@fifthhorseman.net\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "InstalledFiles": [ "/usr/share/doc/publicsuffix/README.Debian", "/usr/share/doc/publicsuffix/changelog.Debian.gz", "/usr/share/doc/publicsuffix/changelog.gz", "/usr/share/doc/publicsuffix/copyright", "/usr/share/doc/publicsuffix/examples/test_psl.txt", "/usr/share/publicsuffix/public_suffix_list.dafsa", "/usr/share/publicsuffix/public_suffix_list.dat" ], "AnalyzedBy": "dpkg" }, { "ID": "readline-common@8.2-6", "Name": "readline-common", "Identifier": { "PURL": "pkg:deb/debian/readline-common@8.2-6?arch=all\u0026distro=debian-13.1", "UID": "c4beab42d2a9a634" }, "Version": "8.2", "Release": "6", "Arch": "all", "SrcName": "readline", "SrcVersion": "8.2", "SrcRelease": "6", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-or-later", "ISC-no-attribution" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "InstalledFiles": [ "/usr/share/doc/readline-common/changelog.Debian.gz", "/usr/share/doc/readline-common/changelog.gz", "/usr/share/doc/readline-common/copyright", "/usr/share/doc/readline-common/inputrc.arrows", "/usr/share/info/rluserman.info.gz", "/usr/share/lintian/overrides/readline-common", "/usr/share/man/man3/history.3readline.gz", "/usr/share/man/man3/readline.3readline.gz", "/usr/share/readline/inputrc" ], "AnalyzedBy": "dpkg" }, { "ID": "sed@4.9-2", "Name": "sed", "Identifier": { "PURL": "pkg:deb/debian/sed@4.9-2?arch=amd64\u0026distro=debian-13.1", "UID": "d383a5208f5e9f7d" }, "Version": "4.9", "Release": "2", "Arch": "amd64", "SrcName": "sed", "SrcVersion": "4.9", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "X11", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-only", "ISC", "BSD-4-Clause-UC", "BSL-1", "pcre" ], "Maintainer": "Clint Adams \u003cclint@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/sed", "/usr/share/doc/sed/AUTHORS", "/usr/share/doc/sed/BUGS.gz", "/usr/share/doc/sed/NEWS.gz", "/usr/share/doc/sed/README", "/usr/share/doc/sed/THANKS.gz", "/usr/share/doc/sed/changelog.Debian.gz", "/usr/share/doc/sed/changelog.gz", "/usr/share/doc/sed/copyright", "/usr/share/doc/sed/examples/dc.sed", "/usr/share/doc/sed/sedfaq.txt.gz", "/usr/share/info/sed.info.gz", "/usr/share/locale/af/LC_MESSAGES/sed.mo", "/usr/share/locale/ast/LC_MESSAGES/sed.mo", "/usr/share/locale/bg/LC_MESSAGES/sed.mo", "/usr/share/locale/ca/LC_MESSAGES/sed.mo", "/usr/share/locale/cs/LC_MESSAGES/sed.mo", "/usr/share/locale/da/LC_MESSAGES/sed.mo", "/usr/share/locale/de/LC_MESSAGES/sed.mo", "/usr/share/locale/el/LC_MESSAGES/sed.mo", "/usr/share/locale/eo/LC_MESSAGES/sed.mo", "/usr/share/locale/es/LC_MESSAGES/sed.mo", "/usr/share/locale/et/LC_MESSAGES/sed.mo", "/usr/share/locale/eu/LC_MESSAGES/sed.mo", "/usr/share/locale/fi/LC_MESSAGES/sed.mo", "/usr/share/locale/fr/LC_MESSAGES/sed.mo", "/usr/share/locale/ga/LC_MESSAGES/sed.mo", "/usr/share/locale/gl/LC_MESSAGES/sed.mo", "/usr/share/locale/he/LC_MESSAGES/sed.mo", "/usr/share/locale/hr/LC_MESSAGES/sed.mo", "/usr/share/locale/hu/LC_MESSAGES/sed.mo", "/usr/share/locale/id/LC_MESSAGES/sed.mo", "/usr/share/locale/it/LC_MESSAGES/sed.mo", "/usr/share/locale/ja/LC_MESSAGES/sed.mo", "/usr/share/locale/ka/LC_MESSAGES/sed.mo", "/usr/share/locale/ko/LC_MESSAGES/sed.mo", "/usr/share/locale/nb/LC_MESSAGES/sed.mo", "/usr/share/locale/nl/LC_MESSAGES/sed.mo", "/usr/share/locale/pl/LC_MESSAGES/sed.mo", "/usr/share/locale/pt/LC_MESSAGES/sed.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/sed.mo", "/usr/share/locale/ro/LC_MESSAGES/sed.mo", "/usr/share/locale/ru/LC_MESSAGES/sed.mo", "/usr/share/locale/sk/LC_MESSAGES/sed.mo", "/usr/share/locale/sl/LC_MESSAGES/sed.mo", "/usr/share/locale/sr/LC_MESSAGES/sed.mo", "/usr/share/locale/sv/LC_MESSAGES/sed.mo", "/usr/share/locale/tr/LC_MESSAGES/sed.mo", "/usr/share/locale/uk/LC_MESSAGES/sed.mo", "/usr/share/locale/vi/LC_MESSAGES/sed.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/sed.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/sed.mo", "/usr/share/man/man1/sed.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "sqv@1.3.0-3", "Name": "sqv", "Identifier": { "PURL": "pkg:deb/debian/sqv@1.3.0-3?arch=amd64\u0026distro=debian-13.1", "UID": "7d0699cb980b2eaa" }, "Version": "1.3.0", "Release": "3", "Arch": "amd64", "SrcName": "rust-sequoia-sqv", "SrcVersion": "1.3.0", "SrcRelease": "3", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.0-only" ], "Maintainer": "Debian Rust Maintainers \u003cpkg-rust-maintainers@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12", "libgcc-s1@14.2.0-19", "libgmp10@2:6.3.0+dfsg-3", "libhogweed6t64@3.10.1-1", "libnettle8t64@3.10.1-1" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/sqv", "/usr/share/bash-completion/completions/sqv.bash", "/usr/share/doc/sqv/NEWS.gz", "/usr/share/doc/sqv/changelog.Debian.gz", "/usr/share/doc/sqv/copyright", "/usr/share/fish/completions/sqv.fish", "/usr/share/man/man1/sqv.1.gz", "/usr/share/zsh/vendor-completions/_sqv" ], "AnalyzedBy": "dpkg" }, { "ID": "sysvinit-utils@3.14-4", "Name": "sysvinit-utils", "Identifier": { "PURL": "pkg:deb/debian/sysvinit-utils@3.14-4?arch=amd64\u0026distro=debian-13.1", "UID": "af81e74826e58c0e" }, "Version": "3.14", "Release": "4", "Arch": "amd64", "SrcName": "sysvinit", "SrcVersion": "3.14", "SrcRelease": "4", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "GPL-3.0-only", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian sysvinit maintainers \u003cdebian-init-diversity@chiark.greenend.org.uk\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/init/init-d-script", "/usr/lib/init/vars.sh", "/usr/lib/lsb/init-functions", "/usr/lib/lsb/init-functions.d/00-verbose", "/usr/sbin/fstab-decode", "/usr/sbin/killall5", "/usr/share/doc/sysvinit-utils/changelog.Debian.gz", "/usr/share/doc/sysvinit-utils/copyright", "/usr/share/man/man5/init-d-script.5.gz", "/usr/share/man/man8/fstab-decode.8.gz", "/usr/share/man/man8/killall5.8.gz", "/usr/share/man/man8/pidof.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "tar@1.35+dfsg-3.1", "Name": "tar", "Identifier": { "PURL": "pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=amd64\u0026distro=debian-13.1", "UID": "4f69996c49afbaca" }, "Version": "1.35+dfsg", "Release": "3.1", "Arch": "amd64", "SrcName": "tar", "SrcVersion": "1.35+dfsg", "SrcRelease": "3.1", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-3+ with Bison exception", "LGPL-2.1-or-later", "LGPL-2.1-only", "LGPL-3.0-or-later", "LGPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Janos Lenart \u003cocsi@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/tar", "/usr/lib/mime/packages/tar", "/usr/sbin/rmt-tar", "/usr/sbin/tarcat", "/usr/share/doc/tar/AUTHORS", "/usr/share/doc/tar/NEWS.gz", "/usr/share/doc/tar/README.Debian", "/usr/share/doc/tar/THANKS.gz", "/usr/share/doc/tar/changelog.1.gz", "/usr/share/doc/tar/changelog.Debian.gz", "/usr/share/doc/tar/changelog.gz", "/usr/share/doc/tar/copyright", "/usr/share/locale/bg/LC_MESSAGES/tar.mo", "/usr/share/locale/ca/LC_MESSAGES/tar.mo", "/usr/share/locale/cs/LC_MESSAGES/tar.mo", "/usr/share/locale/da/LC_MESSAGES/tar.mo", "/usr/share/locale/de/LC_MESSAGES/tar.mo", "/usr/share/locale/el/LC_MESSAGES/tar.mo", "/usr/share/locale/eo/LC_MESSAGES/tar.mo", "/usr/share/locale/es/LC_MESSAGES/tar.mo", "/usr/share/locale/et/LC_MESSAGES/tar.mo", "/usr/share/locale/eu/LC_MESSAGES/tar.mo", "/usr/share/locale/fi/LC_MESSAGES/tar.mo", "/usr/share/locale/fr/LC_MESSAGES/tar.mo", "/usr/share/locale/ga/LC_MESSAGES/tar.mo", "/usr/share/locale/gl/LC_MESSAGES/tar.mo", "/usr/share/locale/hr/LC_MESSAGES/tar.mo", "/usr/share/locale/hu/LC_MESSAGES/tar.mo", "/usr/share/locale/id/LC_MESSAGES/tar.mo", "/usr/share/locale/it/LC_MESSAGES/tar.mo", "/usr/share/locale/ja/LC_MESSAGES/tar.mo", "/usr/share/locale/ka/LC_MESSAGES/tar.mo", "/usr/share/locale/ko/LC_MESSAGES/tar.mo", "/usr/share/locale/ky/LC_MESSAGES/tar.mo", "/usr/share/locale/ms/LC_MESSAGES/tar.mo", "/usr/share/locale/nb/LC_MESSAGES/tar.mo", "/usr/share/locale/nl/LC_MESSAGES/tar.mo", "/usr/share/locale/pl/LC_MESSAGES/tar.mo", "/usr/share/locale/pt/LC_MESSAGES/tar.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/tar.mo", "/usr/share/locale/ro/LC_MESSAGES/tar.mo", "/usr/share/locale/ru/LC_MESSAGES/tar.mo", "/usr/share/locale/sk/LC_MESSAGES/tar.mo", "/usr/share/locale/sl/LC_MESSAGES/tar.mo", "/usr/share/locale/sr/LC_MESSAGES/tar.mo", "/usr/share/locale/sv/LC_MESSAGES/tar.mo", "/usr/share/locale/tr/LC_MESSAGES/tar.mo", "/usr/share/locale/uk/LC_MESSAGES/tar.mo", "/usr/share/locale/vi/LC_MESSAGES/tar.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/tar.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/tar.mo", "/usr/share/man/man1/tar.1.gz", "/usr/share/man/man1/tarcat.1.gz", "/usr/share/man/man8/rmt-tar.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "tzdata@2025b-4+deb13u1", "Name": "tzdata", "Identifier": { "PURL": "pkg:deb/debian/tzdata@2025b-4%2Bdeb13u1?arch=all\u0026distro=debian-13.1", "UID": "7331305c81b4897a" }, "Version": "2025b", "Release": "4+deb13u1", "Arch": "all", "SrcName": "tzdata", "SrcVersion": "2025b", "SrcRelease": "4+deb13u1", "Licenses": [ "public-domain" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/share/doc/tzdata/NEWS.Debian.gz", "/usr/share/doc/tzdata/README.Debian", "/usr/share/doc/tzdata/changelog.Debian.gz", "/usr/share/doc/tzdata/changelog.gz", "/usr/share/doc/tzdata/copyright", "/usr/share/lintian/overrides/tzdata", "/usr/share/zoneinfo/Africa/Abidjan", "/usr/share/zoneinfo/Africa/Accra", "/usr/share/zoneinfo/Africa/Addis_Ababa", "/usr/share/zoneinfo/Africa/Algiers", "/usr/share/zoneinfo/Africa/Asmara", "/usr/share/zoneinfo/Africa/Bamako", "/usr/share/zoneinfo/Africa/Bangui", "/usr/share/zoneinfo/Africa/Banjul", "/usr/share/zoneinfo/Africa/Bissau", "/usr/share/zoneinfo/Africa/Blantyre", "/usr/share/zoneinfo/Africa/Brazzaville", "/usr/share/zoneinfo/Africa/Bujumbura", "/usr/share/zoneinfo/Africa/Cairo", "/usr/share/zoneinfo/Africa/Casablanca", "/usr/share/zoneinfo/Africa/Ceuta", "/usr/share/zoneinfo/Africa/Conakry", "/usr/share/zoneinfo/Africa/Dakar", "/usr/share/zoneinfo/Africa/Dar_es_Salaam", "/usr/share/zoneinfo/Africa/Djibouti", "/usr/share/zoneinfo/Africa/Douala", "/usr/share/zoneinfo/Africa/El_Aaiun", "/usr/share/zoneinfo/Africa/Freetown", "/usr/share/zoneinfo/Africa/Gaborone", "/usr/share/zoneinfo/Africa/Harare", "/usr/share/zoneinfo/Africa/Johannesburg", "/usr/share/zoneinfo/Africa/Juba", "/usr/share/zoneinfo/Africa/Kampala", "/usr/share/zoneinfo/Africa/Khartoum", "/usr/share/zoneinfo/Africa/Kigali", "/usr/share/zoneinfo/Africa/Kinshasa", "/usr/share/zoneinfo/Africa/Lagos", "/usr/share/zoneinfo/Africa/Libreville", "/usr/share/zoneinfo/Africa/Lome", "/usr/share/zoneinfo/Africa/Luanda", "/usr/share/zoneinfo/Africa/Lubumbashi", "/usr/share/zoneinfo/Africa/Lusaka", "/usr/share/zoneinfo/Africa/Malabo", "/usr/share/zoneinfo/Africa/Maputo", "/usr/share/zoneinfo/Africa/Maseru", "/usr/share/zoneinfo/Africa/Mbabane", "/usr/share/zoneinfo/Africa/Mogadishu", "/usr/share/zoneinfo/Africa/Monrovia", "/usr/share/zoneinfo/Africa/Nairobi", "/usr/share/zoneinfo/Africa/Ndjamena", "/usr/share/zoneinfo/Africa/Niamey", "/usr/share/zoneinfo/Africa/Nouakchott", "/usr/share/zoneinfo/Africa/Ouagadougou", "/usr/share/zoneinfo/Africa/Porto-Novo", "/usr/share/zoneinfo/Africa/Sao_Tome", "/usr/share/zoneinfo/Africa/Tripoli", "/usr/share/zoneinfo/Africa/Tunis", "/usr/share/zoneinfo/Africa/Windhoek", "/usr/share/zoneinfo/America/Adak", "/usr/share/zoneinfo/America/Anchorage", "/usr/share/zoneinfo/America/Anguilla", "/usr/share/zoneinfo/America/Antigua", "/usr/share/zoneinfo/America/Araguaina", "/usr/share/zoneinfo/America/Argentina/Buenos_Aires", "/usr/share/zoneinfo/America/Argentina/Catamarca", "/usr/share/zoneinfo/America/Argentina/Cordoba", "/usr/share/zoneinfo/America/Argentina/Jujuy", "/usr/share/zoneinfo/America/Argentina/La_Rioja", "/usr/share/zoneinfo/America/Argentina/Mendoza", "/usr/share/zoneinfo/America/Argentina/Rio_Gallegos", "/usr/share/zoneinfo/America/Argentina/Salta", "/usr/share/zoneinfo/America/Argentina/San_Juan", "/usr/share/zoneinfo/America/Argentina/San_Luis", "/usr/share/zoneinfo/America/Argentina/Tucuman", "/usr/share/zoneinfo/America/Argentina/Ushuaia", "/usr/share/zoneinfo/America/Aruba", "/usr/share/zoneinfo/America/Asuncion", "/usr/share/zoneinfo/America/Atikokan", "/usr/share/zoneinfo/America/Bahia", "/usr/share/zoneinfo/America/Bahia_Banderas", "/usr/share/zoneinfo/America/Barbados", "/usr/share/zoneinfo/America/Belem", "/usr/share/zoneinfo/America/Belize", "/usr/share/zoneinfo/America/Blanc-Sablon", "/usr/share/zoneinfo/America/Boa_Vista", "/usr/share/zoneinfo/America/Bogota", "/usr/share/zoneinfo/America/Boise", "/usr/share/zoneinfo/America/Cambridge_Bay", "/usr/share/zoneinfo/America/Campo_Grande", "/usr/share/zoneinfo/America/Cancun", "/usr/share/zoneinfo/America/Caracas", "/usr/share/zoneinfo/America/Cayenne", "/usr/share/zoneinfo/America/Cayman", "/usr/share/zoneinfo/America/Chicago", "/usr/share/zoneinfo/America/Chihuahua", "/usr/share/zoneinfo/America/Ciudad_Juarez", "/usr/share/zoneinfo/America/Costa_Rica", "/usr/share/zoneinfo/America/Coyhaique", "/usr/share/zoneinfo/America/Creston", "/usr/share/zoneinfo/America/Cuiaba", "/usr/share/zoneinfo/America/Curacao", "/usr/share/zoneinfo/America/Danmarkshavn", "/usr/share/zoneinfo/America/Dawson", "/usr/share/zoneinfo/America/Dawson_Creek", "/usr/share/zoneinfo/America/Denver", "/usr/share/zoneinfo/America/Detroit", "/usr/share/zoneinfo/America/Dominica", "/usr/share/zoneinfo/America/Edmonton", "/usr/share/zoneinfo/America/Eirunepe", "/usr/share/zoneinfo/America/El_Salvador", "/usr/share/zoneinfo/America/Fort_Nelson", "/usr/share/zoneinfo/America/Fortaleza", "/usr/share/zoneinfo/America/Glace_Bay", "/usr/share/zoneinfo/America/Goose_Bay", "/usr/share/zoneinfo/America/Grand_Turk", "/usr/share/zoneinfo/America/Grenada", "/usr/share/zoneinfo/America/Guadeloupe", "/usr/share/zoneinfo/America/Guatemala", "/usr/share/zoneinfo/America/Guayaquil", "/usr/share/zoneinfo/America/Guyana", "/usr/share/zoneinfo/America/Halifax", "/usr/share/zoneinfo/America/Havana", "/usr/share/zoneinfo/America/Hermosillo", "/usr/share/zoneinfo/America/Indiana/Indianapolis", "/usr/share/zoneinfo/America/Indiana/Knox", "/usr/share/zoneinfo/America/Indiana/Marengo", "/usr/share/zoneinfo/America/Indiana/Petersburg", "/usr/share/zoneinfo/America/Indiana/Tell_City", "/usr/share/zoneinfo/America/Indiana/Vevay", "/usr/share/zoneinfo/America/Indiana/Vincennes", "/usr/share/zoneinfo/America/Indiana/Winamac", "/usr/share/zoneinfo/America/Inuvik", "/usr/share/zoneinfo/America/Iqaluit", "/usr/share/zoneinfo/America/Jamaica", "/usr/share/zoneinfo/America/Juneau", "/usr/share/zoneinfo/America/Kentucky/Louisville", "/usr/share/zoneinfo/America/Kentucky/Monticello", "/usr/share/zoneinfo/America/La_Paz", "/usr/share/zoneinfo/America/Lima", "/usr/share/zoneinfo/America/Los_Angeles", "/usr/share/zoneinfo/America/Maceio", "/usr/share/zoneinfo/America/Managua", "/usr/share/zoneinfo/America/Manaus", "/usr/share/zoneinfo/America/Martinique", "/usr/share/zoneinfo/America/Matamoros", "/usr/share/zoneinfo/America/Mazatlan", "/usr/share/zoneinfo/America/Menominee", "/usr/share/zoneinfo/America/Merida", "/usr/share/zoneinfo/America/Metlakatla", "/usr/share/zoneinfo/America/Mexico_City", "/usr/share/zoneinfo/America/Miquelon", "/usr/share/zoneinfo/America/Moncton", "/usr/share/zoneinfo/America/Monterrey", "/usr/share/zoneinfo/America/Montevideo", "/usr/share/zoneinfo/America/Montserrat", "/usr/share/zoneinfo/America/Nassau", "/usr/share/zoneinfo/America/New_York", "/usr/share/zoneinfo/America/Nome", "/usr/share/zoneinfo/America/Noronha", "/usr/share/zoneinfo/America/North_Dakota/Beulah", "/usr/share/zoneinfo/America/North_Dakota/Center", "/usr/share/zoneinfo/America/North_Dakota/New_Salem", "/usr/share/zoneinfo/America/Nuuk", "/usr/share/zoneinfo/America/Ojinaga", "/usr/share/zoneinfo/America/Panama", "/usr/share/zoneinfo/America/Paramaribo", "/usr/share/zoneinfo/America/Phoenix", "/usr/share/zoneinfo/America/Port-au-Prince", "/usr/share/zoneinfo/America/Port_of_Spain", "/usr/share/zoneinfo/America/Porto_Velho", "/usr/share/zoneinfo/America/Puerto_Rico", "/usr/share/zoneinfo/America/Punta_Arenas", "/usr/share/zoneinfo/America/Rankin_Inlet", "/usr/share/zoneinfo/America/Recife", "/usr/share/zoneinfo/America/Regina", "/usr/share/zoneinfo/America/Resolute", "/usr/share/zoneinfo/America/Rio_Branco", "/usr/share/zoneinfo/America/Santarem", "/usr/share/zoneinfo/America/Santiago", "/usr/share/zoneinfo/America/Santo_Domingo", "/usr/share/zoneinfo/America/Sao_Paulo", "/usr/share/zoneinfo/America/Scoresbysund", "/usr/share/zoneinfo/America/Sitka", "/usr/share/zoneinfo/America/St_Johns", "/usr/share/zoneinfo/America/St_Kitts", "/usr/share/zoneinfo/America/St_Lucia", "/usr/share/zoneinfo/America/St_Thomas", "/usr/share/zoneinfo/America/St_Vincent", "/usr/share/zoneinfo/America/Swift_Current", "/usr/share/zoneinfo/America/Tegucigalpa", "/usr/share/zoneinfo/America/Thule", "/usr/share/zoneinfo/America/Tijuana", "/usr/share/zoneinfo/America/Toronto", "/usr/share/zoneinfo/America/Tortola", "/usr/share/zoneinfo/America/Vancouver", "/usr/share/zoneinfo/America/Whitehorse", "/usr/share/zoneinfo/America/Winnipeg", "/usr/share/zoneinfo/America/Yakutat", "/usr/share/zoneinfo/Antarctica/Casey", "/usr/share/zoneinfo/Antarctica/Davis", "/usr/share/zoneinfo/Antarctica/DumontDUrville", "/usr/share/zoneinfo/Antarctica/Macquarie", "/usr/share/zoneinfo/Antarctica/Mawson", "/usr/share/zoneinfo/Antarctica/McMurdo", "/usr/share/zoneinfo/Antarctica/Palmer", "/usr/share/zoneinfo/Antarctica/Rothera", "/usr/share/zoneinfo/Antarctica/Syowa", "/usr/share/zoneinfo/Antarctica/Troll", "/usr/share/zoneinfo/Antarctica/Vostok", "/usr/share/zoneinfo/Asia/Aden", "/usr/share/zoneinfo/Asia/Almaty", "/usr/share/zoneinfo/Asia/Amman", "/usr/share/zoneinfo/Asia/Anadyr", "/usr/share/zoneinfo/Asia/Aqtau", "/usr/share/zoneinfo/Asia/Aqtobe", "/usr/share/zoneinfo/Asia/Ashgabat", "/usr/share/zoneinfo/Asia/Atyrau", "/usr/share/zoneinfo/Asia/Baghdad", "/usr/share/zoneinfo/Asia/Bahrain", "/usr/share/zoneinfo/Asia/Baku", "/usr/share/zoneinfo/Asia/Bangkok", "/usr/share/zoneinfo/Asia/Barnaul", "/usr/share/zoneinfo/Asia/Beirut", "/usr/share/zoneinfo/Asia/Bishkek", "/usr/share/zoneinfo/Asia/Brunei", "/usr/share/zoneinfo/Asia/Chita", "/usr/share/zoneinfo/Asia/Colombo", "/usr/share/zoneinfo/Asia/Damascus", "/usr/share/zoneinfo/Asia/Dhaka", "/usr/share/zoneinfo/Asia/Dili", "/usr/share/zoneinfo/Asia/Dubai", "/usr/share/zoneinfo/Asia/Dushanbe", "/usr/share/zoneinfo/Asia/Famagusta", "/usr/share/zoneinfo/Asia/Gaza", "/usr/share/zoneinfo/Asia/Hebron", "/usr/share/zoneinfo/Asia/Ho_Chi_Minh", "/usr/share/zoneinfo/Asia/Hong_Kong", "/usr/share/zoneinfo/Asia/Hovd", "/usr/share/zoneinfo/Asia/Irkutsk", "/usr/share/zoneinfo/Asia/Jakarta", "/usr/share/zoneinfo/Asia/Jayapura", "/usr/share/zoneinfo/Asia/Jerusalem", "/usr/share/zoneinfo/Asia/Kabul", "/usr/share/zoneinfo/Asia/Kamchatka", "/usr/share/zoneinfo/Asia/Karachi", "/usr/share/zoneinfo/Asia/Kathmandu", "/usr/share/zoneinfo/Asia/Khandyga", "/usr/share/zoneinfo/Asia/Kolkata", "/usr/share/zoneinfo/Asia/Krasnoyarsk", "/usr/share/zoneinfo/Asia/Kuala_Lumpur", "/usr/share/zoneinfo/Asia/Kuching", "/usr/share/zoneinfo/Asia/Kuwait", "/usr/share/zoneinfo/Asia/Macau", "/usr/share/zoneinfo/Asia/Magadan", "/usr/share/zoneinfo/Asia/Makassar", "/usr/share/zoneinfo/Asia/Manila", "/usr/share/zoneinfo/Asia/Muscat", "/usr/share/zoneinfo/Asia/Nicosia", "/usr/share/zoneinfo/Asia/Novokuznetsk", "/usr/share/zoneinfo/Asia/Novosibirsk", "/usr/share/zoneinfo/Asia/Omsk", "/usr/share/zoneinfo/Asia/Oral", "/usr/share/zoneinfo/Asia/Phnom_Penh", "/usr/share/zoneinfo/Asia/Pontianak", "/usr/share/zoneinfo/Asia/Pyongyang", "/usr/share/zoneinfo/Asia/Qatar", "/usr/share/zoneinfo/Asia/Qostanay", "/usr/share/zoneinfo/Asia/Qyzylorda", "/usr/share/zoneinfo/Asia/Riyadh", "/usr/share/zoneinfo/Asia/Sakhalin", "/usr/share/zoneinfo/Asia/Samarkand", "/usr/share/zoneinfo/Asia/Seoul", "/usr/share/zoneinfo/Asia/Shanghai", "/usr/share/zoneinfo/Asia/Singapore", "/usr/share/zoneinfo/Asia/Srednekolymsk", "/usr/share/zoneinfo/Asia/Taipei", "/usr/share/zoneinfo/Asia/Tashkent", "/usr/share/zoneinfo/Asia/Tbilisi", "/usr/share/zoneinfo/Asia/Tehran", "/usr/share/zoneinfo/Asia/Thimphu", "/usr/share/zoneinfo/Asia/Tokyo", "/usr/share/zoneinfo/Asia/Tomsk", "/usr/share/zoneinfo/Asia/Ulaanbaatar", "/usr/share/zoneinfo/Asia/Urumqi", "/usr/share/zoneinfo/Asia/Ust-Nera", "/usr/share/zoneinfo/Asia/Vientiane", "/usr/share/zoneinfo/Asia/Vladivostok", "/usr/share/zoneinfo/Asia/Yakutsk", "/usr/share/zoneinfo/Asia/Yangon", "/usr/share/zoneinfo/Asia/Yekaterinburg", "/usr/share/zoneinfo/Asia/Yerevan", "/usr/share/zoneinfo/Atlantic/Azores", "/usr/share/zoneinfo/Atlantic/Bermuda", "/usr/share/zoneinfo/Atlantic/Canary", "/usr/share/zoneinfo/Atlantic/Cape_Verde", "/usr/share/zoneinfo/Atlantic/Faroe", "/usr/share/zoneinfo/Atlantic/Madeira", "/usr/share/zoneinfo/Atlantic/Reykjavik", "/usr/share/zoneinfo/Atlantic/South_Georgia", "/usr/share/zoneinfo/Atlantic/St_Helena", "/usr/share/zoneinfo/Atlantic/Stanley", "/usr/share/zoneinfo/Australia/Adelaide", "/usr/share/zoneinfo/Australia/Brisbane", "/usr/share/zoneinfo/Australia/Broken_Hill", "/usr/share/zoneinfo/Australia/Darwin", "/usr/share/zoneinfo/Australia/Eucla", "/usr/share/zoneinfo/Australia/Hobart", "/usr/share/zoneinfo/Australia/Lindeman", "/usr/share/zoneinfo/Australia/Lord_Howe", "/usr/share/zoneinfo/Australia/Melbourne", "/usr/share/zoneinfo/Australia/Perth", "/usr/share/zoneinfo/Australia/Sydney", "/usr/share/zoneinfo/Etc/GMT", "/usr/share/zoneinfo/Etc/GMT+1", "/usr/share/zoneinfo/Etc/GMT+10", "/usr/share/zoneinfo/Etc/GMT+11", "/usr/share/zoneinfo/Etc/GMT+12", "/usr/share/zoneinfo/Etc/GMT+2", "/usr/share/zoneinfo/Etc/GMT+3", "/usr/share/zoneinfo/Etc/GMT+4", "/usr/share/zoneinfo/Etc/GMT+5", "/usr/share/zoneinfo/Etc/GMT+6", "/usr/share/zoneinfo/Etc/GMT+7", "/usr/share/zoneinfo/Etc/GMT+8", "/usr/share/zoneinfo/Etc/GMT+9", "/usr/share/zoneinfo/Etc/GMT-1", "/usr/share/zoneinfo/Etc/GMT-10", "/usr/share/zoneinfo/Etc/GMT-11", "/usr/share/zoneinfo/Etc/GMT-12", "/usr/share/zoneinfo/Etc/GMT-13", "/usr/share/zoneinfo/Etc/GMT-14", "/usr/share/zoneinfo/Etc/GMT-2", "/usr/share/zoneinfo/Etc/GMT-3", "/usr/share/zoneinfo/Etc/GMT-4", "/usr/share/zoneinfo/Etc/GMT-5", "/usr/share/zoneinfo/Etc/GMT-6", "/usr/share/zoneinfo/Etc/GMT-7", "/usr/share/zoneinfo/Etc/GMT-8", "/usr/share/zoneinfo/Etc/GMT-9", "/usr/share/zoneinfo/Etc/UTC", "/usr/share/zoneinfo/Europe/Amsterdam", "/usr/share/zoneinfo/Europe/Andorra", "/usr/share/zoneinfo/Europe/Astrakhan", "/usr/share/zoneinfo/Europe/Athens", "/usr/share/zoneinfo/Europe/Belgrade", "/usr/share/zoneinfo/Europe/Berlin", "/usr/share/zoneinfo/Europe/Brussels", "/usr/share/zoneinfo/Europe/Bucharest", "/usr/share/zoneinfo/Europe/Budapest", "/usr/share/zoneinfo/Europe/Chisinau", "/usr/share/zoneinfo/Europe/Copenhagen", "/usr/share/zoneinfo/Europe/Dublin", "/usr/share/zoneinfo/Europe/Gibraltar", "/usr/share/zoneinfo/Europe/Guernsey", "/usr/share/zoneinfo/Europe/Helsinki", "/usr/share/zoneinfo/Europe/Isle_of_Man", "/usr/share/zoneinfo/Europe/Istanbul", "/usr/share/zoneinfo/Europe/Jersey", "/usr/share/zoneinfo/Europe/Kaliningrad", "/usr/share/zoneinfo/Europe/Kirov", "/usr/share/zoneinfo/Europe/Kyiv", "/usr/share/zoneinfo/Europe/Lisbon", "/usr/share/zoneinfo/Europe/Ljubljana", "/usr/share/zoneinfo/Europe/London", "/usr/share/zoneinfo/Europe/Luxembourg", "/usr/share/zoneinfo/Europe/Madrid", "/usr/share/zoneinfo/Europe/Malta", "/usr/share/zoneinfo/Europe/Minsk", "/usr/share/zoneinfo/Europe/Monaco", "/usr/share/zoneinfo/Europe/Moscow", "/usr/share/zoneinfo/Europe/Oslo", "/usr/share/zoneinfo/Europe/Paris", "/usr/share/zoneinfo/Europe/Prague", "/usr/share/zoneinfo/Europe/Riga", "/usr/share/zoneinfo/Europe/Rome", "/usr/share/zoneinfo/Europe/Samara", "/usr/share/zoneinfo/Europe/Sarajevo", "/usr/share/zoneinfo/Europe/Saratov", "/usr/share/zoneinfo/Europe/Simferopol", "/usr/share/zoneinfo/Europe/Skopje", "/usr/share/zoneinfo/Europe/Sofia", "/usr/share/zoneinfo/Europe/Stockholm", "/usr/share/zoneinfo/Europe/Tallinn", "/usr/share/zoneinfo/Europe/Tirane", "/usr/share/zoneinfo/Europe/Ulyanovsk", "/usr/share/zoneinfo/Europe/Vaduz", "/usr/share/zoneinfo/Europe/Vienna", "/usr/share/zoneinfo/Europe/Vilnius", "/usr/share/zoneinfo/Europe/Volgograd", "/usr/share/zoneinfo/Europe/Warsaw", "/usr/share/zoneinfo/Europe/Zagreb", "/usr/share/zoneinfo/Europe/Zurich", "/usr/share/zoneinfo/Factory", "/usr/share/zoneinfo/Indian/Antananarivo", "/usr/share/zoneinfo/Indian/Chagos", "/usr/share/zoneinfo/Indian/Christmas", "/usr/share/zoneinfo/Indian/Cocos", "/usr/share/zoneinfo/Indian/Comoro", "/usr/share/zoneinfo/Indian/Kerguelen", "/usr/share/zoneinfo/Indian/Mahe", "/usr/share/zoneinfo/Indian/Maldives", "/usr/share/zoneinfo/Indian/Mauritius", "/usr/share/zoneinfo/Indian/Mayotte", "/usr/share/zoneinfo/Indian/Reunion", "/usr/share/zoneinfo/Pacific/Apia", "/usr/share/zoneinfo/Pacific/Auckland", "/usr/share/zoneinfo/Pacific/Bougainville", "/usr/share/zoneinfo/Pacific/Chatham", "/usr/share/zoneinfo/Pacific/Chuuk", "/usr/share/zoneinfo/Pacific/Easter", "/usr/share/zoneinfo/Pacific/Efate", "/usr/share/zoneinfo/Pacific/Fakaofo", "/usr/share/zoneinfo/Pacific/Fiji", "/usr/share/zoneinfo/Pacific/Funafuti", "/usr/share/zoneinfo/Pacific/Galapagos", "/usr/share/zoneinfo/Pacific/Gambier", "/usr/share/zoneinfo/Pacific/Guadalcanal", "/usr/share/zoneinfo/Pacific/Guam", "/usr/share/zoneinfo/Pacific/Honolulu", "/usr/share/zoneinfo/Pacific/Kanton", "/usr/share/zoneinfo/Pacific/Kiritimati", "/usr/share/zoneinfo/Pacific/Kosrae", "/usr/share/zoneinfo/Pacific/Kwajalein", "/usr/share/zoneinfo/Pacific/Majuro", "/usr/share/zoneinfo/Pacific/Marquesas", "/usr/share/zoneinfo/Pacific/Midway", "/usr/share/zoneinfo/Pacific/Nauru", "/usr/share/zoneinfo/Pacific/Niue", "/usr/share/zoneinfo/Pacific/Norfolk", "/usr/share/zoneinfo/Pacific/Noumea", "/usr/share/zoneinfo/Pacific/Pago_Pago", "/usr/share/zoneinfo/Pacific/Palau", "/usr/share/zoneinfo/Pacific/Pitcairn", "/usr/share/zoneinfo/Pacific/Pohnpei", "/usr/share/zoneinfo/Pacific/Port_Moresby", "/usr/share/zoneinfo/Pacific/Rarotonga", "/usr/share/zoneinfo/Pacific/Saipan", "/usr/share/zoneinfo/Pacific/Tahiti", "/usr/share/zoneinfo/Pacific/Tarawa", "/usr/share/zoneinfo/Pacific/Tongatapu", "/usr/share/zoneinfo/Pacific/Wake", "/usr/share/zoneinfo/Pacific/Wallis", "/usr/share/zoneinfo/iso3166.tab", "/usr/share/zoneinfo/leap-seconds.list", "/usr/share/zoneinfo/leapseconds", "/usr/share/zoneinfo/tzdata.zi", "/usr/share/zoneinfo/zone.tab", "/usr/share/zoneinfo/zone1970.tab", "/usr/share/zoneinfo/zonenow.tab" ], "AnalyzedBy": "dpkg" }, { "ID": "util-linux@2.41-5", "Name": "util-linux", "Identifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "972fb85b9c9e83e7" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/bin/choom", "/usr/bin/chrt", "/usr/bin/dmesg", "/usr/bin/fallocate", "/usr/bin/findmnt", "/usr/bin/flock", "/usr/bin/getopt", "/usr/bin/hardlink", "/usr/bin/ionice", "/usr/bin/ipcmk", "/usr/bin/ipcrm", "/usr/bin/ipcs", "/usr/bin/lsblk", "/usr/bin/lscpu", "/usr/bin/lsipc", "/usr/bin/lslocks", "/usr/bin/lslogins", "/usr/bin/lsmem", "/usr/bin/lsns", "/usr/bin/mcookie", "/usr/bin/more", "/usr/bin/mountpoint", "/usr/bin/namei", "/usr/bin/nsenter", "/usr/bin/partx", "/usr/bin/prlimit", "/usr/bin/rename.ul", "/usr/bin/rev", "/usr/bin/setarch", "/usr/bin/setpriv", "/usr/bin/setsid", "/usr/bin/setterm", "/usr/bin/su", "/usr/bin/taskset", "/usr/bin/uclampset", "/usr/bin/unshare", "/usr/bin/wdctl", "/usr/bin/whereis", "/usr/lib/mime/packages/util-linux", "/usr/lib/systemd/system/fstrim.service", "/usr/lib/systemd/system/fstrim.timer", "/usr/sbin/agetty", "/usr/sbin/blkdiscard", "/usr/sbin/blkid", "/usr/sbin/blkzone", "/usr/sbin/blockdev", "/usr/sbin/chcpu", "/usr/sbin/chmem", "/usr/sbin/findfs", "/usr/sbin/fsck", "/usr/sbin/fsfreeze", "/usr/sbin/fstrim", "/usr/sbin/isosize", "/usr/sbin/ldattach", "/usr/sbin/mkfs", "/usr/sbin/mkswap", "/usr/sbin/pivot_root", "/usr/sbin/readprofile", "/usr/sbin/rtcwake", "/usr/sbin/runuser", "/usr/sbin/sulogin", "/usr/sbin/swaplabel", "/usr/sbin/switch_root", "/usr/sbin/wipefs", "/usr/sbin/zramctl", "/usr/share/bash-completion/completions/blkdiscard", "/usr/share/bash-completion/completions/blkid", "/usr/share/bash-completion/completions/blkzone", "/usr/share/bash-completion/completions/blockdev", "/usr/share/bash-completion/completions/chcpu", "/usr/share/bash-completion/completions/chmem", "/usr/share/bash-completion/completions/chrt", "/usr/share/bash-completion/completions/dmesg", "/usr/share/bash-completion/completions/fallocate", "/usr/share/bash-completion/completions/findfs", "/usr/share/bash-completion/completions/findmnt", "/usr/share/bash-completion/completions/flock", "/usr/share/bash-completion/completions/fsck", "/usr/share/bash-completion/completions/fsfreeze", "/usr/share/bash-completion/completions/fstrim", "/usr/share/bash-completion/completions/getopt", "/usr/share/bash-completion/completions/hardlink", "/usr/share/bash-completion/completions/ionice", "/usr/share/bash-completion/completions/ipcmk", "/usr/share/bash-completion/completions/ipcrm", "/usr/share/bash-completion/completions/ipcs", "/usr/share/bash-completion/completions/isosize", "/usr/share/bash-completion/completions/ldattach", "/usr/share/bash-completion/completions/lsblk", "/usr/share/bash-completion/completions/lscpu", "/usr/share/bash-completion/completions/lsipc", "/usr/share/bash-completion/completions/lslocks", "/usr/share/bash-completion/completions/lslogins", "/usr/share/bash-completion/completions/lsmem", "/usr/share/bash-completion/completions/lsns", "/usr/share/bash-completion/completions/mcookie", "/usr/share/bash-completion/completions/mkfs", "/usr/share/bash-completion/completions/mkswap", "/usr/share/bash-completion/completions/more", "/usr/share/bash-completion/completions/mountpoint", "/usr/share/bash-completion/completions/namei", "/usr/share/bash-completion/completions/nsenter", "/usr/share/bash-completion/completions/partx", "/usr/share/bash-completion/completions/pivot_root", "/usr/share/bash-completion/completions/prlimit", "/usr/share/bash-completion/completions/readprofile", "/usr/share/bash-completion/completions/rename.ul", "/usr/share/bash-completion/completions/rev", "/usr/share/bash-completion/completions/rtcwake", "/usr/share/bash-completion/completions/setarch", "/usr/share/bash-completion/completions/setpriv", "/usr/share/bash-completion/completions/setsid", "/usr/share/bash-completion/completions/setterm", "/usr/share/bash-completion/completions/su", "/usr/share/bash-completion/completions/swaplabel", "/usr/share/bash-completion/completions/taskset", "/usr/share/bash-completion/completions/uclampset", "/usr/share/bash-completion/completions/unshare", "/usr/share/bash-completion/completions/wdctl", "/usr/share/bash-completion/completions/whereis", "/usr/share/bash-completion/completions/wipefs", "/usr/share/bash-completion/completions/zramctl", "/usr/share/doc/util-linux/00-about-docs.txt", "/usr/share/doc/util-linux/AUTHORS.gz", "/usr/share/doc/util-linux/NEWS.Debian.gz", "/usr/share/doc/util-linux/PAM-configuration.txt", "/usr/share/doc/util-linux/README.Debian", "/usr/share/doc/util-linux/blkid.txt", "/usr/share/doc/util-linux/cal.txt", "/usr/share/doc/util-linux/changelog.Debian.gz", "/usr/share/doc/util-linux/changelog.gz", "/usr/share/doc/util-linux/col.txt", "/usr/share/doc/util-linux/copyright", "/usr/share/doc/util-linux/deprecated.txt", "/usr/share/doc/util-linux/examples/getopt-example.bash", "/usr/share/doc/util-linux/getopt.txt", "/usr/share/doc/util-linux/getopt_changelog.txt", "/usr/share/doc/util-linux/howto-build-sys.txt", "/usr/share/doc/util-linux/howto-compilation.txt", "/usr/share/doc/util-linux/howto-contribute.txt.gz", "/usr/share/doc/util-linux/howto-debug.txt", "/usr/share/doc/util-linux/howto-man-page.txt", "/usr/share/doc/util-linux/howto-pull-request.txt.gz", "/usr/share/doc/util-linux/howto-tests.txt", "/usr/share/doc/util-linux/howto-usage-function.txt.gz", "/usr/share/doc/util-linux/hwclock.txt", "/usr/share/doc/util-linux/modems-with-agetty.txt", "/usr/share/doc/util-linux/mount.txt", "/usr/share/doc/util-linux/parse-date.txt.gz", "/usr/share/doc/util-linux/pg.txt", "/usr/share/doc/util-linux/poeigl.txt.gz", "/usr/share/doc/util-linux/release-schedule.txt", "/usr/share/doc/util-linux/releases/v2.13-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.14-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.15-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.16-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.17-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.18-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.19-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.20-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.21-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.22-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.23-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.24-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.25-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.26-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.27-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.28-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.29-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.30-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.31-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.32-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.33-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.34-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.35-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.36-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.37-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.38-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.39-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.40-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.41-ReleaseNotes.gz", "/usr/share/lintian/overrides/util-linux", "/usr/share/man/man1/choom.1.gz", "/usr/share/man/man1/chrt.1.gz", "/usr/share/man/man1/dmesg.1.gz", "/usr/share/man/man1/fallocate.1.gz", "/usr/share/man/man1/flock.1.gz", "/usr/share/man/man1/getopt.1.gz", "/usr/share/man/man1/hardlink.1.gz", "/usr/share/man/man1/ionice.1.gz", "/usr/share/man/man1/ipcmk.1.gz", "/usr/share/man/man1/ipcrm.1.gz", "/usr/share/man/man1/ipcs.1.gz", "/usr/share/man/man1/lscpu.1.gz", "/usr/share/man/man1/lsipc.1.gz", "/usr/share/man/man1/lslogins.1.gz", "/usr/share/man/man1/lsmem.1.gz", "/usr/share/man/man1/mcookie.1.gz", "/usr/share/man/man1/more.1.gz", "/usr/share/man/man1/mountpoint.1.gz", "/usr/share/man/man1/namei.1.gz", "/usr/share/man/man1/nsenter.1.gz", "/usr/share/man/man1/prlimit.1.gz", "/usr/share/man/man1/rename.ul.1.gz", "/usr/share/man/man1/rev.1.gz", "/usr/share/man/man1/runuser.1.gz", "/usr/share/man/man1/setpriv.1.gz", "/usr/share/man/man1/setsid.1.gz", "/usr/share/man/man1/setterm.1.gz", "/usr/share/man/man1/su.1.gz", "/usr/share/man/man1/taskset.1.gz", "/usr/share/man/man1/uclampset.1.gz", "/usr/share/man/man1/unshare.1.gz", "/usr/share/man/man1/whereis.1.gz", "/usr/share/man/man5/adjtime_config.5.gz", "/usr/share/man/man5/scols-filter.5.gz", "/usr/share/man/man5/terminal-colors.d.5.gz", "/usr/share/man/man8/agetty.8.gz", "/usr/share/man/man8/blkdiscard.8.gz", "/usr/share/man/man8/blkid.8.gz", "/usr/share/man/man8/blkzone.8.gz", "/usr/share/man/man8/blockdev.8.gz", "/usr/share/man/man8/chcpu.8.gz", "/usr/share/man/man8/chmem.8.gz", "/usr/share/man/man8/findfs.8.gz", "/usr/share/man/man8/findmnt.8.gz", "/usr/share/man/man8/fsck.8.gz", "/usr/share/man/man8/fsfreeze.8.gz", "/usr/share/man/man8/fstrim.8.gz", "/usr/share/man/man8/isosize.8.gz", "/usr/share/man/man8/ldattach.8.gz", "/usr/share/man/man8/lsblk.8.gz", "/usr/share/man/man8/lslocks.8.gz", "/usr/share/man/man8/lsns.8.gz", "/usr/share/man/man8/mkfs.8.gz", "/usr/share/man/man8/mkswap.8.gz", "/usr/share/man/man8/partx.8.gz", "/usr/share/man/man8/pivot_root.8.gz", "/usr/share/man/man8/readprofile.8.gz", "/usr/share/man/man8/rtcwake.8.gz", "/usr/share/man/man8/setarch.8.gz", "/usr/share/man/man8/sulogin.8.gz", "/usr/share/man/man8/swaplabel.8.gz", "/usr/share/man/man8/switch_root.8.gz", "/usr/share/man/man8/wdctl.8.gz", "/usr/share/man/man8/wipefs.8.gz", "/usr/share/man/man8/zramctl.8.gz", "/usr/share/util-linux/logcheck/ignore.d.server/util-linux" ], "AnalyzedBy": "dpkg" }, { "ID": "zlib1g@1:1.3.dfsg+really1.3.1-1+b1", "Name": "zlib1g", "Identifier": { "PURL": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "bad002d21692afaf" }, "Version": "1.3.dfsg+really1.3.1", "Release": "1+b1", "Epoch": 1, "Arch": "amd64", "SrcName": "zlib", "SrcVersion": "1.3.dfsg+really1.3.1", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "Zlib" ], "Maintainer": "Mark Brown \u003cbroonie@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12" ], "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libz.so.1.3.1", "/usr/share/doc/zlib1g/changelog.Debian.amd64.gz", "/usr/share/doc/zlib1g/changelog.Debian.gz", "/usr/share/doc/zlib1g/changelog.gz", "/usr/share/doc/zlib1g/copyright" ], "AnalyzedBy": "dpkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-109518", "VendorIDs": [ "DSA-6607-1" ], "PkgID": "apt@3.0.3", "PkgName": "apt", "PkgIdentifier": { "PURL": "pkg:deb/debian/apt@3.0.3?arch=amd64\u0026distro=debian-13.1", "UID": "11607181e5c9d3dd" }, "InstalledVersion": "3.0.3", "FixedVersion": "3.0.4", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109518", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b224b34b62c9a4acf0f6dd09f968f65b58c7b5632ae6005679dabfd10e148c0b", "Title": "apt: apt: Remote code execution via hard link reuse during package download retries", "Description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration", "Severity": "HIGH", "CweIDs": [ "CWE-62", "CWE-367" ], "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/11/04/12", "https://access.redhat.com/security/cve/CVE-2026-109518", "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html", "https://lists.debian.org/debian-security-announce/2026/msg00526.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109518", "https://ubuntu.com/blog/apt-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8996-1", "https://www.cve.org/CVERecord?id=CVE-2026-109518" ], "PublishedDate": "2026-11-04T16:17:33.01Z", "LastModifiedDate": "2026-11-05T05:18:19.033Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c7ff91e97b69d1c0df4a0513c571d2c3048276ce72be22ed1d4808b8e0b31662", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4e67c90ed9a8c120e5e5cef6a3737958dcde1df9ca0ff8b03e8c63274b0170cd", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1d525bc43a12c306450f7541f77ed66548e0b76e7efadb6c4714fdd353522e47", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ce258edf41355067cfb67f943bbceb6ceee8deba8cb2d40344546f75ecf17e18", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6448e62076119c400d8d3cc171040aac4aec8e25a475dcb2d921728e0eff3065", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:db5cc6f89f60768c4ede174a6098a621fdb2422c3ca4fad73ae8f077a2ff608d", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f6a1bca439a2a1acc62c9a5fc3f0abb48215693234b8d9c5b6bbe0c3b51d7f50", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:91d5d70b22d65361df5b4292bf53f595c825b46a3c1c7552d799d8f170f45833", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "curl@8.14.1-2", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "f0fe82f7c7d29b4a" }, "InstalledVersion": "8.14.1-2", "Status": "affected", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2721d5a765b9c45f97a2c6483e18ed8681db06d9280478fbdd2b877c04acbdee", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-5773", "PkgID": "curl@8.14.1-2", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "f0fe82f7c7d29b4a" }, "InstalledVersion": "8.14.1-2", "FixedVersion": "8.14.1-2+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5773", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9af837df3cf11d6c57632d27529bef7c624909df9410770642b23143c53da615", "Title": "curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse", "Description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "Severity": "HIGH", "CweIDs": [ "CWE-488", "CWE-918" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/9", "https://access.redhat.com/security/cve/CVE-2026-5773", "https://curl.se/docs/CVE-2026-5773.html", "https://curl.se/docs/CVE-2026-5773.json", "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "https://hackerone.com/reports/3650689", "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "https://ubuntu.com/security/notices/USN-8227-1", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-5773" ], "PublishedDate": "2026-05-13T13:01:56.307Z", "LastModifiedDate": "2026-09-15T07:16:28.82Z" }, { "VulnerabilityID": "CVE-2026-6276", "PkgID": "curl@8.14.1-2", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "f0fe82f7c7d29b4a" }, "InstalledVersion": "8.14.1-2", "FixedVersion": "8.14.1-2+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6276", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:31fd684c5263423dbddd2b8ef2260995ec8f061490291e26eb1daeadb81f1631", "Title": "curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers", "Description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-319" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/13", "https://access.redhat.com/security/cve/CVE-2026-6276", "https://curl.se/docs/CVE-2026-6276.html", "https://curl.se/docs/CVE-2026-6276.json", "https://github.com/advisories/GHSA-2jc6-hc33-hv48", "https://hackerone.com/reports/3671818", "https://nvd.nist.gov/vuln/detail/CVE-2026-6276", "https://ubuntu.com/security/notices/USN-8227-1", "https://www.cve.org/CVERecord?id=CVE-2026-6276" ], "PublishedDate": "2026-05-13T13:01:56.8Z", "LastModifiedDate": "2026-09-15T07:16:29.343Z" }, { "VulnerabilityID": "CVE-2026-8286", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "curl@8.14.1-2", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "f0fe82f7c7d29b4a" }, "InstalledVersion": "8.14.1-2", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:035c2a671dc0f445e9465921e28fe3eeb4b3330a90bbfbe6c14552847b19a07b", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "curl@8.14.1-2", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "f0fe82f7c7d29b4a" }, "InstalledVersion": "8.14.1-2", "Status": "affected", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0fa24b9101966e1830c9fde3a05359da8df0af187103a9640e4baaf793aecbd8", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8927", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "curl@8.14.1-2", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "f0fe82f7c7d29b4a" }, "InstalledVersion": "8.14.1-2", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:25199b19755dc63a980c532de3ca7a94e797c94a85087fb19326b879565f3992", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "curl@8.14.1-2", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "f0fe82f7c7d29b4a" }, "InstalledVersion": "8.14.1-2", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e1c765417625081ff9495ff41410976b0f6248e6ed3786e61960e0b0c59eefb8", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-41992", "PkgID": "gzip@1.13-1", "PkgName": "gzip", "PkgIdentifier": { "PURL": "pkg:deb/debian/gzip@1.13-1?arch=amd64\u0026distro=debian-13.1", "UID": "954545ce99bc687e" }, "InstalledVersion": "1.13-1", "FixedVersion": "1.13-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41992", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4557e7a5f1a3af0c21cf1cc3d30fb68eaaea7ac173071a4f8e387dca90918213", "Title": "gzip: gzip: Information disclosure via global buffer overflow in LZH decompression", "Description": "GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "alma": 2, "azure": 2, "julia": 2, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 1, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 6.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "V3Score": 3.6 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/23/1", "http://www.openwall.com/lists/oss-security/2026/08/25/1", "http://www.openwall.com/lists/oss-security/2026/08/27/2", "https://access.redhat.com/errata/RHSA-2026:61623", "https://access.redhat.com/security/cve/CVE-2026-41992", "https://bugzilla.redhat.com/2494158", "https://bugzilla.redhat.com/show_bug.cgi?id=2494158", "https://bugzilla.redhat.com/show_bug.cgi?id=2494159", "https://cert.pl/en/posts/2026/04/CVE-2026-41991", "https://cert.pl/en/posts/2026/04/CVE-2026-41991/", "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681", "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41992", "https://errata.almalinux.org/9/ALSA-2026-61623.html", "https://errata.rockylinux.org/RLSA-2026:61623", "https://github.com/advisories/GHSA-qxh4-rprf-2mmj", "https://linux.oracle.com/cve/CVE-2026-41992.html", "https://linux.oracle.com/errata/ELSA-2026-65998-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-41992", "https://ubuntu.com/security/notices/USN-8512-1", "https://ubuntu.com/security/notices/USN-8733-1", "https://ubuntu.com/security/notices/USN-8733-2", "https://www.cve.org/CVERecord?id=CVE-2026-41992", "https://www.gnu.org/software/gzip", "https://www.gnu.org/software/gzip/" ], "PublishedDate": "2026-06-29T12:16:29.94Z", "LastModifiedDate": "2026-10-25T21:10:00.77Z" }, { "VulnerabilityID": "CVE-2026-40355", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "krb5-locales@1.21.3-5", "PkgName": "krb5-locales", "PkgIdentifier": { "PURL": "pkg:deb/debian/krb5-locales@1.21.3-5?arch=all\u0026distro=debian-13.1", "UID": "781b645aa442b3df" }, "InstalledVersion": "1.21.3-5", "FixedVersion": "1.21.3-5+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40355", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:42cd3c43cb32c111c822eb0ca96928d4e7d44a32838fa771690d0654959f7054", "Title": "krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40355", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-8qgv-wm66-hrmc", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40355.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40355", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40355" ], "PublishedDate": "2026-04-28T06:16:03.663Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-40356", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "krb5-locales@1.21.3-5", "PkgName": "krb5-locales", "PkgIdentifier": { "PURL": "pkg:deb/debian/krb5-locales@1.21.3-5?arch=all\u0026distro=debian-13.1", "UID": "781b645aa442b3df" }, "InstalledVersion": "1.21.3-5", "FixedVersion": "1.21.3-5+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40356", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2e776d626798bfb3f542ed4342be7360c53617e1cc97fe5f55b0ef9151890e89", "Title": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40356", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-f7p3-6rhj-p7jv", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40356.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40356", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40356" ], "PublishedDate": "2026-04-28T07:16:03.197Z", "LastModifiedDate": "2026-10-26T22:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-54369", "PkgID": "libacl1@2.3.2-2+b1", "PkgName": "libacl1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64\u0026distro=debian-13.1", "UID": "3f80157315b2dfd8" }, "InstalledVersion": "2.3.2-2+b1", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b30458ed1445e787be77ff984c8c04825317284c2a7bbb00779e0c571877309f", "Title": "acl: Symlink traversal privilege escalation via libacl functions", "Description": "acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34351", "https://access.redhat.com/errata/RHSA-2026:42736", "https://access.redhat.com/errata/RHSA-2026:42739", "https://access.redhat.com/errata/RHSA-2026:43420", "https://access.redhat.com/errata/RHSA-2026:44481", "https://access.redhat.com/errata/RHSA-2026:46836", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:53371", "https://access.redhat.com/errata/RHSA-2026:54769", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:64805", "https://access.redhat.com/errata/RHSA-2026:67140", "https://access.redhat.com/errata/RHSA-2026:67142", "https://access.redhat.com/errata/RHSA-2026:67144", "https://access.redhat.com/security/cve/CVE-2026-54369", "https://bugzilla.redhat.com/2490277", "https://bugzilla.redhat.com/2490279", "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "https://bugzilla.redhat.com/show_bug.cgi?id=2490279", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54370", "https://errata.almalinux.org/9/ALSA-2026-42736.html", "https://errata.rockylinux.org/RLSA-2026:42736", "https://linux.oracle.com/cve/CVE-2026-54369.html", "https://linux.oracle.com/errata/ELSA-2026-43420.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54369", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "https://www.cve.org/CVERecord?id=CVE-2026-54369", "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" ], "PublishedDate": "2026-06-29T14:16:57.487Z", "LastModifiedDate": "2026-10-25T21:10:00.77Z" }, { "VulnerabilityID": "CVE-2026-109518", "VendorIDs": [ "DSA-6607-1" ], "PkgID": "libapt-pkg7.0@3.0.3", "PkgName": "libapt-pkg7.0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libapt-pkg7.0@3.0.3?arch=amd64\u0026distro=debian-13.1", "UID": "8d0831c9d06c644b" }, "InstalledVersion": "3.0.3", "FixedVersion": "3.0.4", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109518", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bf718e561816d65720efb4f5eefb68032f2a4b04d0beb9348418cac14a172d58", "Title": "apt: apt: Remote code execution via hard link reuse during package download retries", "Description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration", "Severity": "HIGH", "CweIDs": [ "CWE-62", "CWE-367" ], "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/11/04/12", "https://access.redhat.com/security/cve/CVE-2026-109518", "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html", "https://lists.debian.org/debian-security-announce/2026/msg00526.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109518", "https://ubuntu.com/blog/apt-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8996-1", "https://www.cve.org/CVERecord?id=CVE-2026-109518" ], "PublishedDate": "2026-11-04T16:17:33.01Z", "LastModifiedDate": "2026-11-05T05:18:19.033Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "5e2de859106ae047" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:16d5cb5a43107bff69b5a6907df6eb804c77bf4985f13a1a1fdebf2cebfd6508", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "5e2de859106ae047" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:85687c692448b16132ae4e3057cc0ebd008b6f0968b12bdf81764d0c5f24db58", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "5e2de859106ae047" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:87ca01252a0711ccc83faacc0a760f3dacd3392606d23c3b82696b83b1c4b380", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "5e2de859106ae047" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d81ed932352f390bc8fdb6766069825eacaf77189ea2712d6ac582e6fc69366a", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "5e2de859106ae047" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a140c25feb0d1e8d6f96ddceffd88e5a7b97ce8d864ce4a643956b53b8d43c3c", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "5e2de859106ae047" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4e18a63c5f60e536ba6a7165b0d5f9e0816abc4c28824a6f7654f5338080c6dd", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "5e2de859106ae047" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ed8a33bade57cc32b22888a00fa01d2c9613b282dacc4a9637eac44037fd5c15", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "5e2de859106ae047" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d84caa0f2be7a5d52e21027036a137a48f162dcf1a50f82d7a0cffc7497f5ac1", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-111497", "VendorIDs": [ "DSA-6582-1" ], "PkgID": "libbrotli1@1.1.0-2+b7", "PkgName": "libbrotli1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libbrotli1@1.1.0-2%2Bb7?arch=amd64\u0026distro=debian-13.1", "UID": "1cb11302e523b78" }, "InstalledVersion": "1.1.0-2+b7", "FixedVersion": "1.1.0-2+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f1e9e92c6a731f0c76dcd9a660103f7474065c06b14cb63c9ee6dfb5294099b3", "Title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "Description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "Severity": "CRITICAL", "CweIDs": [ "CWE-252", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 9.8, "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/23/25", "http://www.openwall.com/lists/oss-security/2026/10/24/6", "http://www.openwall.com/lists/oss-security/2026/10/26/12", "http://www.openwall.com/lists/oss-security/2026/10/26/13", "http://www.openwall.com/lists/oss-security/2026/10/26/16", "http://www.openwall.com/lists/oss-security/2026/11/03/2", "https://access.redhat.com/errata/RHSA-2026:90495", "https://access.redhat.com/errata/RHSA-2026:92492", "https://access.redhat.com/security/cve/CVE-2026-111497", "https://advisory.echohq.com/cve/CVE-2026-111497", "https://broccoli2shell.com", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2562054", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://cert-portal.siemens.com/productcert/html/ssa-045512.html", "https://cert-portal.siemens.com/productcert/html/ssa-443410.html", "https://cert-portal.siemens.com/productcert/html/ssa-898633.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/", "https://errata.almalinux.org/9/ALSA-2026-92492.html", "https://errata.rockylinux.org/RLSA-2026:90495", "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "https://github.com/andybalholm/brotli/releases/tag/v1.2.7", "https://github.com/dotnet/announcements/issues/494", "https://github.com/google/brotli", "https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b", "https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0", "https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6", "https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12", "https://github.com/google/brotli/releases/tag/v1.0.10", "https://github.com/google/brotli/releases/tag/v1.1.1", "https://github.com/google/brotli/releases/tag/v1.2.1", "https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml", "https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml", "https://linux.oracle.com/cve/CVE-2026-111497.html", "https://linux.oracle.com/errata/ELSA-2026-92492.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high", "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "https://opensourcemalware.com/blog/node2shell-affects-python", "https://patchtheplanet.org/brotli", "https://pypi.org/project/Brotli", "https://pypi.org/project/brotlicffi", "https://ubuntu.com/security/notices/USN-8956-1", "https://ubuntu.com/security/notices/USN-8956-2", "https://ubuntu.com/security/notices/USN-8958-1", "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497", "https://www.cve.org/CVERecord?id=CVE-2026-111497" ], "PublishedDate": "2026-10-22T14:17:37.19Z", "LastModifiedDate": "2026-11-06T16:17:37.393Z" }, { "VulnerabilityID": "CVE-2026-4878", "PkgID": "libcap2@1:2.75-10+b1", "PkgName": "libcap2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcap2@2.75-10%2Bb1?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "c7a667e13ed1a878" }, "InstalledVersion": "1:2.75-10+b1", "FixedVersion": "1:2.75-10+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-4878", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:10cac5df8a628e98188f539169d4e27dc13ed884d98a7c04f14983dc42ba5a13", "Title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()", "Description": "A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "bottlerocket": 2, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4878", "http://www.openwall.com/lists/oss-security/2026/04/07/14", "http://www.openwall.com/lists/oss-security/2026/04/07/4", "http://www.openwall.com/lists/oss-security/2026/04/08/9", "http://www.openwall.com/lists/oss-security/2026/04/09/5", "http://www.openwall.com/lists/oss-security/2026/04/09/6", "https://access.redhat.com/errata/RHSA-2026:12423", "https://access.redhat.com/errata/RHSA-2026:12441", "https://access.redhat.com/errata/RHSA-2026:13285", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14937", "https://access.redhat.com/errata/RHSA-2026:19130", "https://access.redhat.com/errata/RHSA-2026:19346", "https://access.redhat.com/errata/RHSA-2026:19456", "https://access.redhat.com/errata/RHSA-2026:19458", "https://access.redhat.com/errata/RHSA-2026:20595", "https://access.redhat.com/errata/RHSA-2026:21254", "https://access.redhat.com/errata/RHSA-2026:21275", "https://access.redhat.com/errata/RHSA-2026:22634", "https://access.redhat.com/errata/RHSA-2026:22957", "https://access.redhat.com/errata/RHSA-2026:23233", "https://access.redhat.com/errata/RHSA-2026:23245", "https://access.redhat.com/errata/RHSA-2026:24346", "https://access.redhat.com/errata/RHSA-2026:25044", "https://access.redhat.com/errata/RHSA-2026:25096", "https://access.redhat.com/errata/RHSA-2026:25181", "https://access.redhat.com/errata/RHSA-2026:26542", "https://access.redhat.com/errata/RHSA-2026:27998", "https://access.redhat.com/errata/RHSA-2026:28887", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:30078", "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/errata/RHSA-2026:34098", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:7473", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-4878", "https://bugzilla.redhat.com/2451615", "https://bugzilla.redhat.com/show_bug.cgi?id=2447554", "https://bugzilla.redhat.com/show_bug.cgi?id=2451615", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4878", "https://errata.almalinux.org/9/ALSA-2026-19346.html", "https://errata.rockylinux.org/RLSA-2026:19346", "https://github.com/AndrewGMorgan/libcap_mirror/security/advisories/GHSA-f78v-p5hx-m7hh", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-b8okc9cb56gk.toml", "https://linux.oracle.com/cve/CVE-2026-4878.html", "https://linux.oracle.com/errata/ELSA-2026-19346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-4878", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json", "https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.x4zn8j3lss6r", "https://ubuntu.com/security/notices/USN-8193-1", "https://ubuntu.com/security/notices/USN-8193-2", "https://www.cve.org/CVERecord?id=CVE-2026-4878" ], "PublishedDate": "2026-04-09T16:16:31.987Z", "LastModifiedDate": "2026-11-04T23:17:39.403Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "libcurl4t64@8.14.1-2", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "63107564cba8ba64" }, "InstalledVersion": "8.14.1-2", "Status": "affected", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0fa3db1d3d5a9ab44c3b7894f07edb74547c579d6b94952c05d5df2f451df233", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-5773", "PkgID": "libcurl4t64@8.14.1-2", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "63107564cba8ba64" }, "InstalledVersion": "8.14.1-2", "FixedVersion": "8.14.1-2+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5773", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:979f2a9a0f18e9a7db0d145d7d82d4cc64138ad4e16f9c3366461f2f84768def", "Title": "curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse", "Description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "Severity": "HIGH", "CweIDs": [ "CWE-488", "CWE-918" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/9", "https://access.redhat.com/security/cve/CVE-2026-5773", "https://curl.se/docs/CVE-2026-5773.html", "https://curl.se/docs/CVE-2026-5773.json", "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "https://hackerone.com/reports/3650689", "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "https://ubuntu.com/security/notices/USN-8227-1", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-5773" ], "PublishedDate": "2026-05-13T13:01:56.307Z", "LastModifiedDate": "2026-09-15T07:16:28.82Z" }, { "VulnerabilityID": "CVE-2026-6276", "PkgID": "libcurl4t64@8.14.1-2", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "63107564cba8ba64" }, "InstalledVersion": "8.14.1-2", "FixedVersion": "8.14.1-2+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6276", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0f6701c430f805b8bc8101acdb23a2d298b6a9d61cfaa1eaf74f6dac89462842", "Title": "curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers", "Description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-319" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/13", "https://access.redhat.com/security/cve/CVE-2026-6276", "https://curl.se/docs/CVE-2026-6276.html", "https://curl.se/docs/CVE-2026-6276.json", "https://github.com/advisories/GHSA-2jc6-hc33-hv48", "https://hackerone.com/reports/3671818", "https://nvd.nist.gov/vuln/detail/CVE-2026-6276", "https://ubuntu.com/security/notices/USN-8227-1", "https://www.cve.org/CVERecord?id=CVE-2026-6276" ], "PublishedDate": "2026-05-13T13:01:56.8Z", "LastModifiedDate": "2026-09-15T07:16:29.343Z" }, { "VulnerabilityID": "CVE-2026-8286", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "libcurl4t64@8.14.1-2", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "63107564cba8ba64" }, "InstalledVersion": "8.14.1-2", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f7f5b9765b3a804e4826085e4024a8456171073e79c488dd13207e402ec73cdf", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "libcurl4t64@8.14.1-2", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "63107564cba8ba64" }, "InstalledVersion": "8.14.1-2", "Status": "affected", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e123b2a0f6d1e03aea7ec7ad7761deffdb426e03f94cb97f8b94e3ca67d446c7", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8927", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "libcurl4t64@8.14.1-2", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "63107564cba8ba64" }, "InstalledVersion": "8.14.1-2", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dad9a832f2da6dfe83df7c2c8912d0e89b6276611becdad5beb68c08b2f89246", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "libcurl4t64@8.14.1-2", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2?arch=amd64\u0026distro=debian-13.1", "UID": "63107564cba8ba64" }, "InstalledVersion": "8.14.1-2", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5c53e5b29700e06693303744b974101f9500580ad11425777e4e3241325cfd9a", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-33845", "VendorIDs": [ "DSA-6281-1" ], "PkgID": "libgnutls30t64@3.8.9-3", "PkgName": "libgnutls30t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgnutls30t64@3.8.9-3?arch=amd64\u0026distro=debian-13.1", "UID": "9749e8948ee81e44" }, "InstalledVersion": "3.8.9-3", "FixedVersion": "3.8.9-3+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33845", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71692a8de5e355a745634b4e0f4c9ee2861399ec40097adcd97b1f445623db71", "Title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "Description": "A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.", "Severity": "CRITICAL", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13274", "https://access.redhat.com/errata/RHSA-2026:20611", "https://access.redhat.com/errata/RHSA-2026:20612", "https://access.redhat.com/errata/RHSA-2026:20613", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:26409", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:30004", "https://access.redhat.com/errata/RHSA-2026:30849", "https://access.redhat.com/errata/RHSA-2026:30850", "https://access.redhat.com/errata/RHSA-2026:32962", "https://access.redhat.com/errata/RHSA-2026:33125", "https://access.redhat.com/errata/RHSA-2026:34372", "https://access.redhat.com/errata/RHSA-2026:36004", "https://access.redhat.com/errata/RHSA-2026:36005", "https://access.redhat.com/errata/RHSA-2026:36006", "https://access.redhat.com/errata/RHSA-2026:41921", "https://access.redhat.com/errata/RHSA-2026:56786", "https://access.redhat.com/errata/RHSA-2026:56853", "https://access.redhat.com/errata/RHSA-2026:56911", "https://access.redhat.com/errata/RHSA-2026:57402", "https://access.redhat.com/errata/RHSA-2026:57483", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/errata/RHSA-2026:65839", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-33845", "https://bugzilla.redhat.com/2445763", "https://bugzilla.redhat.com/2450624", "https://bugzilla.redhat.com/2450625", "https://bugzilla.redhat.com/2467279", "https://bugzilla.redhat.com/2467289", "https://bugzilla.redhat.com/2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2445762", "https://bugzilla.redhat.com/show_bug.cgi?id=2445763", "https://bugzilla.redhat.com/show_bug.cgi?id=2450624", "https://bugzilla.redhat.com/show_bug.cgi?id=2450625", "https://bugzilla.redhat.com/show_bug.cgi?id=2467279", "https://bugzilla.redhat.com/show_bug.cgi?id=2467289", "https://bugzilla.redhat.com/show_bug.cgi?id=2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2467441", "https://bugzilla.redhat.com/show_bug.cgi?id=2467448", "https://bugzilla.redhat.com/show_bug.cgi?id=2467450", "https://bugzilla.redhat.com/show_bug.cgi?id=2467451", "https://bugzilla.redhat.com/show_bug.cgi?id=2467678", "https://bugzilla.redhat.com/show_bug.cgi?id=2467686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419", "https://errata.almalinux.org/9/ALSA-2026-20612.html", "https://errata.rockylinux.org/RLSA-2026:20612", "https://linux.oracle.com/cve/CVE-2026-33845.html", "https://linux.oracle.com/errata/ELSA-2026-50346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33845", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json", "https://ubuntu.com/security/notices/USN-8284-1", "https://ubuntu.com/security/notices/USN-8502-1", "https://www.cve.org/CVERecord?id=CVE-2026-33845", "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-3" ], "PublishedDate": "2026-04-30T18:16:28.003Z", "LastModifiedDate": "2026-11-04T23:17:27.143Z" }, { "VulnerabilityID": "CVE-2026-42010", "VendorIDs": [ "DSA-6281-1" ], "PkgID": "libgnutls30t64@3.8.9-3", "PkgName": "libgnutls30t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgnutls30t64@3.8.9-3?arch=amd64\u0026distro=debian-13.1", "UID": "9749e8948ee81e44" }, "InstalledVersion": "3.8.9-3", "FixedVersion": "3.8.9-3+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42010", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c235e1d835a016261513b0e7f24b02d25d87751ffc448f9a438e00457ec25c16", "Title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "Description": "A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.", "Severity": "CRITICAL", "CweIDs": [ "CWE-170", "CWE-626" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13274", "https://access.redhat.com/errata/RHSA-2026:20611", "https://access.redhat.com/errata/RHSA-2026:20612", "https://access.redhat.com/errata/RHSA-2026:20613", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:26409", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:30004", "https://access.redhat.com/errata/RHSA-2026:30849", "https://access.redhat.com/errata/RHSA-2026:30850", "https://access.redhat.com/errata/RHSA-2026:32962", "https://access.redhat.com/errata/RHSA-2026:33125", "https://access.redhat.com/errata/RHSA-2026:34764", "https://access.redhat.com/errata/RHSA-2026:34788", "https://access.redhat.com/errata/RHSA-2026:34790", "https://access.redhat.com/errata/RHSA-2026:36004", "https://access.redhat.com/errata/RHSA-2026:36005", "https://access.redhat.com/errata/RHSA-2026:36006", "https://access.redhat.com/errata/RHSA-2026:40762", "https://access.redhat.com/errata/RHSA-2026:41921", "https://access.redhat.com/errata/RHSA-2026:56853", "https://access.redhat.com/errata/RHSA-2026:57483", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/errata/RHSA-2026:62409", "https://access.redhat.com/errata/RHSA-2026:65839", "https://access.redhat.com/errata/RHSA-2026:67857", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-42010", "https://bugzilla.redhat.com/2445763", "https://bugzilla.redhat.com/2450624", "https://bugzilla.redhat.com/2450625", "https://bugzilla.redhat.com/2467279", "https://bugzilla.redhat.com/2467289", "https://bugzilla.redhat.com/2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2445762", "https://bugzilla.redhat.com/show_bug.cgi?id=2445763", "https://bugzilla.redhat.com/show_bug.cgi?id=2450624", "https://bugzilla.redhat.com/show_bug.cgi?id=2450625", "https://bugzilla.redhat.com/show_bug.cgi?id=2467279", "https://bugzilla.redhat.com/show_bug.cgi?id=2467289", "https://bugzilla.redhat.com/show_bug.cgi?id=2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2467441", "https://bugzilla.redhat.com/show_bug.cgi?id=2467448", "https://bugzilla.redhat.com/show_bug.cgi?id=2467450", "https://bugzilla.redhat.com/show_bug.cgi?id=2467451", "https://bugzilla.redhat.com/show_bug.cgi?id=2467678", "https://bugzilla.redhat.com/show_bug.cgi?id=2467686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419", "https://errata.almalinux.org/9/ALSA-2026-20612.html", "https://errata.rockylinux.org/RLSA-2026:20612", "https://linux.oracle.com/cve/CVE-2026-42010.html", "https://linux.oracle.com/errata/ELSA-2026-50346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42010", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json", "https://ubuntu.com/security/notices/USN-8284-1", "https://ubuntu.com/security/notices/USN-8502-1", "https://www.cve.org/CVERecord?id=CVE-2026-42010", "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4" ], "PublishedDate": "2026-05-07T12:16:17.977Z", "LastModifiedDate": "2026-11-04T23:17:33.233Z" }, { "VulnerabilityID": "CVE-2026-33846", "VendorIDs": [ "DSA-6281-1" ], "PkgID": "libgnutls30t64@3.8.9-3", "PkgName": "libgnutls30t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgnutls30t64@3.8.9-3?arch=amd64\u0026distro=debian-13.1", "UID": "9749e8948ee81e44" }, "InstalledVersion": "3.8.9-3", "FixedVersion": "3.8.9-3+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33846", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:748a1e87e9da0cb1e947d061a7e2fb32d6a1a90b92a7da1bf1c7b12651dadf92", "Title": "gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly", "Description": "A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-130" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13274", "https://access.redhat.com/errata/RHSA-2026:20611", "https://access.redhat.com/errata/RHSA-2026:20612", "https://access.redhat.com/errata/RHSA-2026:20613", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:26409", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:30004", "https://access.redhat.com/errata/RHSA-2026:30849", "https://access.redhat.com/errata/RHSA-2026:30850", "https://access.redhat.com/errata/RHSA-2026:32962", "https://access.redhat.com/errata/RHSA-2026:33125", "https://access.redhat.com/errata/RHSA-2026:34372", "https://access.redhat.com/errata/RHSA-2026:36004", "https://access.redhat.com/errata/RHSA-2026:36005", "https://access.redhat.com/errata/RHSA-2026:36006", "https://access.redhat.com/errata/RHSA-2026:41921", "https://access.redhat.com/errata/RHSA-2026:56786", "https://access.redhat.com/errata/RHSA-2026:56853", "https://access.redhat.com/errata/RHSA-2026:56911", "https://access.redhat.com/errata/RHSA-2026:57402", "https://access.redhat.com/errata/RHSA-2026:57483", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/errata/RHSA-2026:65839", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-33846", "https://bugzilla.redhat.com/2445763", "https://bugzilla.redhat.com/2450624", "https://bugzilla.redhat.com/2450625", "https://bugzilla.redhat.com/2467279", "https://bugzilla.redhat.com/2467289", "https://bugzilla.redhat.com/2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2445762", "https://bugzilla.redhat.com/show_bug.cgi?id=2445763", "https://bugzilla.redhat.com/show_bug.cgi?id=2450624", "https://bugzilla.redhat.com/show_bug.cgi?id=2450625", "https://bugzilla.redhat.com/show_bug.cgi?id=2467279", "https://bugzilla.redhat.com/show_bug.cgi?id=2467289", "https://bugzilla.redhat.com/show_bug.cgi?id=2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2467441", "https://bugzilla.redhat.com/show_bug.cgi?id=2467448", "https://bugzilla.redhat.com/show_bug.cgi?id=2467450", "https://bugzilla.redhat.com/show_bug.cgi?id=2467451", "https://bugzilla.redhat.com/show_bug.cgi?id=2467678", "https://bugzilla.redhat.com/show_bug.cgi?id=2467686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419", "https://errata.almalinux.org/9/ALSA-2026-20612.html", "https://errata.rockylinux.org/RLSA-2026:20612", "https://linux.oracle.com/cve/CVE-2026-33846.html", "https://linux.oracle.com/errata/ELSA-2026-50346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33846", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json", "https://ubuntu.com/security/notices/USN-8284-1", "https://ubuntu.com/security/notices/USN-8502-1", "https://www.cve.org/CVERecord?id=CVE-2026-33846", "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-1" ], "PublishedDate": "2026-05-04T10:15:59.69Z", "LastModifiedDate": "2026-11-04T23:17:27.96Z" }, { "VulnerabilityID": "CVE-2026-3833", "VendorIDs": [ "DSA-6281-1" ], "PkgID": "libgnutls30t64@3.8.9-3", "PkgName": "libgnutls30t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgnutls30t64@3.8.9-3?arch=amd64\u0026distro=debian-13.1", "UID": "9749e8948ee81e44" }, "InstalledVersion": "3.8.9-3", "FixedVersion": "3.8.9-3+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-3833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3a36f06b02de112c075bfa1eaf878856f533f56c265891f34de825c17fa3b7cc", "Title": "gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison", "Description": "A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.", "Severity": "HIGH", "CweIDs": [ "CWE-178" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13274", "https://access.redhat.com/errata/RHSA-2026:20611", "https://access.redhat.com/errata/RHSA-2026:20612", "https://access.redhat.com/errata/RHSA-2026:20613", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:26409", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:30004", "https://access.redhat.com/errata/RHSA-2026:30849", "https://access.redhat.com/errata/RHSA-2026:30850", "https://access.redhat.com/errata/RHSA-2026:32962", "https://access.redhat.com/errata/RHSA-2026:33125", "https://access.redhat.com/errata/RHSA-2026:41921", "https://access.redhat.com/errata/RHSA-2026:43575", "https://access.redhat.com/errata/RHSA-2026:57402", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/errata/RHSA-2026:62409", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:65839", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:67857", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-3833", "https://bugzilla.redhat.com/2445763", "https://bugzilla.redhat.com/2450624", "https://bugzilla.redhat.com/2450625", "https://bugzilla.redhat.com/2467279", "https://bugzilla.redhat.com/2467289", "https://bugzilla.redhat.com/2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2445762", "https://bugzilla.redhat.com/show_bug.cgi?id=2445763", "https://bugzilla.redhat.com/show_bug.cgi?id=2450624", "https://bugzilla.redhat.com/show_bug.cgi?id=2450625", "https://bugzilla.redhat.com/show_bug.cgi?id=2467279", "https://bugzilla.redhat.com/show_bug.cgi?id=2467289", "https://bugzilla.redhat.com/show_bug.cgi?id=2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2467441", "https://bugzilla.redhat.com/show_bug.cgi?id=2467448", "https://bugzilla.redhat.com/show_bug.cgi?id=2467450", "https://bugzilla.redhat.com/show_bug.cgi?id=2467451", "https://bugzilla.redhat.com/show_bug.cgi?id=2467678", "https://bugzilla.redhat.com/show_bug.cgi?id=2467686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419", "https://errata.almalinux.org/9/ALSA-2026-20612.html", "https://errata.rockylinux.org/RLSA-2026:20612", "https://gitlab.com/gnutls/gnutls/-/issues/1803", "https://linux.oracle.com/cve/CVE-2026-3833.html", "https://linux.oracle.com/errata/ELSA-2026-50346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-3833", "https://ubuntu.com/security/notices/USN-8284-1", "https://ubuntu.com/security/notices/USN-8502-1", "https://www.cve.org/CVERecord?id=CVE-2026-3833", "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-5" ], "PublishedDate": "2026-04-30T18:16:30.577Z", "LastModifiedDate": "2026-11-05T22:18:41.977Z" }, { "VulnerabilityID": "CVE-2026-42009", "VendorIDs": [ "DSA-6281-1" ], "PkgID": "libgnutls30t64@3.8.9-3", "PkgName": "libgnutls30t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgnutls30t64@3.8.9-3?arch=amd64\u0026distro=debian-13.1", "UID": "9749e8948ee81e44" }, "InstalledVersion": "3.8.9-3", "FixedVersion": "3.8.9-3+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42009", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:185f58a4e60af77130872f4b2b77fc79074c4a7133718380047543a7a1aa1418", "Title": "gnutls: gnutls: Denial of Service via DTLS packet reordering vulnerability", "Description": "A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.", "Severity": "HIGH", "CweIDs": [ "CWE-475" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:13274", "https://access.redhat.com/errata/RHSA-2026:20611", "https://access.redhat.com/errata/RHSA-2026:20612", "https://access.redhat.com/errata/RHSA-2026:20613", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:26409", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:29794", "https://access.redhat.com/errata/RHSA-2026:30004", "https://access.redhat.com/errata/RHSA-2026:30849", "https://access.redhat.com/errata/RHSA-2026:30850", "https://access.redhat.com/errata/RHSA-2026:32962", "https://access.redhat.com/errata/RHSA-2026:33125", "https://access.redhat.com/errata/RHSA-2026:34372", "https://access.redhat.com/errata/RHSA-2026:34764", "https://access.redhat.com/errata/RHSA-2026:34788", "https://access.redhat.com/errata/RHSA-2026:36004", "https://access.redhat.com/errata/RHSA-2026:36005", "https://access.redhat.com/errata/RHSA-2026:36006", "https://access.redhat.com/errata/RHSA-2026:40762", "https://access.redhat.com/errata/RHSA-2026:41921", "https://access.redhat.com/errata/RHSA-2026:56786", "https://access.redhat.com/errata/RHSA-2026:56853", "https://access.redhat.com/errata/RHSA-2026:56911", "https://access.redhat.com/errata/RHSA-2026:57483", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:60019", "https://access.redhat.com/errata/RHSA-2026:65839", "https://access.redhat.com/errata/RHSA-2026:72502", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/errata/RHSA-2026:82304", "https://access.redhat.com/errata/RHSA-2026:82322", "https://access.redhat.com/errata/RHSA-2026:82347", "https://access.redhat.com/errata/RHSA-2026:82354", "https://access.redhat.com/errata/RHSA-2026:82372", "https://access.redhat.com/errata/RHSA-2026:82857", "https://access.redhat.com/errata/RHSA-2026:82888", "https://access.redhat.com/security/cve/CVE-2026-42009", "https://bugzilla.redhat.com/2445763", "https://bugzilla.redhat.com/2450624", "https://bugzilla.redhat.com/2450625", "https://bugzilla.redhat.com/2467279", "https://bugzilla.redhat.com/2467289", "https://bugzilla.redhat.com/2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2445762", "https://bugzilla.redhat.com/show_bug.cgi?id=2445763", "https://bugzilla.redhat.com/show_bug.cgi?id=2450624", "https://bugzilla.redhat.com/show_bug.cgi?id=2450625", "https://bugzilla.redhat.com/show_bug.cgi?id=2467279", "https://bugzilla.redhat.com/show_bug.cgi?id=2467289", "https://bugzilla.redhat.com/show_bug.cgi?id=2467437", "https://bugzilla.redhat.com/show_bug.cgi?id=2467441", "https://bugzilla.redhat.com/show_bug.cgi?id=2467448", "https://bugzilla.redhat.com/show_bug.cgi?id=2467450", "https://bugzilla.redhat.com/show_bug.cgi?id=2467451", "https://bugzilla.redhat.com/show_bug.cgi?id=2467678", "https://bugzilla.redhat.com/show_bug.cgi?id=2467686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419", "https://errata.almalinux.org/9/ALSA-2026-20612.html", "https://errata.rockylinux.org/RLSA-2026:20612", "https://linux.oracle.com/cve/CVE-2026-42009.html", "https://linux.oracle.com/errata/ELSA-2026-50346.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42009", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json", "https://ubuntu.com/security/notices/USN-8284-1", "https://ubuntu.com/security/notices/USN-8502-1", "https://www.cve.org/CVERecord?id=CVE-2026-42009", "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2" ], "PublishedDate": "2026-05-18T13:16:32.707Z", "LastModifiedDate": "2026-11-04T23:17:32.4Z" }, { "VulnerabilityID": "CVE-2026-40355", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libgssapi-krb5-2@1.21.3-5", "PkgName": "libgssapi-krb5-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.21.3-5?arch=amd64\u0026distro=debian-13.1", "UID": "952ae322c229f4bb" }, "InstalledVersion": "1.21.3-5", "FixedVersion": "1.21.3-5+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40355", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:51cacd2b132c8464cd29099d65b91e5062778b96f82c6c2b425b06a9c1bbb326", "Title": "krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40355", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-8qgv-wm66-hrmc", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40355.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40355", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40355" ], "PublishedDate": "2026-04-28T06:16:03.663Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-40356", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libgssapi-krb5-2@1.21.3-5", "PkgName": "libgssapi-krb5-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.21.3-5?arch=amd64\u0026distro=debian-13.1", "UID": "952ae322c229f4bb" }, "InstalledVersion": "1.21.3-5", "FixedVersion": "1.21.3-5+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40356", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:66349c28aafe66dc762ed33f210e098dbce2c824fd4c756438a6c79494fffcf2", "Title": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40356", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-f7p3-6rhj-p7jv", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40356.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40356", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40356" ], "PublishedDate": "2026-04-28T07:16:03.197Z", "LastModifiedDate": "2026-10-26T22:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-40355", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libk5crypto3@1.21.3-5", "PkgName": "libk5crypto3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.21.3-5?arch=amd64\u0026distro=debian-13.1", "UID": "c22ed782493a2e31" }, "InstalledVersion": "1.21.3-5", "FixedVersion": "1.21.3-5+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40355", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aa2d057daadf77e44f83ae9cc87e9f63e519bb5dc883efeb180d70d6226202c0", "Title": "krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40355", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-8qgv-wm66-hrmc", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40355.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40355", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40355" ], "PublishedDate": "2026-04-28T06:16:03.663Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-40356", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libk5crypto3@1.21.3-5", "PkgName": "libk5crypto3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.21.3-5?arch=amd64\u0026distro=debian-13.1", "UID": "c22ed782493a2e31" }, "InstalledVersion": "1.21.3-5", "FixedVersion": "1.21.3-5+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40356", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a7bb415e4cbcde701e271d1850f7137e8fd03f7d62572989018cf706a27c160a", "Title": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40356", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-f7p3-6rhj-p7jv", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40356.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40356", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40356" ], "PublishedDate": "2026-04-28T07:16:03.197Z", "LastModifiedDate": "2026-10-26T22:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-40355", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libkrb5-3@1.21.3-5", "PkgName": "libkrb5-3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.21.3-5?arch=amd64\u0026distro=debian-13.1", "UID": "a12badb8866b6f15" }, "InstalledVersion": "1.21.3-5", "FixedVersion": "1.21.3-5+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40355", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:73c4b6a9837c009b74a22a25d77d59694b9e00d43c06a55f05fbbb0a19182365", "Title": "krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40355", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-8qgv-wm66-hrmc", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40355.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40355", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40355" ], "PublishedDate": "2026-04-28T06:16:03.663Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-40356", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libkrb5-3@1.21.3-5", "PkgName": "libkrb5-3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.21.3-5?arch=amd64\u0026distro=debian-13.1", "UID": "a12badb8866b6f15" }, "InstalledVersion": "1.21.3-5", "FixedVersion": "1.21.3-5+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40356", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bbb297ac9765d3f453881f63c77494ca6a5e8b1f45017c4cafc8247b89c19ce4", "Title": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40356", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-f7p3-6rhj-p7jv", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40356.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40356", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40356" ], "PublishedDate": "2026-04-28T07:16:03.197Z", "LastModifiedDate": "2026-10-26T22:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-40355", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libkrb5support0@1.21.3-5", "PkgName": "libkrb5support0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.21.3-5?arch=amd64\u0026distro=debian-13.1", "UID": "395b8991f5efaa79" }, "InstalledVersion": "1.21.3-5", "FixedVersion": "1.21.3-5+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40355", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:23e340b44559e718e6150d2034c77b125326d7c4ee24723bb8e71b3cd6bfefa0", "Title": "krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40355", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-8qgv-wm66-hrmc", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40355.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40355", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40355" ], "PublishedDate": "2026-04-28T06:16:03.663Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-40356", "VendorIDs": [ "DSA-6293-1" ], "PkgID": "libkrb5support0@1.21.3-5", "PkgName": "libkrb5support0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.21.3-5?arch=amd64\u0026distro=debian-13.1", "UID": "395b8991f5efaa79" }, "InstalledVersion": "1.21.3-5", "FixedVersion": "1.21.3-5+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40356", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2599d5a1a97d3cef0c8c94327dd78a81e33051afe60d79f01bb556da76144e01", "Title": "krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read", "Description": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.", "Severity": "HIGH", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19357", "https://access.redhat.com/security/cve/CVE-2026-40356", "https://bugzilla.redhat.com/2463368", "https://bugzilla.redhat.com/2463370", "https://bugzilla.redhat.com/show_bug.cgi?id=2463368", "https://bugzilla.redhat.com/show_bug.cgi?id=2463370", "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40356", "https://errata.almalinux.org/9/ALSA-2026-19357.html", "https://errata.rockylinux.org/RLSA-2026:19357", "https://github.com/advisories/GHSA-f7p3-6rhj-p7jv", "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "https://linux.oracle.com/cve/CVE-2026-40356.html", "https://linux.oracle.com/errata/ELSA-2026-19357.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40356", "https://ubuntu.com/security/notices/USN-8585-1", "https://web.mit.edu/kerberos/advisories", "https://web.mit.edu/kerberos/advisories/", "https://www.cve.org/CVERecord?id=CVE-2026-40356" ], "PublishedDate": "2026-04-28T07:16:03.197Z", "LastModifiedDate": "2026-10-26T22:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "e729248341b6f11f" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d37eb9f8def52ba428bbf4ee7311a112fff05a6db67a9b8a74a1914a702318e0", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "e729248341b6f11f" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:acc8ec17611c9708d04e40236d64de2791151f8ba0b68d3982e8ffef9c660530", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "e729248341b6f11f" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:08ed3a740d8d1dde59945ae1be80218756d70e970e05de44d26c734cf39544a2", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "e729248341b6f11f" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b9a8e523000f3bf9c9fa0a6be5a7a2ab8cd5006f32e3de932a0ae04f8bb50af", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "e729248341b6f11f" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7a49e8f92cc59dab8a1a68afba5d35ef76d3ff83f0cc462d634bfe085d4762a6", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "e729248341b6f11f" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71eb651826f4a8f9c54610c010b04ae18497da4008d61bd585e00c96ecb6968c", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "e729248341b6f11f" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f66b3132a1d86f16b531300a4161195f9df05c5b15e94713994d669f046882e1", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "e729248341b6f11f" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d368944da881c21bbef7bb7876407263271cc5661515c5c6a53c8953006326d8", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "74c05ea16cd704b6" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e5cfd9054a397fe1083cde96cf7b42eff26a57f416f795e165886a3e0e746315", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "74c05ea16cd704b6" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:292c53deddc0e2fd2a879c5fa373278aaf35dfc529a5485b7d47c9eb5d1c16b7", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "74c05ea16cd704b6" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2becd6b3488748acf611dffee60dda3b0b0376aa4b6269f655278b415e72e639", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "74c05ea16cd704b6" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:036b6fce0c508b64801c243026604bf74c80895848da0fc56813776a101b7684", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "74c05ea16cd704b6" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ffd939cf70ed04fc6419a60c3d8e387952356635f66b67a148eee94ad2920c59", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "74c05ea16cd704b6" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:59a16509568a9729027f3c23076b3322cbfd319758e53ea34ff17a59451a990f", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "74c05ea16cd704b6" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7924e48de0cae6bd9000bbeed3f55d7a565fea2728d67d7bc89e03a6b185302d", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "74c05ea16cd704b6" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:37112f7d34c07c52b2eacedd628792dd60c0f6600c32aebee8c3a7d81cbac7fd", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "libncursesw6@6.5+20250216-2", "PkgName": "libncursesw6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.1", "UID": "b634c296f8d31a6a" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4ddc5f106b4ccb7750961129f7d7de04c125a332f7ca3e77a876b5a9396c1978", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-27135", "VendorIDs": [ "DSA-6266-1" ], "PkgID": "libnghttp2-14@1.64.0-1.1", "PkgName": "libnghttp2-14", "PkgIdentifier": { "PURL": "pkg:deb/debian/libnghttp2-14@1.64.0-1.1?arch=amd64\u0026distro=debian-13.1", "UID": "e61f81d9706a56c1" }, "InstalledVersion": "1.64.0-1.1", "FixedVersion": "1.64.0-1.1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27135", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:421c3134966b1755214d81e40eb0676c20dffbcb9f74e8594cf4f75b80ea9d34", "Title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination", "Description": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.", "Severity": "HIGH", "CweIDs": [ "CWE-617" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "cbl-mariner": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/03/20/3", "https://access.redhat.com/errata/RHSA-2026:10065", "https://access.redhat.com/errata/RHSA-2026:11768", "https://access.redhat.com/errata/RHSA-2026:13812", "https://access.redhat.com/errata/RHSA-2026:14773", "https://access.redhat.com/errata/RHSA-2026:14937", "https://access.redhat.com/errata/RHSA-2026:15087", "https://access.redhat.com/errata/RHSA-2026:16008", "https://access.redhat.com/errata/RHSA-2026:16009", "https://access.redhat.com/errata/RHSA-2026:16030", "https://access.redhat.com/errata/RHSA-2026:16174", "https://access.redhat.com/errata/RHSA-2026:17596", "https://access.redhat.com/errata/RHSA-2026:19724", "https://access.redhat.com/errata/RHSA-2026:19725", "https://access.redhat.com/errata/RHSA-2026:20040", "https://access.redhat.com/errata/RHSA-2026:20087", "https://access.redhat.com/errata/RHSA-2026:21656", "https://access.redhat.com/errata/RHSA-2026:21690", "https://access.redhat.com/errata/RHSA-2026:21695", "https://access.redhat.com/errata/RHSA-2026:25096", "https://access.redhat.com/errata/RHSA-2026:27200", "https://access.redhat.com/errata/RHSA-2026:27201", "https://access.redhat.com/errata/RHSA-2026:6190", "https://access.redhat.com/errata/RHSA-2026:7080", "https://access.redhat.com/errata/RHSA-2026:7123", "https://access.redhat.com/errata/RHSA-2026:7302", "https://access.redhat.com/errata/RHSA-2026:7310", "https://access.redhat.com/errata/RHSA-2026:7350", "https://access.redhat.com/errata/RHSA-2026:7666", "https://access.redhat.com/errata/RHSA-2026:7667", "https://access.redhat.com/errata/RHSA-2026:7668", "https://access.redhat.com/errata/RHSA-2026:7670", "https://access.redhat.com/errata/RHSA-2026:7675", "https://access.redhat.com/errata/RHSA-2026:7896", "https://access.redhat.com/errata/RHSA-2026:7983", "https://access.redhat.com/errata/RHSA-2026:8339", "https://access.redhat.com/errata/RHSA-2026:8538", "https://access.redhat.com/errata/RHSA-2026:8539", "https://access.redhat.com/errata/RHSA-2026:8540", "https://access.redhat.com/errata/RHSA-2026:8541", "https://access.redhat.com/errata/RHSA-2026:8545", "https://access.redhat.com/errata/RHSA-2026:8546", "https://access.redhat.com/errata/RHSA-2026:8547", "https://access.redhat.com/errata/RHSA-2026:8548", "https://access.redhat.com/errata/RHSA-2026:8868", "https://access.redhat.com/errata/RHSA-2026:9711", "https://access.redhat.com/errata/RHSA-2026:9832", "https://access.redhat.com/errata/RHSA-2026:9874", "https://access.redhat.com/security/cve/CVE-2026-27135", "https://bugzilla.redhat.com/2441268", "https://bugzilla.redhat.com/2442922", "https://bugzilla.redhat.com/2448754", "https://bugzilla.redhat.com/2453151", "https://bugzilla.redhat.com/show_bug.cgi?id=2448754", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27135", "https://errata.almalinux.org/9/ALSA-2026-7896.html", "https://errata.rockylinux.org/RLSA-2026:7668", "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1", "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6", "https://linux.oracle.com/cve/CVE-2026-27135.html", "https://linux.oracle.com/errata/ELSA-2026-8339.html", "https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27135", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json", "https://ubuntu.com/security/notices/USN-8233-1", "https://ubuntu.com/security/notices/USN-8233-2", "https://www.cve.org/CVERecord?id=CVE-2026-27135" ], "PublishedDate": "2026-03-18T18:16:26.723Z", "LastModifiedDate": "2026-10-15T02:18:59.883Z" }, { "VulnerabilityID": "CVE-2026-103111", "VendorIDs": [ "DSA-6530-1" ], "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "67c004712a78b8c2" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-103111", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aa50e0d5798328e93b07518efad21059c5fb8deaa30ce6d683c5d2a6d709fed9", "Title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "Description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-103111", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m", "https://linux.oracle.com/cve/CVE-2026-103111.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-103111" ], "PublishedDate": "2026-09-30T05:16:45.863Z", "LastModifiedDate": "2026-10-04T00:16:35.563Z" }, { "VulnerabilityID": "CVE-2026-86145", "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "67c004712a78b8c2" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86145", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:67941b7072dfa5d8c58cad3bcf38f32cfe43635d4e9751ac782c5a3c6ebef94b", "Title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "Description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "Severity": "HIGH", "CweIDs": [ "CWE-424" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "http://www.openwall.com/lists/oss-security/2026/09/05/3", "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-86145", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/17.1.0/BRSA-xqvt0yt0g9rb.toml", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://linux.oracle.com/cve/CVE-2026-86145.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-86145" ], "PublishedDate": "2026-09-05T06:17:10.37Z", "LastModifiedDate": "2026-09-09T16:04:24.933Z" }, { "VulnerabilityID": "CVE-2026-89157", "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "67c004712a78b8c2" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89157", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:156995c017af2c317dcc050cbd92b0ebe32d84e3c6f9032428a186e1d9fb5858", "Title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "Description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 5.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89157", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "https://linux.oracle.com/cve/CVE-2026-89157.html", "https://linux.oracle.com/errata/ELSA-2026-81613.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89157", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89157" ], "PublishedDate": "2026-09-11T04:18:03.753Z", "LastModifiedDate": "2026-09-16T19:25:08.88Z" }, { "VulnerabilityID": "CVE-2026-89161", "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "67c004712a78b8c2" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89161", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a4851018df644cd51b3745cccf877ed1f5e5616538d3498d1818ab629438d4c5", "Title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "Description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "Severity": "HIGH", "CweIDs": [ "CWE-590" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89161", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/commit/1dcd0cf42a6a7cb62cc9a7c024196733abcfda95%20%28pcre2-10.48-RC1%29", "https://github.com/PCRE2Project/pcre2/pull/937", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://linux.oracle.com/cve/CVE-2026-89161.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89161" ], "PublishedDate": "2026-09-11T04:18:04.47Z", "LastModifiedDate": "2026-09-16T19:10:47.78Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "7707866bf21cbb62" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5f88446dc932296fd79d8a32f424559d0944a7dea36bd9130352e4f56e5ca274", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "7707866bf21cbb62" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cb4ea0e159b84241672dadc4156f872e16f3986ca33c3889daf90e6c10451d91", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "7707866bf21cbb62" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2e64481cefbe8e276c8ade9467fcade32f9e0dc81b2fcfd7fed3a53474c8a5e8", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "7707866bf21cbb62" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3dbb4ac0fd6a3a461569e217c12c093f3011ebe5dcf4ab84bee19f733ac01a3a", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "7707866bf21cbb62" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8cd664187676d85b12fa7b8fe7b4f88c8f9289801e91a429e3054df3a6efd33a", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "7707866bf21cbb62" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22e8d3582ff62ce8b3c6b9b41fc52526119b7a19ddf3f9f82ce897a6658e1b11", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "7707866bf21cbb62" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:86d0359c02e9952ce94a18d0482257d87710d311d08b037b87a7c5ff7c8eddd5", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "7707866bf21cbb62" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9b1a62e3fc209fbc7f8498d6f1e8883b3aeb74de1e6e150cfee4d12e2111d84f", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-11822", "PkgID": "libsqlite3-0@3.46.1-7", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7?arch=amd64\u0026distro=debian-13.1", "UID": "8f79e2c4d0625e33" }, "InstalledVersion": "3.46.1-7", "FixedVersion": "3.46.1-7+deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11822", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ffae8e8dcec334dc26fc0b07e3f8cc5f4d091d7727ad5ddf7143555ad7b44f48", "Title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "Description": "SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:58936", "https://access.redhat.com/security/cve/CVE-2026-11822", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://errata.almalinux.org/9/ALSA-2026-58936.html", "https://errata.rockylinux.org/RLSA-2026:58936", "https://linux.oracle.com/cve/CVE-2026-11822.html", "https://linux.oracle.com/errata/ELSA-2026-61242-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-11822", "https://sqlite.org/releaselog/3_53_2.html", "https://sqlite.org/src/info/061febcf41ca", "https://sqlite.org/src/info/4a5ad516ea93", "https://sqlite.org/src/info/87b653731171", "https://sqlite.org/src/info/fad98805b7d7", "https://ubuntu.com/security/notices/USN-8480-1", "https://www.cve.org/CVERecord?id=CVE-2026-11822", "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension" ], "PublishedDate": "2026-06-09T20:16:32.15Z", "LastModifiedDate": "2026-10-30T02:17:08.76Z" }, { "VulnerabilityID": "CVE-2026-11824", "PkgID": "libsqlite3-0@3.46.1-7", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7?arch=amd64\u0026distro=debian-13.1", "UID": "8f79e2c4d0625e33" }, "InstalledVersion": "3.46.1-7", "FixedVersion": "3.46.1-7+deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11824", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d25b96209b9dc4d2850a09946eff88994407832a44eaf69cb78e6a9d60ee05b4", "Title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "Description": "SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:58936", "https://access.redhat.com/security/cve/CVE-2026-11824", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://errata.almalinux.org/9/ALSA-2026-58936.html", "https://errata.rockylinux.org/RLSA-2026:58936", "https://linux.oracle.com/cve/CVE-2026-11824.html", "https://linux.oracle.com/errata/ELSA-2026-58938.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-11824", "https://sqlite.org/releaselog/3_53_2.html", "https://sqlite.org/src/info/061febcf41ca", "https://sqlite.org/src/info/4a5ad516ea93", "https://ubuntu.com/security/notices/USN-8480-1", "https://www.cve.org/CVERecord?id=CVE-2026-11824", "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate" ], "PublishedDate": "2026-06-09T20:16:32.3Z", "LastModifiedDate": "2026-10-15T02:18:37.653Z" }, { "VulnerabilityID": "CVE-2026-119373", "PkgID": "libsqlite3-0@3.46.1-7", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7?arch=amd64\u0026distro=debian-13.1", "UID": "8f79e2c4d0625e33" }, "InstalledVersion": "3.46.1-7", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119373", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3d3b25e764a81717fe46a234a8dd46233177acf7195c9bd7a7f04d9f88f804b5", "Title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5", "Description": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge", "https://access.redhat.com/security/cve/CVE-2026-119373", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107", "https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80", "https://nvd.nist.gov/vuln/detail/CVE-2026-119373", "https://sqlite.org/bugs/info/2026-08-04T08:49:27Z", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/a7f8c92f62", "https://www.cve.org/CVERecord?id=CVE-2026-119373", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists" ], "PublishedDate": "2026-10-30T12:16:36.027Z", "LastModifiedDate": "2026-11-05T21:18:41.047Z" }, { "VulnerabilityID": "CVE-2026-119374", "PkgID": "libsqlite3-0@3.46.1-7", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7?arch=amd64\u0026distro=debian-13.1", "UID": "8f79e2c4d0625e33" }, "InstalledVersion": "3.46.1-7", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119374", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:582c94d460fac83373445a3b4555d258eac3ad024d64777964bcb8f466aef387", "Title": "sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index", "Description": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-fts5-securedel", "https://access.redhat.com/security/cve/CVE-2026-119374", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525", "https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9", "https://nvd.nist.gov/vuln/detail/CVE-2026-119374", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/9cd4f9e920", "https://www.cve.org/CVERecord?id=CVE-2026-119374", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete" ], "PublishedDate": "2026-10-30T12:16:36.187Z", "LastModifiedDate": "2026-11-03T16:09:06.143Z" }, { "VulnerabilityID": "CVE-2026-119379", "PkgID": "libsqlite3-0@3.46.1-7", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7?arch=amd64\u0026distro=debian-13.1", "UID": "8f79e2c4d0625e33" }, "InstalledVersion": "3.46.1-7", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119379", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd68c95a0f66d3c4ba9d193c0f34f4c3f334cc20b2662be13782c528c09e353f", "Title": "sqlite: sqlite: Arbitrary code execution via crafted session changesets", "Description": "SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-session-ncol", "https://access.redhat.com/security/cve/CVE-2026-119379", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619", "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52", "https://nvd.nist.gov/vuln/detail/CVE-2026-119379", "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/3f57024aecea0f3b", "https://www.cve.org/CVERecord?id=CVE-2026-119379", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind" ], "PublishedDate": "2026-10-30T12:16:36.967Z", "LastModifiedDate": "2026-11-03T15:38:24.827Z" }, { "VulnerabilityID": "CVE-2026-55199", "VendorIDs": [ "DSA-6365-1" ], "PkgID": "libssh2-1t64@1.11.1-1", "PkgName": "libssh2-1t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh2-1t64@1.11.1-1?arch=amd64\u0026distro=debian-13.1", "UID": "748bb5a160a66e58" }, "InstalledVersion": "1.11.1-1", "FixedVersion": "1.11.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55199", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:00e81f515b62673cb173f9a3797d84edfb38998a9bb7e1e584af563e5531e292", "Title": "libssh2: libssh2: Denial of Service via crafted SSH_MSG_EXT_INFO message", "Description": "libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-55199", "https://github.com/advisories/GHSA-3cfq-4xx4-rmpg", "https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4", "https://github.com/libssh2/libssh2/pull/1864", "https://nvd.nist.gov/vuln/detail/CVE-2026-55199", "https://ubuntu.com/security/notices/USN-8486-1", "https://www.cve.org/CVERecord?id=CVE-2026-55199", "https://www.vulncheck.com/advisories/libssh2-pre-authentication-dos-via-ssh-msg-ext-info-handler" ], "PublishedDate": "2026-06-17T20:17:28.52Z", "LastModifiedDate": "2026-07-14T22:17:17.043Z" }, { "VulnerabilityID": "CVE-2026-55200", "VendorIDs": [ "DSA-6365-1" ], "PkgID": "libssh2-1t64@1.11.1-1", "PkgName": "libssh2-1t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh2-1t64@1.11.1-1?arch=amd64\u0026distro=debian-13.1", "UID": "748bb5a160a66e58" }, "InstalledVersion": "1.11.1-1", "FixedVersion": "1.11.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55200", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ddae6bee136b2d3b9ee9f1a35465ca3f01c98600f98beb6153e2f48625c8ee80", "Title": "libssh2: libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c", "Description": "libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "azure": 3, "julia": 4, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.3, "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "V3Score": 8.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-55200", "https://github.com/advisories/GHSA-r8mh-x5qv-7gg2", "https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc", "https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8", "https://github.com/libssh2/libssh2/pull/2052", "https://nvd.nist.gov/vuln/detail/CVE-2026-55200", "https://ubuntu.com/security/notices/USN-8486-1", "https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc", "https://www.cve.org/CVERecord?id=CVE-2026-55200", "https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c" ], "PublishedDate": "2026-06-17T20:17:28.667Z", "LastModifiedDate": "2026-10-22T19:17:55.937Z" }, { "VulnerabilityID": "CVE-2026-58050", "PkgID": "libssh2-1t64@1.11.1-1", "PkgName": "libssh2-1t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh2-1t64@1.11.1-1?arch=amd64\u0026distro=debian-13.1", "UID": "748bb5a160a66e58" }, "InstalledVersion": "1.11.1-1", "FixedVersion": "1.11.1-1+deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58050", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eb6453833f87ce88b99ee6b736ce08735a36cc1cd4dd8756556397e7d9b9e4bb", "Title": "libssh2: libssh2: Heap buffer overflow via integer overflow in publickey attribute allocation", "Description": "libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 3, "azure": 3, "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-58050", "https://github.com/advisories/GHSA-mf77-5hj2-98w9", "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc", "https://github.com/libssh2/libssh2/blob/master/src/publickey.c", "https://github.com/libssh2/libssh2/pull/2205#discussion_r3523193089", "https://nvd.nist.gov/vuln/detail/CVE-2026-58050", "https://ubuntu.com/security/notices/USN-8532-1", "https://ubuntu.com/security/notices/USN-8799-1", "https://www.cve.org/CVERecord?id=CVE-2026-58050", "https://www.vulncheck.com/advisories/libssh2-integer-overflow-in-publickey-subsystem-attribute-allocation" ], "PublishedDate": "2026-06-28T02:16:32.017Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-7598", "VendorIDs": [ "DSA-6365-1" ], "PkgID": "libssh2-1t64@1.11.1-1", "PkgName": "libssh2-1t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh2-1t64@1.11.1-1?arch=amd64\u0026distro=debian-13.1", "UID": "748bb5a160a66e58" }, "InstalledVersion": "1.11.1-1", "FixedVersion": "1.11.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:eb0267e51746179afecf5011724dea69f25d268d68bac7ef4387e06b6121d705" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-7598", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eb89cfc62fe017b39c88c12ff6984b73bc707a420e1c2e2bf64ba135e7a2f288", "Title": "libssh2: integer overflow via large username or password arguments", "Description": "A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-189", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 2, "julia": 2, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "V3Score": 7.3, "V40Score": 6.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:16736", "https://access.redhat.com/errata/RHSA-2026:61752", "https://access.redhat.com/errata/RHSA-2026:7021", "https://access.redhat.com/security/cve/CVE-2026-7598", "https://bugzilla.redhat.com/show_bug.cgi?id=2464597", "https://github.com/libssh2/libssh2/", "https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1", "https://github.com/libssh2/libssh2/pull/1858", "https://nvd.nist.gov/vuln/detail/CVE-2026-7598", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7598.json", "https://ubuntu.com/security/notices/USN-8309-1", "https://vuldb.com/submit/805564", "https://vuldb.com/vuln/360555", "https://vuldb.com/vuln/360555/cti", "https://www.cve.org/CVERecord?id=CVE-2026-7598" ], "PublishedDate": "2026-05-01T22:16:16.947Z", "LastModifiedDate": "2026-09-01T13:19:59.617Z" }, { "VulnerabilityID": "CVE-2026-31789", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3t64@3.5.1-1+deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "c1c971e12cfd8b07" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31789", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:30bda1e7e79c554bea18bf58951da6d096e2d5dd8ace13b4d8955e8bd4cfb776", "Title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "Description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "julia": 4, "nvd": 4, "photon": 4, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31789", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://github.com/advisories/GHSA-j79m-9jxq-788r", "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "https://nvd.nist.gov/vuln/detail/CVE-2026-31789", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://www.cve.org/CVERecord?id=CVE-2026-31789", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.617Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2025-15467", "VendorIDs": [ "DSA-6113-1" ], "PkgID": "libssl3t64@3.5.1-1+deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "c1c971e12cfd8b07" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.4-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-15467", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bb456fa29e0c909280638d0c0342291a2c4092d4d30f1ed31b695a2176cf2ff8", "Title": "openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing", "Description": "Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-120" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "julia": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/01/27/10", "http://www.openwall.com/lists/oss-security/2026/02/25/6", "https://access.redhat.com/errata/RHSA-2026:1472", "https://access.redhat.com/errata/RHSA-2026:1473", "https://access.redhat.com/errata/RHSA-2026:1496", "https://access.redhat.com/errata/RHSA-2026:1503", "https://access.redhat.com/errata/RHSA-2026:1519", "https://access.redhat.com/errata/RHSA-2026:1594", "https://access.redhat.com/errata/RHSA-2026:1733", "https://access.redhat.com/errata/RHSA-2026:1736", "https://access.redhat.com/errata/RHSA-2026:2072", "https://access.redhat.com/errata/RHSA-2026:2077", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2633", "https://access.redhat.com/errata/RHSA-2026:2659", "https://access.redhat.com/errata/RHSA-2026:2671", "https://access.redhat.com/errata/RHSA-2026:2844", "https://access.redhat.com/errata/RHSA-2026:2974", "https://access.redhat.com/errata/RHSA-2026:2995", "https://access.redhat.com/errata/RHSA-2026:3228", "https://access.redhat.com/errata/RHSA-2026:3415", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:4419", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:6481", "https://access.redhat.com/errata/RHSA-2026:7261", "https://access.redhat.com/security/cve/CVE-2025-15467", "https://bugzilla.redhat.com/2430375", "https://bugzilla.redhat.com/2430376", "https://bugzilla.redhat.com/2430377", "https://bugzilla.redhat.com/2430378", "https://bugzilla.redhat.com/2430379", "https://bugzilla.redhat.com/2430380", "https://bugzilla.redhat.com/2430381", "https://bugzilla.redhat.com/2430386", "https://bugzilla.redhat.com/2430387", "https://bugzilla.redhat.com/2430388", "https://bugzilla.redhat.com/2430389", "https://bugzilla.redhat.com/2430390", "https://bugzilla.redhat.com/show_bug.cgi?id=2430375", "https://bugzilla.redhat.com/show_bug.cgi?id=2430376", "https://bugzilla.redhat.com/show_bug.cgi?id=2430377", "https://bugzilla.redhat.com/show_bug.cgi?id=2430378", "https://bugzilla.redhat.com/show_bug.cgi?id=2430379", "https://bugzilla.redhat.com/show_bug.cgi?id=2430380", "https://bugzilla.redhat.com/show_bug.cgi?id=2430381", "https://bugzilla.redhat.com/show_bug.cgi?id=2430386", "https://bugzilla.redhat.com/show_bug.cgi?id=2430387", "https://bugzilla.redhat.com/show_bug.cgi?id=2430388", "https://bugzilla.redhat.com/show_bug.cgi?id=2430389", "https://bugzilla.redhat.com/show_bug.cgi?id=2430390", "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "https://cert-portal.siemens.com/productcert/html/ssa-734552.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796", "https://errata.almalinux.org/9/ALSA-2026-1473.html", "https://errata.rockylinux.org/RLSA-2026:1473", "https://github.com/advisories/GHSA-wvhq-3h88-rf6g", "https://github.com/guiimoraes/CVE-2025-15467", "https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703", "https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9", "https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3", "https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e", "https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc", "https://linux.oracle.com/cve/CVE-2025-15467.html", "https://linux.oracle.com/errata/ELSA-2026-50081.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-15467", "https://openssl-library.org/news/secadv/20260127.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json", "https://ubuntu.com/security/notices/USN-7980-1", "https://www.cve.org/CVERecord?id=CVE-2025-15467" ], "PublishedDate": "2026-01-27T16:16:14.257Z", "LastModifiedDate": "2026-10-15T02:17:23.44Z" }, { "VulnerabilityID": "CVE-2025-69421", "VendorIDs": [ "DSA-6113-1" ], "PkgID": "libssl3t64@3.5.1-1+deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "c1c971e12cfd8b07" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.4-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69421", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:414225cbf198f6d04ba7888641c19a3d1a9ff6bb3b38df4d8faba7975da2b58c", "Title": "openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing", "Description": "Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1473", "https://access.redhat.com/security/cve/CVE-2025-69421", "https://bugzilla.redhat.com/2430375", "https://bugzilla.redhat.com/2430376", "https://bugzilla.redhat.com/2430377", "https://bugzilla.redhat.com/2430378", "https://bugzilla.redhat.com/2430379", "https://bugzilla.redhat.com/2430380", "https://bugzilla.redhat.com/2430381", "https://bugzilla.redhat.com/2430386", "https://bugzilla.redhat.com/2430387", "https://bugzilla.redhat.com/2430388", "https://bugzilla.redhat.com/2430389", "https://bugzilla.redhat.com/2430390", "https://bugzilla.redhat.com/show_bug.cgi?id=2430375", "https://bugzilla.redhat.com/show_bug.cgi?id=2430376", "https://bugzilla.redhat.com/show_bug.cgi?id=2430377", "https://bugzilla.redhat.com/show_bug.cgi?id=2430378", "https://bugzilla.redhat.com/show_bug.cgi?id=2430379", "https://bugzilla.redhat.com/show_bug.cgi?id=2430380", "https://bugzilla.redhat.com/show_bug.cgi?id=2430381", "https://bugzilla.redhat.com/show_bug.cgi?id=2430386", "https://bugzilla.redhat.com/show_bug.cgi?id=2430387", "https://bugzilla.redhat.com/show_bug.cgi?id=2430388", "https://bugzilla.redhat.com/show_bug.cgi?id=2430389", "https://bugzilla.redhat.com/show_bug.cgi?id=2430390", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796", "https://errata.almalinux.org/9/ALSA-2026-1473.html", "https://errata.rockylinux.org/RLSA-2026:1473", "https://github.com/advisories/GHSA-w9rv-xc8m-cmqp", "https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b", "https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7", "https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd", "https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3", "https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c", "https://linux.oracle.com/cve/CVE-2025-69421.html", "https://linux.oracle.com/errata/ELSA-2026-50081.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-69421", "https://openssl-library.org/news/secadv/20260127.txt", "https://ubuntu.com/security/notices/USN-7980-1", "https://ubuntu.com/security/notices/USN-7980-2", "https://www.cve.org/CVERecord?id=CVE-2025-69421" ], "PublishedDate": "2026-01-27T16:16:34.437Z", "LastModifiedDate": "2026-06-17T10:00:40.683Z" }, { "VulnerabilityID": "CVE-2026-14456", "VendorIDs": [ "DSA-6465-1" ], "PkgID": "libssl3t64@3.5.1-1+deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "c1c971e12cfd8b07" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.7-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:321689dea9e76b356f622f5eeb6b889da2b55202985f1b377759b49d24bc23af", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-28387", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3t64@3.5.1-1+deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "c1c971e12cfd8b07" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28387", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d52d46e922a859c3d0ec2f4e8b84a7256ab321c2c71073d4146a876d630679e9", "Title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "Description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28387", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "https://nvd.nist.gov/vuln/detail/CVE-2026-28387", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28387", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.7Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28388", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3t64@3.5.1-1+deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "c1c971e12cfd8b07" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28388", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c5cf6e4ad584a17b3f198f83d22e846890fc146640f2a1f34bf1c34be2ff0440", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "Description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28388", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "https://nvd.nist.gov/vuln/detail/CVE-2026-28388", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28388", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.863Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28389", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3t64@3.5.1-1+deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "c1c971e12cfd8b07" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28389", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f1727883a1d325aa0853ff099aed5917b62f37db617abc2f03e90eceaf929f0f", "Title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28389", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/advisories/GHSA-7x88-9hgc-69gf", "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "https://nvd.nist.gov/vuln/detail/CVE-2026-28389", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28389", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.03Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28390", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "libssl3t64@3.5.1-1+deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "c1c971e12cfd8b07" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28390", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:493a37060e78dd5ebbf528dad891dd5ea35150439cba976d4bb4669735039cab", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22312", "https://access.redhat.com/errata/RHSA-2026:22313", "https://access.redhat.com/security/cve/CVE-2026-28390", "https://bugzilla.redhat.com/2456314", "https://bugzilla.redhat.com/show_bug.cgi?id=2456314", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390", "https://errata.almalinux.org/9/ALSA-2026-22313.html", "https://errata.rockylinux.org/RLSA-2026:22312", "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "https://linux.oracle.com/cve/CVE-2026-28390.html", "https://linux.oracle.com/errata/ELSA-2026-50345.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28390", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.19Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-45447", "VendorIDs": [ "DSA-6335-1" ], "PkgID": "libssl3t64@3.5.1-1+deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "c1c971e12cfd8b07" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.6-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f46a2a84ddd8efa1ad95f3de648bc6ce044b032e68ec917bc3b9de063bd2dcc9", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DSA-6531-1" ], "PkgID": "libssl3t64@3.5.1-1+deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "c1c971e12cfd8b07" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.7-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ebbdd07560a6c3f070f014858a816b765f25b133caf73a83e12c4b32a6241ddc", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-16742", "PkgID": "libsystemd0@257.8-1~deb13u2", "PkgName": "libsystemd0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsystemd0@257.8-1~deb13u2?arch=amd64\u0026distro=debian-13.1", "UID": "5a0862dbd32f489e" }, "InstalledVersion": "257.8-1~deb13u2", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16742", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1bcef3d598d53a6e3029af4a4be3fd9a2627ce54f7dfcc43e0e47a87c5efddc1", "Title": "systemd: systemd-homed: Local privilege escalation via missing home-record signature verification", "Description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16742", "https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv", "https://nvd.nist.gov/vuln/detail/CVE-2026-16742", "https://ubuntu.com/security/notices/USN-8626-1", "https://www.cve.org/CVERecord?id=CVE-2026-16742" ], "PublishedDate": "2026-08-10T14:17:21.277Z", "LastModifiedDate": "2026-10-23T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "libtinfo6@6.5+20250216-2", "PkgName": "libtinfo6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.1", "UID": "2106ba75d7633f0b" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:102d38454e5a0a0f2335a02e7addd6934d2cc709b7cba95443d7856bda25724a", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-16742", "PkgID": "libudev1@257.8-1~deb13u2", "PkgName": "libudev1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libudev1@257.8-1~deb13u2?arch=amd64\u0026distro=debian-13.1", "UID": "e178852f9582c8a9" }, "InstalledVersion": "257.8-1~deb13u2", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16742", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:38295851333047d64e94560a49ab75ad1e416375efcab772ae40049756082403", "Title": "systemd: systemd-homed: Local privilege escalation via missing home-record signature verification", "Description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16742", "https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv", "https://nvd.nist.gov/vuln/detail/CVE-2026-16742", "https://ubuntu.com/security/notices/USN-8626-1", "https://www.cve.org/CVERecord?id=CVE-2026-16742" ], "PublishedDate": "2026-08-10T14:17:21.277Z", "LastModifiedDate": "2026-10-23T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "4071f16978620954" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:169a68fa49e3db64e71fa1244cb562d3cbbe389b645101050228f8bf2cb68921", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "4071f16978620954" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:598ee94a7df4fad3f505bfb8a0c6d176a36e8fcd5a3e0bc641690dbc60364e27", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "4071f16978620954" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f58f7f421812d0e05c8bd7adf68dcb8868df79604b9b61c1601e921e9659c64f", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "4071f16978620954" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6117a198d53795faee2d9f18d9a7ecf53e2276e9a0ed1b12baefcd6b2be8956c", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "4071f16978620954" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a39c091896919cfc97fdb09b0c4dc65cb3929c57972bb5331db1bfd6656d4a8b", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "4071f16978620954" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:684b6369e2140d48759ca2c4f855c9538510678cb97ab4f6752b6fe42fdf928e", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "4071f16978620954" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a3bf012a2d4f53058b116bf8ea72182daff8d25055d7ca548aabe8c0d0f0dec2", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "4071f16978620954" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5676a3f37896ac6d9ff7d298522a8eae8c87274a120cb59c257a238bdbc76515", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "52c13d997b14a282" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7df809acebc853122bb7cef079743b7b454ab816559a8039a8c3c5c6b63ba31b", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "52c13d997b14a282" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:35c90a32df3d9bf3fb0a575c287f2c6835b37c4cb661a27cdbee1b38c2fe0fb8", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "52c13d997b14a282" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4b7c19c3f1537fb9a20781ae749c4cfa6a7cd76bd17c87a7521f6ba8ceee4813", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "52c13d997b14a282" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:85e8eab741ef9d464c0213041aeb44a639b27c761dbd1f7a720a6ae453ff6e7c", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "52c13d997b14a282" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:96c0a5e9418b80b9af00195bda9ea062bd8d0022073e9452e3a90cf00d08c4d5", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "52c13d997b14a282" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:df3a4cc9894e48dea8dbc6415093b3baca4447aca1b49529fe7771426bd6a038", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "52c13d997b14a282" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:96dfa02231e938f9335be1e9e6fea4f17c4b760deab34754a98cf43a4e1809a0", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "52c13d997b14a282" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ea2e927b553ec975c2854222dfa51a246a96f285eefd7eccd57eaa90ad392fa2", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:82558a3b19075d9bcf51bddd04cf0babd684efe0f95bea1c67d6803b29bc562d", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:92bb9413e139a8456a5237ca81f803d0583e3c9b6f28a2f996a06f61a6ee1a14", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d7ac2f5794cf5f4d2c83cf0b385f3bb8c11a2e5a3031251b287418afb36d4926", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8353bf8d589e02113d66442a4f68bbe888d800a23829ae8eb973ae4839866265", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c4d5dd5fdce7f19b5bb6cfc2d6ff3d46e16d4d9cbd4ec99514e525953cfdf8c8", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:58fc7d3d787cf93c2f03c9c830258d15a14ca4f51d991c6b795d0d4f130e7d09", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:96b971c44656fce72b2f300c0c4c22fb6f33f90cd14db704ee5643a7f0f55b3d", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:010ef283af3c71d7a8fd1808e9627807635d753117650e30815f57d426c96665", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "ncurses-base@6.5+20250216-2", "PkgName": "ncurses-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all\u0026distro=debian-13.1", "UID": "767a0231348a5cb5" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:838970f924494d2e7bbd3f3d1fb831c15d3eaa5e6c4be0bcd0be17189b72ce2f", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "ncurses-bin@6.5+20250216-2", "PkgName": "ncurses-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.1", "UID": "5b541563cf6587e5" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:683c35dd0e4b3a4c90dbb153397f2295fee945a96cd88178d8e3fedd782ad234", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-31789", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.5.1-1+deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "bb3df0b626c57a91" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31789", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:94d94f0f3251589e9e0800644a02e9003bab3307f54b3915ca1d103113c7679c", "Title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "Description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "julia": 4, "nvd": 4, "photon": 4, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31789", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://github.com/advisories/GHSA-j79m-9jxq-788r", "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "https://nvd.nist.gov/vuln/detail/CVE-2026-31789", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://www.cve.org/CVERecord?id=CVE-2026-31789", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.617Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2025-15467", "VendorIDs": [ "DSA-6113-1" ], "PkgID": "openssl@3.5.1-1+deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "bb3df0b626c57a91" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.4-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-15467", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9f5817a1fe5f6fb7baa68c48470d255d22f35d879c683c144434d471b03efae2", "Title": "openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing", "Description": "Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-120" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "julia": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/01/27/10", "http://www.openwall.com/lists/oss-security/2026/02/25/6", "https://access.redhat.com/errata/RHSA-2026:1472", "https://access.redhat.com/errata/RHSA-2026:1473", "https://access.redhat.com/errata/RHSA-2026:1496", "https://access.redhat.com/errata/RHSA-2026:1503", "https://access.redhat.com/errata/RHSA-2026:1519", "https://access.redhat.com/errata/RHSA-2026:1594", "https://access.redhat.com/errata/RHSA-2026:1733", "https://access.redhat.com/errata/RHSA-2026:1736", "https://access.redhat.com/errata/RHSA-2026:2072", "https://access.redhat.com/errata/RHSA-2026:2077", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2633", "https://access.redhat.com/errata/RHSA-2026:2659", "https://access.redhat.com/errata/RHSA-2026:2671", "https://access.redhat.com/errata/RHSA-2026:2844", "https://access.redhat.com/errata/RHSA-2026:2974", "https://access.redhat.com/errata/RHSA-2026:2995", "https://access.redhat.com/errata/RHSA-2026:3228", "https://access.redhat.com/errata/RHSA-2026:3415", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:4419", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:6481", "https://access.redhat.com/errata/RHSA-2026:7261", "https://access.redhat.com/security/cve/CVE-2025-15467", "https://bugzilla.redhat.com/2430375", "https://bugzilla.redhat.com/2430376", "https://bugzilla.redhat.com/2430377", "https://bugzilla.redhat.com/2430378", "https://bugzilla.redhat.com/2430379", "https://bugzilla.redhat.com/2430380", "https://bugzilla.redhat.com/2430381", "https://bugzilla.redhat.com/2430386", "https://bugzilla.redhat.com/2430387", "https://bugzilla.redhat.com/2430388", "https://bugzilla.redhat.com/2430389", "https://bugzilla.redhat.com/2430390", "https://bugzilla.redhat.com/show_bug.cgi?id=2430375", "https://bugzilla.redhat.com/show_bug.cgi?id=2430376", "https://bugzilla.redhat.com/show_bug.cgi?id=2430377", "https://bugzilla.redhat.com/show_bug.cgi?id=2430378", "https://bugzilla.redhat.com/show_bug.cgi?id=2430379", "https://bugzilla.redhat.com/show_bug.cgi?id=2430380", "https://bugzilla.redhat.com/show_bug.cgi?id=2430381", "https://bugzilla.redhat.com/show_bug.cgi?id=2430386", "https://bugzilla.redhat.com/show_bug.cgi?id=2430387", "https://bugzilla.redhat.com/show_bug.cgi?id=2430388", "https://bugzilla.redhat.com/show_bug.cgi?id=2430389", "https://bugzilla.redhat.com/show_bug.cgi?id=2430390", "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "https://cert-portal.siemens.com/productcert/html/ssa-734552.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796", "https://errata.almalinux.org/9/ALSA-2026-1473.html", "https://errata.rockylinux.org/RLSA-2026:1473", "https://github.com/advisories/GHSA-wvhq-3h88-rf6g", "https://github.com/guiimoraes/CVE-2025-15467", "https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703", "https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9", "https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3", "https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e", "https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc", "https://linux.oracle.com/cve/CVE-2025-15467.html", "https://linux.oracle.com/errata/ELSA-2026-50081.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-15467", "https://openssl-library.org/news/secadv/20260127.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json", "https://ubuntu.com/security/notices/USN-7980-1", "https://www.cve.org/CVERecord?id=CVE-2025-15467" ], "PublishedDate": "2026-01-27T16:16:14.257Z", "LastModifiedDate": "2026-10-15T02:17:23.44Z" }, { "VulnerabilityID": "CVE-2025-69421", "VendorIDs": [ "DSA-6113-1" ], "PkgID": "openssl@3.5.1-1+deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "bb3df0b626c57a91" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.4-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69421", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4e65d384996af21bf491ec421d22e740e8966ab6b7f957e1208dd02ff3ac6352", "Title": "openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing", "Description": "Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1473", "https://access.redhat.com/security/cve/CVE-2025-69421", "https://bugzilla.redhat.com/2430375", "https://bugzilla.redhat.com/2430376", "https://bugzilla.redhat.com/2430377", "https://bugzilla.redhat.com/2430378", "https://bugzilla.redhat.com/2430379", "https://bugzilla.redhat.com/2430380", "https://bugzilla.redhat.com/2430381", "https://bugzilla.redhat.com/2430386", "https://bugzilla.redhat.com/2430387", "https://bugzilla.redhat.com/2430388", "https://bugzilla.redhat.com/2430389", "https://bugzilla.redhat.com/2430390", "https://bugzilla.redhat.com/show_bug.cgi?id=2430375", "https://bugzilla.redhat.com/show_bug.cgi?id=2430376", "https://bugzilla.redhat.com/show_bug.cgi?id=2430377", "https://bugzilla.redhat.com/show_bug.cgi?id=2430378", "https://bugzilla.redhat.com/show_bug.cgi?id=2430379", "https://bugzilla.redhat.com/show_bug.cgi?id=2430380", "https://bugzilla.redhat.com/show_bug.cgi?id=2430381", "https://bugzilla.redhat.com/show_bug.cgi?id=2430386", "https://bugzilla.redhat.com/show_bug.cgi?id=2430387", "https://bugzilla.redhat.com/show_bug.cgi?id=2430388", "https://bugzilla.redhat.com/show_bug.cgi?id=2430389", "https://bugzilla.redhat.com/show_bug.cgi?id=2430390", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796", "https://errata.almalinux.org/9/ALSA-2026-1473.html", "https://errata.rockylinux.org/RLSA-2026:1473", "https://github.com/advisories/GHSA-w9rv-xc8m-cmqp", "https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b", "https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7", "https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd", "https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3", "https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c", "https://linux.oracle.com/cve/CVE-2025-69421.html", "https://linux.oracle.com/errata/ELSA-2026-50081.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-69421", "https://openssl-library.org/news/secadv/20260127.txt", "https://ubuntu.com/security/notices/USN-7980-1", "https://ubuntu.com/security/notices/USN-7980-2", "https://www.cve.org/CVERecord?id=CVE-2025-69421" ], "PublishedDate": "2026-01-27T16:16:34.437Z", "LastModifiedDate": "2026-06-17T10:00:40.683Z" }, { "VulnerabilityID": "CVE-2026-14456", "VendorIDs": [ "DSA-6465-1" ], "PkgID": "openssl@3.5.1-1+deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "bb3df0b626c57a91" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.7-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b64388629c925b5cf906f4dd9488a5ac1936d72e8697834357670a37b32ae8d6", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-28387", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.5.1-1+deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "bb3df0b626c57a91" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28387", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:59a88e2b8cb3f08ea15b8ace8ada082ccbf5bf541ad325ac4526c025165b64b2", "Title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "Description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28387", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "https://nvd.nist.gov/vuln/detail/CVE-2026-28387", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28387", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.7Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28388", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.5.1-1+deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "bb3df0b626c57a91" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28388", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6e3fc81ad737b42c74c84dc0ce9cbdeec893777a71cd36bbf92f6f7b59fcff24", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "Description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28388", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "https://nvd.nist.gov/vuln/detail/CVE-2026-28388", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28388", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.863Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28389", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.5.1-1+deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "bb3df0b626c57a91" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28389", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fb7a458516a5e8efd10508ef5d678ab37262c04eb78c9a2e09bba3ebad04649f", "Title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28389", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/advisories/GHSA-7x88-9hgc-69gf", "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "https://nvd.nist.gov/vuln/detail/CVE-2026-28389", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28389", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.03Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28390", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl@3.5.1-1+deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "bb3df0b626c57a91" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28390", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a1f0d2acc8be14a7ac0c5577f39cf0690366e5a6a5bf6008cdd442c7429d7e31", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22312", "https://access.redhat.com/errata/RHSA-2026:22313", "https://access.redhat.com/security/cve/CVE-2026-28390", "https://bugzilla.redhat.com/2456314", "https://bugzilla.redhat.com/show_bug.cgi?id=2456314", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390", "https://errata.almalinux.org/9/ALSA-2026-22313.html", "https://errata.rockylinux.org/RLSA-2026:22312", "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "https://linux.oracle.com/cve/CVE-2026-28390.html", "https://linux.oracle.com/errata/ELSA-2026-50345.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28390", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.19Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-45447", "VendorIDs": [ "DSA-6335-1" ], "PkgID": "openssl@3.5.1-1+deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "bb3df0b626c57a91" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.6-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b9d0614372f8c2694d4ddc356215641e8a5e5c0633276202989c8152679b642a", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DSA-6531-1" ], "PkgID": "openssl@3.5.1-1+deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "bb3df0b626c57a91" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.7-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:c28fab3840a6c6d51c515f35b44cefd6df484ffac07029b114df0d8ee1522420" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6aa188f7117177f0023a10536c7c2dcb8f695e5e05c5a9eaa55fdcca7d07bf10", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-31789", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl-provider-legacy@3.5.1-1+deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "317b92010de10747" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31789", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:833d3c8e11ffe4fda7e39ec314aee1c937d42c6e111671a82e1486dd418f9e2c", "Title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "Description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "julia": 4, "nvd": 4, "photon": 4, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31789", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://github.com/advisories/GHSA-j79m-9jxq-788r", "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "https://nvd.nist.gov/vuln/detail/CVE-2026-31789", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://www.cve.org/CVERecord?id=CVE-2026-31789", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.617Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2025-15467", "VendorIDs": [ "DSA-6113-1" ], "PkgID": "openssl-provider-legacy@3.5.1-1+deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "317b92010de10747" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.4-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-15467", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1998a4f8931d2f5fc1a11a8edbdb2838291222beb5012e9337f1e5a138c05b10", "Title": "openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing", "Description": "Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-120" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "julia": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/01/27/10", "http://www.openwall.com/lists/oss-security/2026/02/25/6", "https://access.redhat.com/errata/RHSA-2026:1472", "https://access.redhat.com/errata/RHSA-2026:1473", "https://access.redhat.com/errata/RHSA-2026:1496", "https://access.redhat.com/errata/RHSA-2026:1503", "https://access.redhat.com/errata/RHSA-2026:1519", "https://access.redhat.com/errata/RHSA-2026:1594", "https://access.redhat.com/errata/RHSA-2026:1733", "https://access.redhat.com/errata/RHSA-2026:1736", "https://access.redhat.com/errata/RHSA-2026:2072", "https://access.redhat.com/errata/RHSA-2026:2077", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2633", "https://access.redhat.com/errata/RHSA-2026:2659", "https://access.redhat.com/errata/RHSA-2026:2671", "https://access.redhat.com/errata/RHSA-2026:2844", "https://access.redhat.com/errata/RHSA-2026:2974", "https://access.redhat.com/errata/RHSA-2026:2995", "https://access.redhat.com/errata/RHSA-2026:3228", "https://access.redhat.com/errata/RHSA-2026:3415", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:4419", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:6481", "https://access.redhat.com/errata/RHSA-2026:7261", "https://access.redhat.com/security/cve/CVE-2025-15467", "https://bugzilla.redhat.com/2430375", "https://bugzilla.redhat.com/2430376", "https://bugzilla.redhat.com/2430377", "https://bugzilla.redhat.com/2430378", "https://bugzilla.redhat.com/2430379", "https://bugzilla.redhat.com/2430380", "https://bugzilla.redhat.com/2430381", "https://bugzilla.redhat.com/2430386", "https://bugzilla.redhat.com/2430387", "https://bugzilla.redhat.com/2430388", "https://bugzilla.redhat.com/2430389", "https://bugzilla.redhat.com/2430390", "https://bugzilla.redhat.com/show_bug.cgi?id=2430375", "https://bugzilla.redhat.com/show_bug.cgi?id=2430376", "https://bugzilla.redhat.com/show_bug.cgi?id=2430377", "https://bugzilla.redhat.com/show_bug.cgi?id=2430378", "https://bugzilla.redhat.com/show_bug.cgi?id=2430379", "https://bugzilla.redhat.com/show_bug.cgi?id=2430380", "https://bugzilla.redhat.com/show_bug.cgi?id=2430381", "https://bugzilla.redhat.com/show_bug.cgi?id=2430386", "https://bugzilla.redhat.com/show_bug.cgi?id=2430387", "https://bugzilla.redhat.com/show_bug.cgi?id=2430388", "https://bugzilla.redhat.com/show_bug.cgi?id=2430389", "https://bugzilla.redhat.com/show_bug.cgi?id=2430390", "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "https://cert-portal.siemens.com/productcert/html/ssa-734552.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796", "https://errata.almalinux.org/9/ALSA-2026-1473.html", "https://errata.rockylinux.org/RLSA-2026:1473", "https://github.com/advisories/GHSA-wvhq-3h88-rf6g", "https://github.com/guiimoraes/CVE-2025-15467", "https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703", "https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9", "https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3", "https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e", "https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc", "https://linux.oracle.com/cve/CVE-2025-15467.html", "https://linux.oracle.com/errata/ELSA-2026-50081.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-15467", "https://openssl-library.org/news/secadv/20260127.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json", "https://ubuntu.com/security/notices/USN-7980-1", "https://www.cve.org/CVERecord?id=CVE-2025-15467" ], "PublishedDate": "2026-01-27T16:16:14.257Z", "LastModifiedDate": "2026-10-15T02:17:23.44Z" }, { "VulnerabilityID": "CVE-2025-69421", "VendorIDs": [ "DSA-6113-1" ], "PkgID": "openssl-provider-legacy@3.5.1-1+deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "317b92010de10747" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.4-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69421", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8ee9e5ef19f80599b0c25ccc357debd5daac31f7e19f7095ebd3b515b05a7678", "Title": "openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing", "Description": "Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1473", "https://access.redhat.com/security/cve/CVE-2025-69421", "https://bugzilla.redhat.com/2430375", "https://bugzilla.redhat.com/2430376", "https://bugzilla.redhat.com/2430377", "https://bugzilla.redhat.com/2430378", "https://bugzilla.redhat.com/2430379", "https://bugzilla.redhat.com/2430380", "https://bugzilla.redhat.com/2430381", "https://bugzilla.redhat.com/2430386", "https://bugzilla.redhat.com/2430387", "https://bugzilla.redhat.com/2430388", "https://bugzilla.redhat.com/2430389", "https://bugzilla.redhat.com/2430390", "https://bugzilla.redhat.com/show_bug.cgi?id=2430375", "https://bugzilla.redhat.com/show_bug.cgi?id=2430376", "https://bugzilla.redhat.com/show_bug.cgi?id=2430377", "https://bugzilla.redhat.com/show_bug.cgi?id=2430378", "https://bugzilla.redhat.com/show_bug.cgi?id=2430379", "https://bugzilla.redhat.com/show_bug.cgi?id=2430380", "https://bugzilla.redhat.com/show_bug.cgi?id=2430381", "https://bugzilla.redhat.com/show_bug.cgi?id=2430386", "https://bugzilla.redhat.com/show_bug.cgi?id=2430387", "https://bugzilla.redhat.com/show_bug.cgi?id=2430388", "https://bugzilla.redhat.com/show_bug.cgi?id=2430389", "https://bugzilla.redhat.com/show_bug.cgi?id=2430390", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796", "https://errata.almalinux.org/9/ALSA-2026-1473.html", "https://errata.rockylinux.org/RLSA-2026:1473", "https://github.com/advisories/GHSA-w9rv-xc8m-cmqp", "https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b", "https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7", "https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd", "https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3", "https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c", "https://linux.oracle.com/cve/CVE-2025-69421.html", "https://linux.oracle.com/errata/ELSA-2026-50081.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-69421", "https://openssl-library.org/news/secadv/20260127.txt", "https://ubuntu.com/security/notices/USN-7980-1", "https://ubuntu.com/security/notices/USN-7980-2", "https://www.cve.org/CVERecord?id=CVE-2025-69421" ], "PublishedDate": "2026-01-27T16:16:34.437Z", "LastModifiedDate": "2026-06-17T10:00:40.683Z" }, { "VulnerabilityID": "CVE-2026-14456", "VendorIDs": [ "DSA-6465-1" ], "PkgID": "openssl-provider-legacy@3.5.1-1+deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "317b92010de10747" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.7-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:75b33207ed084d47ceef432991eda54d3e4e1391dd9b00026c70ef019c88611a", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-28387", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl-provider-legacy@3.5.1-1+deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "317b92010de10747" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28387", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e0ac2ce10f713431e902c553abdfd936fea20b4bb3864c0b1001810a2e33f2ed", "Title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "Description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28387", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "https://nvd.nist.gov/vuln/detail/CVE-2026-28387", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28387", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.7Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28388", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl-provider-legacy@3.5.1-1+deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "317b92010de10747" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28388", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:78ed2ecfdba2c07ed0d372278c5ba42c8a2b2c23736d667844a0eca1a9251a1f", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "Description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28388", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "https://nvd.nist.gov/vuln/detail/CVE-2026-28388", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28388", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.863Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28389", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl-provider-legacy@3.5.1-1+deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "317b92010de10747" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28389", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3b2f12e704222512b28c94f0b8d36b40466a58174ed80d6c73c2c62148c59d6a", "Title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28389", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/advisories/GHSA-7x88-9hgc-69gf", "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "https://nvd.nist.gov/vuln/detail/CVE-2026-28389", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28389", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.03Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28390", "VendorIDs": [ "DSA-6201-1" ], "PkgID": "openssl-provider-legacy@3.5.1-1+deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "317b92010de10747" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.5-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28390", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ee0507bcf8e5891926c650887393f33c0e80325cff83faab5884fc5c1f2fc063", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22312", "https://access.redhat.com/errata/RHSA-2026:22313", "https://access.redhat.com/security/cve/CVE-2026-28390", "https://bugzilla.redhat.com/2456314", "https://bugzilla.redhat.com/show_bug.cgi?id=2456314", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390", "https://errata.almalinux.org/9/ALSA-2026-22313.html", "https://errata.rockylinux.org/RLSA-2026:22312", "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "https://linux.oracle.com/cve/CVE-2026-28390.html", "https://linux.oracle.com/errata/ELSA-2026-50345.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28390", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.19Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-45447", "VendorIDs": [ "DSA-6335-1" ], "PkgID": "openssl-provider-legacy@3.5.1-1+deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "317b92010de10747" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.6-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:031d9e446c179e3fd81408e5dd28a39a4214fad3dce251336a4b055c9fa32d4f", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DSA-6531-1" ], "PkgID": "openssl-provider-legacy@3.5.1-1+deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.1", "UID": "317b92010de10747" }, "InstalledVersion": "3.5.1-1+deb13u1", "FixedVersion": "3.5.7-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eb8ed4cb0517fd8f93cb829be77f044102595941c9dec7f6389826ceca13acdf", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-13221", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.1", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d8fc369685ebf18d7b5534b2557d85e09d661b815ac0915e820792a80c46fe49", "Title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://access.redhat.com/errata/RHSA-2026:67155", "https://access.redhat.com/security/cve/CVE-2026-13221", "https://bugzilla.redhat.com/2499727", "https://bugzilla.redhat.com/show_bug.cgi?id=2499727", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13221", "https://errata.almalinux.org/9/ALSA-2026-67155.html", "https://errata.rockylinux.org/RLSA-2026:67155", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://linux.oracle.com/cve/CVE-2026-13221.html", "https://linux.oracle.com/errata/ELSA-2026-67278-0.html", "https://lists.security.metacpan.org/cve-announce/msg/41780104/", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-42496", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.1", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:45a548eeaba6bec6c5aee4f18c97dc919843ab82de6e88bc809ce1f792e9e13d", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-8376", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.1", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3d7a467d0d251e3ab71ba055e5d9d34b7bf87330b4c99851a6a87cc13c37e2d5", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-09-08T22:19:18.373Z" }, { "VulnerabilityID": "CVE-2026-42497", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.1", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:82c0194e5137e0656ff28d0fde5c0f8f6265fb64c5e66f3c7e0d2b370c7e9ef6", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://lists.security.metacpan.org/cve-announce/msg/40396457/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.1", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d5271be3f6915d8c8eb7e16db0e00f4597411f9502d0e99f70e58e903bd98759", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/errata/RHSA-2026:50262", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://lists.security.metacpan.org/cve-announce/msg/40434385/", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-08-05T13:23:22.46Z" }, { "VulnerabilityID": "CVE-2026-57432", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.1", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:763412912a8674d4ebca0c6f427e27264ca8fc658fc2f51f2e4d79b23adab535", "Title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://access.redhat.com/security/cve/CVE-2026-57432", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780102/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57433", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.1", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8198b335903586c2eaa6752c5ed27d21b970b60e1755eed6b5bbf6f204e555d3", "Title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://access.redhat.com/security/cve/CVE-2026-57433", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780100/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.1", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:28121e9c2dd692ba9dd5add9857a07dc697e9c4b793acf12c288eb81355d145e", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/errata/RHSA-2026:49525", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://bugzilla.redhat.com/2481315", "https://bugzilla.redhat.com/show_bug.cgi?id=2481315", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9538", "https://errata.almalinux.org/9/ALSA-2026-49525.html", "https://errata.rockylinux.org/RLSA-2026:49525", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://linux.oracle.com/cve/CVE-2026-9538.html", "https://linux.oracle.com/errata/ELSA-2026-49525.html", "https://lists.security.metacpan.org/cve-announce/msg/40396448/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7a8ab74b8390c6281af9e59a5c7bd8748f2b2d48e1290e2121fbdf7c6e9f1730", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:26c9eb48adcf79d785123863b9944e918706488c5cee6837fe8db6ad13186fe8", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b1b619b603722b7e880f32af120dd25fbfab584bd1471f0b155f74d29f204054", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:601bad5b5ff6c1f139c411dc8c88056466523be19c77645d1eec50e486e34cd4", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7498c498086d5044a038954a4f5067d5ef1e4a64da27296a530de03336c3527e", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5c7e43ba1863727422d26926943cce2b316f4d2cf2f2f95dd2575c384d07807c", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:45dc3fa3d697f77436cb9884fbd59bb6fb84ec5202689434c355ac96b6839f21", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.1", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:92e11d5d591efa423cd75872fb1032312171cf3315561e97ef7d24d095f1d1fa", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-76844", "VendorIDs": [ "DSA-6613-1" ], "PkgID": "zlib1g@1:1.3.dfsg+really1.3.1-1+b1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "bad002d21692afaf" }, "InstalledVersion": "1:1.3.dfsg+really1.3.1-1+b1", "FixedVersion": "1:1.3.dfsg+really1.3.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76844", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd3977b8f3bc7320cc82f494a2668f0248fc44a5888553e74f6c6d7ef5edaa22", "Title": "webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal", "Description": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76844", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148", "https://github.com/webpack/webpack-dev-middleware", "https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js", "https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b", "https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b", "https://github.com/webpack/webpack-dev-middleware/pull/2404", "https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6", "https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0", "https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c", "https://nvd.nist.gov/vuln/detail/CVE-2026-76844", "https://www.cve.org/CVERecord?id=CVE-2026-76844", "https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-08-24T14:17:02.25Z", "LastModifiedDate": "2026-10-12T17:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-85091", "VendorIDs": [ "DSA-6613-1" ], "PkgID": "zlib1g@1:1.3.dfsg+really1.3.1-1+b1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64\u0026distro=debian-13.1\u0026epoch=1", "UID": "bad002d21692afaf" }, "InstalledVersion": "1:1.3.dfsg+really1.3.1-1+b1", "FixedVersion": "1:1.3.dfsg+really1.3.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:36d06fe0cbc654e5f67d58c960ed33e53127e4a3288d8ce6f6a60a9c311794d4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:66ed24bd874cba4b619db7a25559ff3c9647691789332117df5a309bf299f55c", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" } ] }, { "Target": "Python", "Class": "lang-pkgs", "Type": "python-pkg", "Packages": [ { "Name": "PyYAML", "Identifier": { "PURL": "pkg:pypi/pyyaml@6.0.3", "UID": "200d8384c5c91a41" }, "Version": "6.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/pyyaml-6.0.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "annotated-types", "Identifier": { "PURL": "pkg:pypi/annotated-types@0.7.0", "UID": "8f2d1a00c89e67cc" }, "Version": "0.7.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/annotated_types-0.7.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "anthropic", "Identifier": { "PURL": "pkg:pypi/anthropic@0.42.0", "UID": "d90c34e1e845876b" }, "Version": "0.42.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/anthropic-0.42.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "anyio", "Identifier": { "PURL": "pkg:pypi/anyio@4.11.0", "UID": "77fd5457aa5ae237" }, "Version": "4.11.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/anyio-4.11.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "autocommand", "Identifier": { "PURL": "pkg:pypi/autocommand@2.2.2", "UID": "de2aeb22213f7255" }, "Version": "2.2.2", "Licenses": [ "LGPL-3.0-only" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/autocommand-2.2.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "backports.tarfile", "Identifier": { "PURL": "pkg:pypi/backports.tarfile@1.2.0", "UID": "1333ca5d453000df" }, "Version": "1.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/backports.tarfile-1.2.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "certifi", "Identifier": { "PURL": "pkg:pypi/certifi@2025.11.12", "UID": "23871ceadb6b3454" }, "Version": "2025.11.12", "Licenses": [ "MPL-2.0" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/certifi-2025.11.12.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "charset-normalizer", "Identifier": { "PURL": "pkg:pypi/charset-normalizer@3.4.4", "UID": "8c758b7b747bd3eb" }, "Version": "3.4.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/charset_normalizer-3.4.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "click", "Identifier": { "PURL": "pkg:pypi/click@8.3.0", "UID": "6ed7b8663e7aedc4" }, "Version": "8.3.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/click-8.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "distro", "Identifier": { "PURL": "pkg:pypi/distro@1.9.0", "UID": "9924e2afe75382b4" }, "Version": "1.9.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/distro-1.9.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "docker", "Identifier": { "PURL": "pkg:pypi/docker@7.1.0", "UID": "ad782387aee7537d" }, "Version": "7.1.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/docker-7.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "fastapi", "Identifier": { "PURL": "pkg:pypi/fastapi@0.115.0", "UID": "cfd8ff169304fda3" }, "Version": "0.115.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/fastapi-0.115.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "h11", "Identifier": { "PURL": "pkg:pypi/h11@0.16.0", "UID": "455db3a00bf72" }, "Version": "0.16.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/h11-0.16.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "httpcore", "Identifier": { "PURL": "pkg:pypi/httpcore@1.0.9", "UID": "5f1e35fbdba869a3" }, "Version": "1.0.9", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/httpcore-1.0.9.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "httptools", "Identifier": { "PURL": "pkg:pypi/httptools@0.7.1", "UID": "4a84689cd11ef71a" }, "Version": "0.7.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/httptools-0.7.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "httpx", "Identifier": { "PURL": "pkg:pypi/httpx@0.28.1", "UID": "90b35739e155fb56" }, "Version": "0.28.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/httpx-0.28.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "idna", "Identifier": { "PURL": "pkg:pypi/idna@3.11", "UID": "e7652757f58a6801" }, "Version": "3.11", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/idna-3.11.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "importlib_metadata", "Identifier": { "PURL": "pkg:pypi/importlib-metadata@8.0.0", "UID": "347a36bc9e660761" }, "Version": "8.0.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/importlib_metadata-8.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "inflect", "Identifier": { "PURL": "pkg:pypi/inflect@7.3.1", "UID": "51e7d1c898b69383" }, "Version": "7.3.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/inflect-7.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.collections", "Identifier": { "PURL": "pkg:pypi/jaraco.collections@5.1.0", "UID": "b2e77b8a0b175ddd" }, "Version": "5.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.collections-5.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.context", "Identifier": { "PURL": "pkg:pypi/jaraco.context@5.3.0", "UID": "d6550b81e52efabe" }, "Version": "5.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.context-5.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.functools", "Identifier": { "PURL": "pkg:pypi/jaraco.functools@4.0.1", "UID": "f42118e4940a83a5" }, "Version": "4.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.functools-4.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.text", "Identifier": { "PURL": "pkg:pypi/jaraco.text@3.12.1", "UID": "cac1fcd2d9755e50" }, "Version": "3.12.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.text-3.12.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jiter", "Identifier": { "PURL": "pkg:pypi/jiter@0.12.0", "UID": "17b0ec2e903375ae" }, "Version": "0.12.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/jiter-0.12.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "more-itertools", "Identifier": { "PURL": "pkg:pypi/more-itertools@10.3.0", "UID": "cab6d07375997e08" }, "Version": "10.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/more_itertools-10.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "packaging", "Identifier": { "PURL": "pkg:pypi/packaging@24.2", "UID": "dd0943476d1773a8" }, "Version": "24.2", "Licenses": [ "Apache-2.0", "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/packaging-24.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pip", "Identifier": { "PURL": "pkg:pypi/pip@24.0", "UID": "7a4293168b845101" }, "Version": "24.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/pip-24.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "platformdirs", "Identifier": { "PURL": "pkg:pypi/platformdirs@4.2.2", "UID": "f93e5b8c438aeaf6" }, "Version": "4.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/platformdirs-4.2.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pydantic", "Identifier": { "PURL": "pkg:pypi/pydantic@2.9.2", "UID": "350c9066c00980e3" }, "Version": "2.9.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/pydantic-2.9.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pydantic_core", "Identifier": { "PURL": "pkg:pypi/pydantic-core@2.23.4", "UID": "f7a9dd9acc4ded02" }, "Version": "2.23.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/pydantic_core-2.23.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "python-dotenv", "Identifier": { "PURL": "pkg:pypi/python-dotenv@1.2.1", "UID": "31180a9d05b1c648" }, "Version": "1.2.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/python_dotenv-1.2.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "python-multipart", "Identifier": { "PURL": "pkg:pypi/python-multipart@0.0.12", "UID": "628a499cf2e1c4be" }, "Version": "0.0.12", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/python_multipart-0.0.12.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "requests", "Identifier": { "PURL": "pkg:pypi/requests@2.32.5", "UID": "ba8ae292d35eef79" }, "Version": "2.32.5", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/requests-2.32.5.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "setuptools", "Identifier": { "PURL": "pkg:pypi/setuptools@79.0.1", "UID": "a34f48aa76be299c" }, "Version": "79.0.1", "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools-79.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "sniffio", "Identifier": { "PURL": "pkg:pypi/sniffio@1.3.1", "UID": "5bd25cd9a1e6f91b" }, "Version": "1.3.1", "Licenses": [ "MIT", "Apache-2.0" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/sniffio-1.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "starlette", "Identifier": { "PURL": "pkg:pypi/starlette@0.38.6", "UID": "c7256b8e0a57c0a" }, "Version": "0.38.6", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/starlette-0.38.6.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tomli", "Identifier": { "PURL": "pkg:pypi/tomli@2.0.1", "UID": "53abaa0d00072d9e" }, "Version": "2.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/tomli-2.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typeguard", "Identifier": { "PURL": "pkg:pypi/typeguard@4.3.0", "UID": "f19abdf9377301a1" }, "Version": "4.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/typeguard-4.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typing_extensions", "Identifier": { "PURL": "pkg:pypi/typing-extensions@4.12.2", "UID": "4b1f19157aef399d" }, "Version": "4.12.2", "Licenses": [ "Python Software Foundation License" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/typing_extensions-4.12.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typing_extensions", "Identifier": { "PURL": "pkg:pypi/typing-extensions@4.15.0", "UID": "55087a215a93d447" }, "Version": "4.15.0", "Licenses": [ "PSF-2.0" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/typing_extensions-4.15.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "urllib3", "Identifier": { "PURL": "pkg:pypi/urllib3@2.5.0", "UID": "4e0361c130b7f5e0" }, "Version": "2.5.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/urllib3-2.5.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "uvicorn", "Identifier": { "PURL": "pkg:pypi/uvicorn@0.32.0", "UID": "cb24e3cb1e58f4e7" }, "Version": "0.32.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/uvicorn-0.32.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "uvloop", "Identifier": { "PURL": "pkg:pypi/uvloop@0.22.1", "UID": "5156339e3f16c007" }, "Version": "0.22.1", "Licenses": [ "Apache-2.0", "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/uvloop-0.22.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "watchfiles", "Identifier": { "PURL": "pkg:pypi/watchfiles@1.1.1", "UID": "6662c751acbcdf7e" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/watchfiles-1.1.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "websockets", "Identifier": { "PURL": "pkg:pypi/websockets@15.0.1", "UID": "86041fd8720b03f1" }, "Version": "15.0.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "FilePath": "usr/local/lib/python3.11/site-packages/websockets-15.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "wheel", "Identifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "68d1f5691b386b62" }, "Version": "0.45.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/wheel-0.45.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "wheel", "Identifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "588d1d5b79ef6155" }, "Version": "0.45.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/wheel-0.45.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "zipp", "Identifier": { "PURL": "pkg:pypi/zipp@3.19.2", "UID": "92d9047d0b817060" }, "Version": "3.19.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/zipp-3.19.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-63374", "VendorIDs": [ "GHSA-82r6-8w77-94w6" ], "PkgName": "anyio", "PkgPath": "usr/local/lib/python3.11/site-packages/anyio-4.11.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/anyio@4.11.0", "UID": "77fd5457aa5ae237" }, "InstalledVersion": "4.11.0", "FixedVersion": "4.14.2", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63374", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0bd4b8b4d01b2c1d0fdd19f5059f3e3d30623088bb544db5ee2d67f1c0093b0a", "Title": "anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding", "Description": "AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.", "Severity": "CRITICAL", "CweIDs": [ "CWE-295", "CWE-297" ], "VendorSeverity": { "ghsa": 4, "redhat": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 9.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63374", "https://advisory.echohq.com/cve/CVE-2026-63374", "https://github.com/advisories/GHSA-82r6-8w77-94w6", "https://github.com/agronholm/anyio", "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce", "https://github.com/agronholm/anyio/pull/1208", "https://github.com/agronholm/anyio/releases/tag/4.14.2", "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6", "https://nvd.nist.gov/vuln/detail/CVE-2026-63374", "https://www.cve.org/CVERecord?id=CVE-2026-63374" ], "PublishedDate": "2026-09-22T16:17:50.68Z", "LastModifiedDate": "2026-09-28T17:17:50.357Z" }, { "VulnerabilityID": "GHSA-6q48-6c7w-9gw2", "PkgName": "certifi", "PkgPath": "usr/local/lib/python3.11/site-packages/certifi-2025.11.12.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/certifi@2025.11.12", "UID": "23871ceadb6b3454" }, "InstalledVersion": "2025.11.12", "FixedVersion": "2026.10.18", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:80e6722b3367110208f02bc4b50474cc28cf7cfa29ae12a9efd92ea2e2b8b69a", "Title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "Description": "Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. \n\nAn attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer.\n\nCertifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.", "Severity": "CRITICAL", "VendorSeverity": { "ghsa": 4 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 9.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-6q48-6c7w-9gw2", "https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576", "https://emudhra.we-have-a-problem.com", "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "https://github.com/certifi/python-certifi", "https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2" ], "PublishedDate": "2026-10-20T19:35:05Z", "LastModifiedDate": "2026-10-26T16:02:12Z" }, { "VulnerabilityID": "CVE-2026-23949", "VendorIDs": [ "GHSA-58pv-8j8x-9vj2" ], "PkgName": "jaraco.context", "PkgPath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.context-5.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/jaraco.context@5.3.0", "UID": "d6550b81e52efabe" }, "InstalledVersion": "5.3.0", "FixedVersion": "6.1.0", "Status": "fixed", "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23949", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:31108ab66b191ddc843c350f18f0369da89e73a868e10bdba144fcaf05cd6908", "Title": "jaraco.context: jaraco.context: Path traversal via malicious tar archives", "Description": "jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23949", "https://advisory.echohq.com/cve/CVE-2026-23949", "https://github.com/jaraco/jaraco.context", "https://github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py#L74-L91", "https://github.com/jaraco/jaraco.context/commit/7b26a42b525735e4085d2e994e13802ea339d5f9", "https://github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2", "https://github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py#L55-L76", "https://nvd.nist.gov/vuln/detail/CVE-2026-23949", "https://ubuntu.com/security/notices/USN-7979-1", "https://www.cve.org/CVERecord?id=CVE-2026-23949" ], "PublishedDate": "2026-01-20T01:15:57.723Z", "LastModifiedDate": "2026-06-17T10:22:20.2Z" }, { "VulnerabilityID": "CVE-2024-53981", "VendorIDs": [ "GHSA-59g5-xgcq-4qw3" ], "PkgName": "python-multipart", "PkgPath": "usr/local/lib/python3.11/site-packages/python_multipart-0.0.12.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/python-multipart@0.0.12", "UID": "628a499cf2e1c4be" }, "InstalledVersion": "0.0.12", "FixedVersion": "0.0.18", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-53981", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:e7c2626e99c8d10e47639bc8c1f300231b0ad486a5519a84e9003bf61a678b8b", "Title": "python-multipart: python-multipart has a DoS via deformation `multipart/form-data` boundary", "Description": "python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \\r or LF \\n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed in 0.0.18.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-53981", "https://github.com/Kludex/python-multipart", "https://github.com/Kludex/python-multipart/commit/c4fe4d3cebc08c660e57dd709af1ffa7059b3177", "https://github.com/Kludex/python-multipart/commit/c4fe4d3cebc08c660e57dd709af1ffa7059b3177%20%280.0.19%29", "https://github.com/Kludex/python-multipart/security/advisories/GHSA-59g5-xgcq-4qw3", "https://nvd.nist.gov/vuln/detail/CVE-2024-53981", "https://ubuntu.com/security/notices/USN-8027-1", "https://www.cve.org/CVERecord?id=CVE-2024-53981" ], "PublishedDate": "2024-12-02T16:15:14.457Z", "LastModifiedDate": "2026-06-17T08:09:36.64Z" }, { "VulnerabilityID": "CVE-2026-24486", "VendorIDs": [ "GHSA-wp53-j4wj-2cfg" ], "PkgName": "python-multipart", "PkgPath": "usr/local/lib/python3.11/site-packages/python_multipart-0.0.12.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/python-multipart@0.0.12", "UID": "628a499cf2e1c4be" }, "InstalledVersion": "0.0.12", "FixedVersion": "0.0.22", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-24486", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:cd09b45c3298f36d19751446637613c0db49336947a1d1a3cedc6d9561d7ca61", "Title": "python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability", "Description": "Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "V3Score": 8.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:1504", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:44696", "https://access.redhat.com/errata/RHSA-2026:51357", "https://access.redhat.com/security/cve/CVE-2026-24486", "https://bugzilla.redhat.com/show_bug.cgi?id=2433132", "https://github.com/Kludex/python-multipart", "https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4", "https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4%20%280.0.22%29", "https://github.com/Kludex/python-multipart/releases/tag/0.0.22", "https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg", "https://nvd.nist.gov/vuln/detail/CVE-2026-24486", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24486.json", "https://ubuntu.com/security/notices/USN-8027-1", "https://www.cve.org/CVERecord?id=CVE-2026-24486" ], "PublishedDate": "2026-01-27T01:16:02.303Z", "LastModifiedDate": "2026-08-07T12:17:21.06Z" }, { "VulnerabilityID": "CVE-2026-42561", "VendorIDs": [ "GHSA-pp6c-gr5w-3c5g" ], "PkgName": "python-multipart", "PkgPath": "usr/local/lib/python3.11/site-packages/python_multipart-0.0.12.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/python-multipart@0.0.12", "UID": "628a499cf2e1c4be" }, "InstalledVersion": "0.0.12", "FixedVersion": "0.0.27", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42561", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:e8aec135f707004ecc207ed71851dc1f9516945adbdfbc69b714faebcb01d345", "Title": "python-multipart: python-multipart: Denial of Service via excessive multipart part headers", "Description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-606" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:44696", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51219", "https://access.redhat.com/errata/RHSA-2026:51357", "https://access.redhat.com/security/cve/CVE-2026-42561", "https://advisory.echohq.com/cve/CVE-2026-42561", "https://bugzilla.redhat.com/show_bug.cgi?id=2477309", "https://github.com/Kludex/python-multipart", "https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g", "https://nvd.nist.gov/vuln/detail/CVE-2026-42561", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42561.json", "https://www.cve.org/CVERecord?id=CVE-2026-42561" ], "PublishedDate": "2026-05-13T21:16:47.07Z", "LastModifiedDate": "2026-10-26T14:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-53539", "VendorIDs": [ "GHSA-5rvq-cxj2-64vf" ], "PkgName": "python-multipart", "PkgPath": "usr/local/lib/python3.11/site-packages/python_multipart-0.0.12.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/python-multipart@0.0.12", "UID": "628a499cf2e1c4be" }, "InstalledVersion": "0.0.12", "FixedVersion": "0.0.30", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53539", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:3bb2e5a75fefe9fe10c3aaf1dc391063559ae99745a2625384bf586705ad812a", "Title": "python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies", "Description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for \u0026, and only when no \u0026 existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no \u0026, every field iteration performed a full failed \u0026 scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-407" ], "VendorSeverity": { "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-53539", "https://advisory.echohq.com/cve/CVE-2026-53539", "https://github.com/Kludex/python-multipart", "https://github.com/Kludex/python-multipart/security/advisories/GHSA-5rvq-cxj2-64vf", "https://nvd.nist.gov/vuln/detail/CVE-2026-53539", "https://www.cve.org/CVERecord?id=CVE-2026-53539" ], "PublishedDate": "2026-06-22T18:16:44.36Z", "LastModifiedDate": "2026-10-25T23:10:00.167Z" }, { "VulnerabilityID": "CVE-2024-47874", "VendorIDs": [ "GHSA-f96h-pmfr-66vw" ], "PkgName": "starlette", "PkgPath": "usr/local/lib/python3.11/site-packages/starlette-0.38.6.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/starlette@0.38.6", "UID": "c7256b8e0a57c0a" }, "InstalledVersion": "0.38.6", "FixedVersion": "0.40.0", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-47874", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:86cf3850ef30841070b2b4d6bfbd31199a0018b93fae211d5ef2324b4195ed21", "Title": "starlette: Starlette Denial of service (DoS) via multipart/form-data", "Description": "Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treats `multipart/form-data` parts without a `filename` as text form fields and buffers those in byte strings with no size limit. This allows an attacker to upload arbitrary large form fields and cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt, or the OS terminates the server process with an OOM error. Uploading multiple such requests in parallel may be enough to render a service practically unusable, even if reasonable request size limits are enforced by a reverse proxy in front of Starlette. This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) accepting form requests. Verison 0.40.0 fixes this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-47874", "https://github.com/encode/starlette", "https://github.com/encode/starlette/commit/fd038f3070c302bff17ef7d173dbb0b007617733", "https://github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw", "https://nvd.nist.gov/vuln/detail/CVE-2024-47874", "https://www.cve.org/CVERecord?id=CVE-2024-47874" ], "PublishedDate": "2024-10-15T16:15:05.26Z", "LastModifiedDate": "2026-06-17T07:57:53.817Z" }, { "VulnerabilityID": "CVE-2026-48818", "VendorIDs": [ "GHSA-wqp7-x3pw-xc5r" ], "PkgName": "starlette", "PkgPath": "usr/local/lib/python3.11/site-packages/starlette-0.38.6.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/starlette@0.38.6", "UID": "c7256b8e0a57c0a" }, "InstalledVersion": "0.38.6", "FixedVersion": "1.1.0", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48818", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:d98092304fa03273501fb9306d8d2f8bb10c17997ffad68416c7f77b974b6e52", "Title": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows", "Description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.", "Severity": "HIGH", "CweIDs": [ "CWE-918" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/security/cve/CVE-2026-48818", "https://advisory.echohq.com/cve/CVE-2026-48818", "https://bugzilla.redhat.com/show_bug.cgi?id=2490020", "https://github.com/Kludex/starlette", "https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5", "https://github.com/Kludex/starlette/pull/3287", "https://github.com/Kludex/starlette/releases/tag/1.1.0", "https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r", "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-2281.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-48818", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48818.json", "https://www.cve.org/CVERecord?id=CVE-2026-48818" ], "PublishedDate": "2026-06-17T19:18:09.807Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-54283", "VendorIDs": [ "GHSA-82w8-qh3p-5jfq" ], "PkgName": "starlette", "PkgPath": "usr/local/lib/python3.11/site-packages/starlette-0.38.6.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/starlette@0.38.6", "UID": "c7256b8e0a57c0a" }, "InstalledVersion": "0.38.6", "FixedVersion": "1.3.1", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54283", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:f7a12a7205a60ebd9feb264947618c3f12c5aabe1c429ad72cf4c003392dfcf4", "Title": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS", "Description": "Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-54283", "https://advisory.echohq.com/cve/CVE-2026-54283", "https://github.com/Kludex/starlette", "https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq", "https://nvd.nist.gov/vuln/detail/CVE-2026-54283", "https://www.cve.org/CVERecord?id=CVE-2026-54283" ], "PublishedDate": "2026-06-22T18:16:46.943Z", "LastModifiedDate": "2026-10-25T23:10:00.167Z" }, { "VulnerabilityID": "CVE-2025-66418", "VendorIDs": [ "GHSA-gm62-xv2j-4w53" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.5.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.5.0", "UID": "4e0361c130b7f5e0" }, "InstalledVersion": "2.5.0", "FixedVersion": "2.6.0", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-66418", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:fc5d8db9a2c92906186da9208e024387e6e5978b1735bd0e517e17d04426d3ec", "Title": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion", "Description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "cbl-mariner": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "V40Score": 8.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1087", "https://access.redhat.com/errata/RHSA-2026:1239", "https://access.redhat.com/security/cve/CVE-2025-66418", "https://advisory.echohq.com/cve/CVE-2025-66418", "https://bugzilla.redhat.com/2419455", "https://bugzilla.redhat.com/2419467", "https://bugzilla.redhat.com/2427726", "https://bugzilla.redhat.com/show_bug.cgi?id=2419455", "https://bugzilla.redhat.com/show_bug.cgi?id=2419467", "https://bugzilla.redhat.com/show_bug.cgi?id=2427726", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66471", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21441", "https://errata.almalinux.org/9/ALSA-2026-1239.html", "https://errata.rockylinux.org/RLSA-2026:1087", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8", "https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53", "https://linux.oracle.com/cve/CVE-2025-66418.html", "https://linux.oracle.com/errata/ELSA-2026-1254.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-66418", "https://ubuntu.com/security/notices/USN-7927-1", "https://ubuntu.com/security/notices/USN-8010-1", "https://ubuntu.com/security/notices/USN-8344-1", "https://www.cve.org/CVERecord?id=CVE-2025-66418", "https://www.openwall.com/lists/oss-security/2025/12/05/4" ], "PublishedDate": "2025-12-05T16:15:51.053Z", "LastModifiedDate": "2026-09-25T23:10:00.463Z" }, { "VulnerabilityID": "CVE-2025-66471", "VendorIDs": [ "GHSA-2xpw-w6gg-jr37" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.5.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.5.0", "UID": "4e0361c130b7f5e0" }, "InstalledVersion": "2.5.0", "FixedVersion": "2.6.0", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-66471", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0aaaadcffed3c300e04da0c1f76c408d1eeea0c39bd39180039786b3bc794562", "Title": "urllib3: urllib3 Streaming API improperly handles highly compressed data", "Description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.", "Severity": "HIGH", "CweIDs": [ "CWE-409" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "cbl-mariner": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "V40Score": 8.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1087", "https://access.redhat.com/errata/RHSA-2026:1239", "https://access.redhat.com/security/cve/CVE-2025-66471", "https://advisory.echohq.com/cve/CVE-2025-66471", "https://bugzilla.redhat.com/2419455", "https://bugzilla.redhat.com/2419467", "https://bugzilla.redhat.com/2427726", "https://bugzilla.redhat.com/show_bug.cgi?id=2419455", "https://bugzilla.redhat.com/show_bug.cgi?id=2419467", "https://bugzilla.redhat.com/show_bug.cgi?id=2427726", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66471", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21441", "https://errata.almalinux.org/9/ALSA-2026-1239.html", "https://errata.rockylinux.org/RLSA-2026:1087", "https://github.com/advisories/GHSA-2xpw-w6gg-jr37", "https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-1994.yaml", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7", "https://github.com/urllib3/urllib3/commit/d0fde3672e4a4093f7587858dccfc298eb66e46c", "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37", "https://linux.oracle.com/cve/CVE-2025-66471.html", "https://linux.oracle.com/errata/ELSA-2026-9031.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-66471", "https://pypi.org/project/urllib3", "https://ubuntu.com/security/notices/USN-7927-1", "https://ubuntu.com/security/notices/USN-7927-2", "https://ubuntu.com/security/notices/USN-7927-3", "https://ubuntu.com/security/notices/USN-8344-1", "https://ubuntu.com/security/notices/USN-8344-2", "https://ubuntu.com/security/notices/USN-8344-3", "https://www.cve.org/CVERecord?id=CVE-2025-66471", "https://www.openwall.com/lists/oss-security/2025/12/05/4" ], "PublishedDate": "2025-12-05T17:16:04.4Z", "LastModifiedDate": "2026-09-25T23:10:00.463Z" }, { "VulnerabilityID": "CVE-2026-21441", "VendorIDs": [ "GHSA-38jv-5279-wg99" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.5.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.5.0", "UID": "4e0361c130b7f5e0" }, "InstalledVersion": "2.5.0", "FixedVersion": "2.6.3", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-21441", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:f309381d479c7ea32737355f596a21d18d8346e905cdb6d2d64a980550dad38b", "Title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)", "Description": "urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.", "Severity": "HIGH", "CweIDs": [ "CWE-409" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "cbl-mariner": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "V3Score": 7.5, "V40Score": 8.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:0981", "https://access.redhat.com/errata/RHSA-2026:0990", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:1038", "https://access.redhat.com/errata/RHSA-2026:1041", "https://access.redhat.com/errata/RHSA-2026:1042", "https://access.redhat.com/errata/RHSA-2026:1086", "https://access.redhat.com/errata/RHSA-2026:1087", "https://access.redhat.com/errata/RHSA-2026:1088", "https://access.redhat.com/errata/RHSA-2026:1089", "https://access.redhat.com/errata/RHSA-2026:1166", "https://access.redhat.com/errata/RHSA-2026:1168", "https://access.redhat.com/errata/RHSA-2026:1176", "https://access.redhat.com/errata/RHSA-2026:1224", "https://access.redhat.com/errata/RHSA-2026:1226", "https://access.redhat.com/errata/RHSA-2026:1239", "https://access.redhat.com/errata/RHSA-2026:1240", "https://access.redhat.com/errata/RHSA-2026:1241", "https://access.redhat.com/errata/RHSA-2026:1254", "https://access.redhat.com/errata/RHSA-2026:1485", "https://access.redhat.com/errata/RHSA-2026:14877", "https://access.redhat.com/errata/RHSA-2026:1504", "https://access.redhat.com/errata/RHSA-2026:1546", "https://access.redhat.com/errata/RHSA-2026:1596", "https://access.redhat.com/errata/RHSA-2026:1599", "https://access.redhat.com/errata/RHSA-2026:1609", "https://access.redhat.com/errata/RHSA-2026:1618", "https://access.redhat.com/errata/RHSA-2026:1619", "https://access.redhat.com/errata/RHSA-2026:1652", "https://access.redhat.com/errata/RHSA-2026:1674", "https://access.redhat.com/errata/RHSA-2026:1676", "https://access.redhat.com/errata/RHSA-2026:1693", "https://access.redhat.com/errata/RHSA-2026:1704", "https://access.redhat.com/errata/RHSA-2026:1706", "https://access.redhat.com/errata/RHSA-2026:1712", "https://access.redhat.com/errata/RHSA-2026:1717", "https://access.redhat.com/errata/RHSA-2026:1726", "https://access.redhat.com/errata/RHSA-2026:1729", "https://access.redhat.com/errata/RHSA-2026:1730", "https://access.redhat.com/errata/RHSA-2026:1734", "https://access.redhat.com/errata/RHSA-2026:1735", "https://access.redhat.com/errata/RHSA-2026:1736", "https://access.redhat.com/errata/RHSA-2026:17456", "https://access.redhat.com/errata/RHSA-2026:17457", "https://access.redhat.com/errata/RHSA-2026:17460", "https://access.redhat.com/errata/RHSA-2026:17461", "https://access.redhat.com/errata/RHSA-2026:17462", "https://access.redhat.com/errata/RHSA-2026:17463", "https://access.redhat.com/errata/RHSA-2026:1791", "https://access.redhat.com/errata/RHSA-2026:1792", "https://access.redhat.com/errata/RHSA-2026:1793", "https://access.redhat.com/errata/RHSA-2026:1794", "https://access.redhat.com/errata/RHSA-2026:1803", "https://access.redhat.com/errata/RHSA-2026:1805", "https://access.redhat.com/errata/RHSA-2026:1942", "https://access.redhat.com/errata/RHSA-2026:1957", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:2106", "https://access.redhat.com/errata/RHSA-2026:2126", "https://access.redhat.com/errata/RHSA-2026:2137", "https://access.redhat.com/errata/RHSA-2026:2139", "https://access.redhat.com/errata/RHSA-2026:2144", "https://access.redhat.com/errata/RHSA-2026:2256", "https://access.redhat.com/errata/RHSA-2026:2456", "https://access.redhat.com/errata/RHSA-2026:2500", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2695", "https://access.redhat.com/errata/RHSA-2026:2717", "https://access.redhat.com/errata/RHSA-2026:2718", "https://access.redhat.com/errata/RHSA-2026:2723", "https://access.redhat.com/errata/RHSA-2026:2728", "https://access.redhat.com/errata/RHSA-2026:2760", "https://access.redhat.com/errata/RHSA-2026:2762", "https://access.redhat.com/errata/RHSA-2026:2764", "https://access.redhat.com/errata/RHSA-2026:2765", "https://access.redhat.com/errata/RHSA-2026:28043", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:2900", "https://access.redhat.com/errata/RHSA-2026:2911", "https://access.redhat.com/errata/RHSA-2026:2919", "https://access.redhat.com/errata/RHSA-2026:2924", "https://access.redhat.com/errata/RHSA-2026:2925", "https://access.redhat.com/errata/RHSA-2026:2926", "https://access.redhat.com/errata/RHSA-2026:3296", "https://access.redhat.com/errata/RHSA-2026:33154", "https://access.redhat.com/errata/RHSA-2026:3406", "https://access.redhat.com/errata/RHSA-2026:3444", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3869", "https://access.redhat.com/errata/RHSA-2026:3874", "https://access.redhat.com/errata/RHSA-2026:3884", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:4185", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:4215", "https://access.redhat.com/errata/RHSA-2026:4271", "https://access.redhat.com/errata/RHSA-2026:4466", "https://access.redhat.com/errata/RHSA-2026:4467", "https://access.redhat.com/errata/RHSA-2026:44696", "https://access.redhat.com/errata/RHSA-2026:51357", "https://access.redhat.com/errata/RHSA-2026:5459", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:6287", "https://access.redhat.com/errata/RHSA-2026:6292", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8500", "https://access.redhat.com/errata/RHSA-2026:8501", "https://access.redhat.com/security/cve/CVE-2026-21441", "https://advisory.echohq.com/cve/CVE-2026-21441", "https://bugzilla.redhat.com/2419455", "https://bugzilla.redhat.com/2419467", "https://bugzilla.redhat.com/2427726", "https://bugzilla.redhat.com/show_bug.cgi?id=2419455", "https://bugzilla.redhat.com/show_bug.cgi?id=2419467", "https://bugzilla.redhat.com/show_bug.cgi?id=2427726", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66471", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21441", "https://errata.almalinux.org/9/ALSA-2026-1239.html", "https://errata.rockylinux.org/RLSA-2026:1087", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b", "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99", "https://linux.oracle.com/cve/CVE-2026-21441.html", "https://linux.oracle.com/errata/ELSA-2026-1254.html", "https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-21441", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21441.json", "https://ubuntu.com/security/notices/USN-7955-1", "https://ubuntu.com/security/notices/USN-7955-2", "https://ubuntu.com/security/notices/USN-8010-1", "https://www.cve.org/CVERecord?id=CVE-2026-21441" ], "PublishedDate": "2026-01-07T22:15:44.04Z", "LastModifiedDate": "2026-09-15T12:16:58.133Z" }, { "VulnerabilityID": "CVE-2026-44431", "VendorIDs": [ "GHSA-qccp-gfcp-xxvc" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.5.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.5.0", "UID": "4e0361c130b7f5e0" }, "InstalledVersion": "2.5.0", "FixedVersion": "2.7.0", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44431", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:6eb11122b1dd54173d1ad55afd2fb6b538581067e9063a950915c021f4b2186a", "Title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers", "Description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.", "Severity": "HIGH", "CweIDs": [ "CWE-200" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "ghsa": 3, "nvd": 2, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V3Score": 5.3, "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:28158", "https://access.redhat.com/errata/RHSA-2026:28159", "https://access.redhat.com/security/cve/CVE-2026-44431", "https://advisory.echohq.com/cve/CVE-2026-44431", "https://bugzilla.redhat.com/2477154", "https://bugzilla.redhat.com/2477167", "https://bugzilla.redhat.com/show_bug.cgi?id=2477154", "https://bugzilla.redhat.com/show_bug.cgi?id=2477167", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44431", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44432", "https://errata.almalinux.org/9/ALSA-2026-28159.html", "https://errata.rockylinux.org/RLSA-2026:28158", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc", "https://linux.oracle.com/cve/CVE-2026-44431.html", "https://linux.oracle.com/errata/ELSA-2026-49927.html", "https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-44431", "https://ubuntu.com/security/notices/USN-8379-1", "https://ubuntu.com/security/notices/USN-8811-1", "https://www.cve.org/CVERecord?id=CVE-2026-44431" ], "PublishedDate": "2026-05-13T16:16:57.15Z", "LastModifiedDate": "2026-06-26T12:16:32.423Z" }, { "VulnerabilityID": "CVE-2026-97687", "VendorIDs": [ "GHSA-8988-9cw3-xx77" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.5.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.5.0", "UID": "4e0361c130b7f5e0" }, "InstalledVersion": "2.5.0", "FixedVersion": "2.8.0", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97687", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0a35faff4ec84b58ddf622ffa273c3d2a059db9845cada0317d6df1d4c153cfb", "Title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override", "Description": "urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-440" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 7.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90494", "https://access.redhat.com/security/cve/CVE-2026-97687", "https://advisory.echohq.com/cve/CVE-2026-97687", "https://bugzilla.redhat.com/2543245", "https://bugzilla.redhat.com/2543255", "https://bugzilla.redhat.com/show_bug.cgi?id=2543245", "https://bugzilla.redhat.com/show_bug.cgi?id=2543255", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97687", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97689", "https://errata.almalinux.org/9/ALSA-2026-90494.html", "https://errata.rockylinux.org/RLSA-2026:90494", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465", "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3", "https://github.com/urllib3/urllib3/pull/5093", "https://github.com/urllib3/urllib3/releases/tag/2.8.0", "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77", "https://linux.oracle.com/cve/CVE-2026-97687.html", "https://linux.oracle.com/errata/ELSA-2026-92474.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97687", "https://ubuntu.com/security/notices/USN-8926-1", "https://www.cve.org/CVERecord?id=CVE-2026-97687" ], "PublishedDate": "2026-09-29T16:17:18.517Z", "LastModifiedDate": "2026-10-13T20:27:23.13Z" }, { "VulnerabilityID": "CVE-2026-97689", "VendorIDs": [ "GHSA-vxq7-64xx-v4gw" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.5.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.5.0", "UID": "4e0361c130b7f5e0" }, "InstalledVersion": "2.5.0", "FixedVersion": "2.8.0", "Status": "fixed", "Layer": { "DiffID": "sha256:905b90167e88a010484ef6b046b8d4c5a1c948f21e896a047330a74a3028d8d3" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97689", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:49b04bde9c872031725bfba00e173ac36dfeadbc20f44c32d9b0bb174e106971", "Title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser", "Description": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "V40Score": 8.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90494", "https://access.redhat.com/security/cve/CVE-2026-97689", "https://advisory.echohq.com/cve/CVE-2026-97689", "https://bugzilla.redhat.com/2543245", "https://bugzilla.redhat.com/2543255", "https://bugzilla.redhat.com/show_bug.cgi?id=2543245", "https://bugzilla.redhat.com/show_bug.cgi?id=2543255", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97687", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97689", "https://errata.almalinux.org/9/ALSA-2026-90494.html", "https://errata.rockylinux.org/RLSA-2026:90494", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed", "https://github.com/urllib3/urllib3/releases/tag/2.8.0", "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw", "https://linux.oracle.com/cve/CVE-2026-97689.html", "https://linux.oracle.com/errata/ELSA-2026-92474.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97689", "https://ubuntu.com/security/notices/USN-8926-1", "https://www.cve.org/CVERecord?id=CVE-2026-97689" ], "PublishedDate": "2026-09-29T16:17:18.837Z", "LastModifiedDate": "2026-10-13T20:20:06.95Z" }, { "VulnerabilityID": "CVE-2026-24049", "VendorIDs": [ "GHSA-8rrh-rw8j-w5fx" ], "PkgName": "wheel", "PkgPath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/wheel-0.45.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "68d1f5691b386b62" }, "InstalledVersion": "0.45.1", "FixedVersion": "0.46.2", "Status": "fixed", "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-24049", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:76084c84af8894c618b874981354471466aba3bae337207e3d68296666f4affb", "Title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking", "Description": "wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.", "Severity": "HIGH", "CweIDs": [ "CWE-22", "CWE-732" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "ghsa": 3, "nvd": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:1504", "https://access.redhat.com/errata/RHSA-2026:17599", "https://access.redhat.com/errata/RHSA-2026:1902", "https://access.redhat.com/errata/RHSA-2026:1939", "https://access.redhat.com/errata/RHSA-2026:1942", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20089", "https://access.redhat.com/errata/RHSA-2026:2090", "https://access.redhat.com/errata/RHSA-2026:2106", "https://access.redhat.com/errata/RHSA-2026:2139", "https://access.redhat.com/errata/RHSA-2026:2675", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2694", "https://access.redhat.com/errata/RHSA-2026:2695", "https://access.redhat.com/errata/RHSA-2026:2710", "https://access.redhat.com/errata/RHSA-2026:2754", "https://access.redhat.com/errata/RHSA-2026:2762", "https://access.redhat.com/errata/RHSA-2026:2823", "https://access.redhat.com/errata/RHSA-2026:2865", "https://access.redhat.com/errata/RHSA-2026:2866", "https://access.redhat.com/errata/RHSA-2026:2900", "https://access.redhat.com/errata/RHSA-2026:2925", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3958", "https://access.redhat.com/errata/RHSA-2026:3959", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:4185", "https://access.redhat.com/errata/RHSA-2026:4215", "https://access.redhat.com/errata/RHSA-2026:4271", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:5119", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:6192", "https://access.redhat.com/errata/RHSA-2026:62115", "https://access.redhat.com/errata/RHSA-2026:6555", "https://access.redhat.com/errata/RHSA-2026:6562", "https://access.redhat.com/errata/RHSA-2026:6565", "https://access.redhat.com/errata/RHSA-2026:7250", "https://access.redhat.com/security/cve/CVE-2026-24049", "https://advisory.echohq.com/cve/CVE-2026-24049", "https://bugzilla.redhat.com/2431959", "https://bugzilla.redhat.com/show_bug.cgi?id=2431959", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24049", "https://errata.almalinux.org/9/ALSA-2026-1939.html", "https://errata.rockylinux.org/RLSA-2026:1939", "https://github.com/pypa/wheel", "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef", "https://github.com/pypa/wheel/commit/934fe177ff912c8e03d5ae951d3805e1fd90ba5e", "https://github.com/pypa/wheel/releases/tag/0.46.2", "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx", "https://linux.oracle.com/cve/CVE-2026-24049.html", "https://linux.oracle.com/errata/ELSA-2026-2090.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-24049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24049.json", "https://ubuntu.com/security/notices/USN-8221-1", "https://www.cve.org/CVERecord?id=CVE-2026-24049" ], "PublishedDate": "2026-01-22T05:16:23.157Z", "LastModifiedDate": "2026-09-10T13:17:45.017Z" }, { "VulnerabilityID": "CVE-2026-24049", "VendorIDs": [ "GHSA-8rrh-rw8j-w5fx" ], "PkgName": "wheel", "PkgPath": "usr/local/lib/python3.11/site-packages/wheel-0.45.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "588d1d5b79ef6155" }, "InstalledVersion": "0.45.1", "FixedVersion": "0.46.2", "Status": "fixed", "Layer": { "DiffID": "sha256:cdd505bd8879cc44acac7f3dbfcc4adef811a8a2996d790ce0dfdea3159800cd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-24049", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:76084c84af8894c618b874981354471466aba3bae337207e3d68296666f4affb", "Title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking", "Description": "wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.", "Severity": "HIGH", "CweIDs": [ "CWE-22", "CWE-732" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "ghsa": 3, "nvd": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:1504", "https://access.redhat.com/errata/RHSA-2026:17599", "https://access.redhat.com/errata/RHSA-2026:1902", "https://access.redhat.com/errata/RHSA-2026:1939", "https://access.redhat.com/errata/RHSA-2026:1942", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20089", "https://access.redhat.com/errata/RHSA-2026:2090", "https://access.redhat.com/errata/RHSA-2026:2106", "https://access.redhat.com/errata/RHSA-2026:2139", "https://access.redhat.com/errata/RHSA-2026:2675", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2694", "https://access.redhat.com/errata/RHSA-2026:2695", "https://access.redhat.com/errata/RHSA-2026:2710", "https://access.redhat.com/errata/RHSA-2026:2754", "https://access.redhat.com/errata/RHSA-2026:2762", "https://access.redhat.com/errata/RHSA-2026:2823", "https://access.redhat.com/errata/RHSA-2026:2865", "https://access.redhat.com/errata/RHSA-2026:2866", "https://access.redhat.com/errata/RHSA-2026:2900", "https://access.redhat.com/errata/RHSA-2026:2925", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3958", "https://access.redhat.com/errata/RHSA-2026:3959", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:4185", "https://access.redhat.com/errata/RHSA-2026:4215", "https://access.redhat.com/errata/RHSA-2026:4271", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:5119", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:6192", "https://access.redhat.com/errata/RHSA-2026:62115", "https://access.redhat.com/errata/RHSA-2026:6555", "https://access.redhat.com/errata/RHSA-2026:6562", "https://access.redhat.com/errata/RHSA-2026:6565", "https://access.redhat.com/errata/RHSA-2026:7250", "https://access.redhat.com/security/cve/CVE-2026-24049", "https://advisory.echohq.com/cve/CVE-2026-24049", "https://bugzilla.redhat.com/2431959", "https://bugzilla.redhat.com/show_bug.cgi?id=2431959", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24049", "https://errata.almalinux.org/9/ALSA-2026-1939.html", "https://errata.rockylinux.org/RLSA-2026:1939", "https://github.com/pypa/wheel", "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef", "https://github.com/pypa/wheel/commit/934fe177ff912c8e03d5ae951d3805e1fd90ba5e", "https://github.com/pypa/wheel/releases/tag/0.46.2", "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx", "https://linux.oracle.com/cve/CVE-2026-24049.html", "https://linux.oracle.com/errata/ELSA-2026-2090.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-24049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24049.json", "https://ubuntu.com/security/notices/USN-8221-1", "https://www.cve.org/CVERecord?id=CVE-2026-24049" ], "PublishedDate": "2026-01-22T05:16:23.157Z", "LastModifiedDate": "2026-09-10T13:17:45.017Z" } ] } ] }