{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b91c-6ee4-7706-9601-1f87312150a4", "CreatedAt": "2026-11-08T04:03:30.788462805+01:00", "ArtifactID": "sha256:b20d27d108dbada9981f5b60bb13289fa748b7d1c779f8c39b44ef10f7dcdc31", "ArtifactName": "traefik-stack-sn-metrics-collector", "ArtifactType": "container_image", "Metadata": { "Size": 157343744, "OS": { "Family": "debian", "Name": "13.5" }, "ImageID": "sha256:0ad9b8c43525e61e95467c32fae41993e67e76de20432d32ae477568f6061ef0", "DiffIDs": [ "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40", "sha256:ae0096d57d7f18e7861848f1103983488102f78517c11444120d8a938884de54", "sha256:c529e1b2553946dcc9afa2d77e33a75f23d3702e0b4a7911b67e2f1fe45a4939", "sha256:6872606a6b819a8348189e0d99b8e730aa74d558c158d96f1dd2406a7c6baaf7", "sha256:9c57f6cface5b93a640b5db0ed32e1500e95ea49f2a4dcf367382bf56b365ae7", "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d", "sha256:65ca543362c7f07dd287aff2ea8b022d364764c986f0efddce6012bd599e9bbf", "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b", "sha256:3b14713b425fb3dc42e9c9ae696f82a223455627bea4af57bd0693fec339d7a7" ], "RepoTags": [ "traefik-stack-sn-metrics-collector:latest" ], "Reference": "traefik-stack-sn-metrics-collector:latest", "ImageConfig": { "architecture": "amd64", "created": "2026-06-08T11:44:16.512125782Z", "history": [ { "created": "2026-05-18T00:00:00Z", "created_by": "# debian.sh --arch 'amd64' out/ 'trixie' '@1779062400'", "comment": "debuerreotype 0.17" }, { "created": "2026-05-19T23:42:40Z", "created_by": "ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-19T23:42:40Z", "created_by": "ENV LANG=C.UTF-8", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-19T23:42:40Z", "created_by": "RUN /bin/sh -c set -eux; \tapt-get update; \tapt-get install -y --no-install-recommends \t\tca-certificates \t\tnetbase \t\ttzdata \t; \tapt-get dist-clean # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-19T23:42:40Z", "created_by": "ENV GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-19T23:42:40Z", "created_by": "ENV PYTHON_VERSION=3.12.13", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-19T23:42:40Z", "created_by": "ENV PYTHON_SHA256=c08bc65a81971c1dd5783182826503369466c7e67374d1646519adf05207b684", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-19T23:50:55Z", "created_by": "RUN /bin/sh -c set -eux; \t\tsavedAptMark=\"$(apt-mark showmanual)\"; \tapt-get update; \tapt-get install -y --no-install-recommends \t\tdpkg-dev \t\tgcc \t\tgnupg \t\tlibbluetooth-dev \t\tlibbz2-dev \t\tlibc6-dev \t\tlibdb-dev \t\tlibffi-dev \t\tlibgdbm-dev \t\tliblzma-dev \t\tlibncursesw5-dev \t\tlibreadline-dev \t\tlibsqlite3-dev \t\tlibssl-dev \t\tmake \t\ttk-dev \t\tuuid-dev \t\twget \t\txz-utils \t\tzlib1g-dev \t; \t\twget -O python.tar.xz \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz\"; \techo \"$PYTHON_SHA256 *python.tar.xz\" | sha256sum -c -; \twget -O python.tar.xz.asc \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc\"; \tGNUPGHOME=\"$(mktemp -d)\"; export GNUPGHOME; \tgpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$GPG_KEY\"; \tgpg --batch --verify python.tar.xz.asc python.tar.xz; \tgpgconf --kill all; \trm -rf \"$GNUPGHOME\" python.tar.xz.asc; \tmkdir -p /usr/src/python; \ttar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; \trm python.tar.xz; \t\tcd /usr/src/python; \tgnuArch=\"$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)\"; \t./configure \t\t--build=\"$gnuArch\" \t\t--enable-loadable-sqlite-extensions \t\t--enable-optimizations \t\t--enable-option-checking=fatal \t\t--enable-shared \t\t$(test \"${gnuArch%%-*}\" != 'riscv64' \u0026\u0026 echo '--with-lto') \t\t--with-ensurepip \t; \tnproc=\"$(nproc)\"; \tEXTRA_CFLAGS=\"$(dpkg-buildflags --get CFLAGS)\"; \tLDFLAGS=\"$(dpkg-buildflags --get LDFLAGS)\"; \tLDFLAGS=\"${LDFLAGS:-} -Wl,--strip-all\"; \tarch=\"$(dpkg --print-architecture)\"; arch=\"${arch##*-}\"; \tcase \"$arch\" in \t\tamd64|arm64) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer\"; \t\t\t;; \t\ti386) \t\t\t;; \t\t*) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer\"; \t\t\t;; \tesac; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-}\" \t; \trm python; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\\$\\$ORIGIN/../lib'\" \t\tpython \t; \tmake install; \t\tcd /; \trm -rf /usr/src/python; \t\tfind /usr/local -depth \t\t\\( \t\t\t\\( -type d -a \\( -name test -o -name tests -o -name idle_test \\) \\) \t\t\t-o \\( -type f -a \\( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \\) \\) \t\t\\) -exec rm -rf '{}' + \t; \t\tldconfig; \t\tapt-mark auto '.*' \u003e /dev/null; \tapt-mark manual $savedAptMark; \tfind /usr/local -type f -executable -not \\( -name '*tkinter*' \\) -exec ldd '{}' ';' \t\t| awk '/=\u003e/ { so = $(NF-1); if (index(so, \"/usr/local/\") == 1) { next }; gsub(\"^/(usr/)?\", \"\", so); printf \"*%s\\n\", so }' \t\t| sort -u \t\t| xargs -rt dpkg-query --search \t\t| awk 'sub(\":$\", \"\", $1) { print $1 }' \t\t| sort -u \t\t| xargs -r apt-mark manual \t; \tapt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \tapt-get dist-clean; \t\texport PYTHONDONTWRITEBYTECODE=1; \tpython3 --version; \tpip3 --version # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-19T23:50:55Z", "created_by": "RUN /bin/sh -c set -eux; \tfor src in idle3 pip3 pydoc3 python3 python3-config; do \t\tdst=\"$(echo \"$src\" | tr -d 3)\"; \t\t[ -s \"/usr/local/bin/$src\" ]; \t\t[ ! -e \"/usr/local/bin/$dst\" ]; \t\tln -svT \"$src\" \"/usr/local/bin/$dst\"; \tdone # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-19T23:50:55Z", "created_by": "CMD [\"python3\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-08T11:44:09Z", "created_by": "ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 PIP_NO_CACHE_DIR=1 TZ=Europe/Bratislava", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-08T11:44:09Z", "created_by": "WORKDIR /app", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-08T11:44:13Z", "created_by": "RUN /bin/sh -c apt-get update \u0026\u0026 apt-get install -y --no-install-recommends tzdata curl ca-certificates \u0026\u0026 rm -rf /var/lib/apt/lists/* # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-08T11:44:13Z", "created_by": "COPY requirements.txt . # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-08T11:44:16Z", "created_by": "RUN /bin/sh -c pip install --no-cache-dir -r requirements.txt # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-08T11:44:16Z", "created_by": "COPY src/ /app/src/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-08T11:44:16Z", "created_by": "ENV PYTHONPATH=/app", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-08T11:44:16Z", "created_by": "CMD [\"python\" \"-m\" \"src.main\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40", "sha256:ae0096d57d7f18e7861848f1103983488102f78517c11444120d8a938884de54", "sha256:c529e1b2553946dcc9afa2d77e33a75f23d3702e0b4a7911b67e2f1fe45a4939", "sha256:6872606a6b819a8348189e0d99b8e730aa74d558c158d96f1dd2406a7c6baaf7", "sha256:9c57f6cface5b93a640b5db0ed32e1500e95ea49f2a4dcf367382bf56b365ae7", "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d", "sha256:65ca543362c7f07dd287aff2ea8b022d364764c986f0efddce6012bd599e9bbf", "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b", "sha256:3b14713b425fb3dc42e9c9ae696f82a223455627bea4af57bd0693fec339d7a7" ] }, "config": { "Cmd": [ "python", "-m", "src.main" ], "Env": [ "PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "LANG=C.UTF-8", "GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", "PYTHON_VERSION=3.12.13", "PYTHON_SHA256=c08bc65a81971c1dd5783182826503369466c7e67374d1646519adf05207b684", "PYTHONUNBUFFERED=1", "PYTHONDONTWRITEBYTECODE=1", "PIP_NO_CACHE_DIR=1", "TZ=Europe/Bratislava", "PYTHONPATH=/app" ], "Labels": { "com.docker.compose.project": "traefik-stack", "com.docker.compose.service": "sn-metrics-collector", "com.docker.compose.version": "5.1.4" }, "WorkingDir": "/app", "ArgsEscaped": true } }, "Layers": [ { "Size": 81049600, "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, { "Size": 4127232, "DiffID": "sha256:ae0096d57d7f18e7861848f1103983488102f78517c11444120d8a938884de54" }, { "Size": 38106624, "DiffID": "sha256:c529e1b2553946dcc9afa2d77e33a75f23d3702e0b4a7911b67e2f1fe45a4939" }, { "Size": 5120, "DiffID": "sha256:6872606a6b819a8348189e0d99b8e730aa74d558c158d96f1dd2406a7c6baaf7" }, { "Size": 1536, "DiffID": "sha256:9c57f6cface5b93a640b5db0ed32e1500e95ea49f2a4dcf367382bf56b365ae7" }, { "Size": 13842432, "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, { "Size": 2560, "DiffID": "sha256:65ca543362c7f07dd287aff2ea8b022d364764c986f0efddce6012bd599e9bbf" }, { "Size": 20128768, "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, { "Size": 79872, "DiffID": "sha256:3b14713b425fb3dc42e9c9ae696f82a223455627bea4af57bd0693fec339d7a7" } ] }, "Results": [ { "Target": "traefik-stack-sn-metrics-collector (debian 13.5)", "Class": "os-pkgs", "Type": "debian", "Packages": [ { "ID": "adduser@3.152", "Name": "adduser", "Identifier": { "PURL": "pkg:deb/debian/adduser@3.152?arch=all\u0026distro=debian-13.5", "UID": "17a3839c9950603e" }, "Version": "3.152", "Arch": "all", "SrcName": "adduser", "SrcVersion": "3.152", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Adduser Developers \u003cadduser@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "passwd@1:4.17.4-2" ], "Layer": { "DiffID": "sha256:c529e1b2553946dcc9afa2d77e33a75f23d3702e0b4a7911b67e2f1fe45a4939" }, "InstalledFiles": [ "/usr/sbin/adduser", "/usr/sbin/deluser", "/usr/share/doc/adduser/NEWS.Debian.gz", "/usr/share/doc/adduser/README.gz", "/usr/share/doc/adduser/TODO", "/usr/share/doc/adduser/changelog.gz", "/usr/share/doc/adduser/copyright", "/usr/share/doc/adduser/examples/INSTALL", "/usr/share/doc/adduser/examples/README", "/usr/share/doc/adduser/examples/adduser.conf", "/usr/share/doc/adduser/examples/adduser.local", "/usr/share/doc/adduser/examples/adduser.local.conf", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/bash.bashrc", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/profile", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel.other/index.html", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bash_logout", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bash_profile", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bashrc", "/usr/share/doc/adduser/examples/deluser.conf", "/usr/share/man/da/man5/deluser.conf.5.gz", "/usr/share/man/de/man5/adduser.conf.5.gz", "/usr/share/man/de/man5/deluser.conf.5.gz", "/usr/share/man/de/man8/adduser.8.gz", "/usr/share/man/de/man8/adduser.local.8.gz", "/usr/share/man/de/man8/deluser.8.gz", "/usr/share/man/es/man5/deluser.conf.5.gz", "/usr/share/man/fr/man5/adduser.conf.5.gz", "/usr/share/man/fr/man5/deluser.conf.5.gz", "/usr/share/man/fr/man8/adduser.8.gz", "/usr/share/man/fr/man8/deluser.8.gz", "/usr/share/man/it/man5/deluser.conf.5.gz", "/usr/share/man/man5/adduser.conf.5.gz", "/usr/share/man/man5/deluser.conf.5.gz", "/usr/share/man/man8/adduser.8.gz", "/usr/share/man/man8/adduser.local.8.gz", "/usr/share/man/man8/deluser.8.gz", "/usr/share/man/nl/man5/adduser.conf.5.gz", "/usr/share/man/nl/man5/deluser.conf.5.gz", "/usr/share/man/nl/man8/adduser.8.gz", "/usr/share/man/nl/man8/adduser.local.8.gz", "/usr/share/man/nl/man8/deluser.8.gz", "/usr/share/man/pl/man5/deluser.conf.5.gz", "/usr/share/man/pt/man5/adduser.conf.5.gz", "/usr/share/man/pt/man5/deluser.conf.5.gz", "/usr/share/man/pt/man8/adduser.8.gz", "/usr/share/man/pt/man8/adduser.local.8.gz", "/usr/share/man/pt/man8/deluser.8.gz", "/usr/share/man/ro/man5/adduser.conf.5.gz", "/usr/share/man/ro/man5/deluser.conf.5.gz", "/usr/share/man/ro/man8/adduser.8.gz", "/usr/share/man/ro/man8/adduser.local.8.gz", "/usr/share/man/ro/man8/deluser.8.gz", "/usr/share/man/ru/man5/deluser.conf.5.gz", "/usr/share/man/sv/man5/deluser.conf.5.gz", "/usr/share/perl5/Debian/AdduserCommon.pm", "/usr/share/perl5/Debian/AdduserLogging.pm", "/usr/share/perl5/Debian/AdduserRetvalues.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "apt@3.0.3", "Name": "apt", "Identifier": { "PURL": "pkg:deb/debian/apt@3.0.3?arch=amd64\u0026distro=debian-13.5", "UID": "2e5d8c8032700559" }, "Version": "3.0.3", "Arch": "amd64", "SrcName": "apt", "SrcVersion": "3.0.3", "Licenses": [ "GPL-2.0-or-later", "curl", "BSD-3-Clause", "MIT", "GPL-2.0-only" ], "Maintainer": "APT Development Team \u003cdeity@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "adduser@3.152", "base-passwd@3.6.7", "debian-archive-keyring@2025.1", "libapt-pkg7.0@3.0.3", "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libseccomp2@2.6.0-2", "libssl3t64@3.5.6-1~deb13u1", "libstdc++6@14.2.0-19", "libsystemd0@257.13-1~deb13u1", "sqv@1.3.0-3+b2" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/apt", "/usr/bin/apt-cache", "/usr/bin/apt-cdrom", "/usr/bin/apt-config", "/usr/bin/apt-get", "/usr/bin/apt-mark", "/usr/lib/apt/apt-extracttemplates", "/usr/lib/apt/apt-helper", "/usr/lib/apt/apt.systemd.daily", "/usr/lib/apt/methods/cdrom", "/usr/lib/apt/methods/copy", "/usr/lib/apt/methods/file", "/usr/lib/apt/methods/gpgv", "/usr/lib/apt/methods/http", "/usr/lib/apt/methods/mirror", "/usr/lib/apt/methods/rred", "/usr/lib/apt/methods/sqv", "/usr/lib/apt/methods/store", "/usr/lib/apt/solvers/dump", "/usr/lib/dpkg/methods/apt/desc.apt", "/usr/lib/dpkg/methods/apt/install", "/usr/lib/dpkg/methods/apt/names", "/usr/lib/dpkg/methods/apt/setup", "/usr/lib/dpkg/methods/apt/update", "/usr/lib/systemd/system/apt-daily-upgrade.service", "/usr/lib/systemd/system/apt-daily-upgrade.timer", "/usr/lib/systemd/system/apt-daily.service", "/usr/lib/systemd/system/apt-daily.timer", "/usr/lib/x86_64-linux-gnu/libapt-private.so.0.0.0", "/usr/share/apt/default-sequoia.config", "/usr/share/bash-completion/completions/apt", "/usr/share/bug/apt/script", "/usr/share/doc/apt/NEWS.Debian.gz", "/usr/share/doc/apt/README.md.gz", "/usr/share/doc/apt/changelog.gz", "/usr/share/doc/apt/copyright", "/usr/share/doc/apt/examples/apt.conf", "/usr/share/doc/apt/examples/configure-index", "/usr/share/doc/apt/examples/debian.sources", "/usr/share/doc/apt/examples/preferences", "/usr/share/lintian/overrides/apt", "/usr/share/locale/ar/LC_MESSAGES/apt.mo", "/usr/share/locale/ast/LC_MESSAGES/apt.mo", "/usr/share/locale/bg/LC_MESSAGES/apt.mo", "/usr/share/locale/bs/LC_MESSAGES/apt.mo", "/usr/share/locale/ca/LC_MESSAGES/apt.mo", "/usr/share/locale/cs/LC_MESSAGES/apt.mo", "/usr/share/locale/cy/LC_MESSAGES/apt.mo", "/usr/share/locale/da/LC_MESSAGES/apt.mo", "/usr/share/locale/de/LC_MESSAGES/apt.mo", "/usr/share/locale/dz/LC_MESSAGES/apt.mo", "/usr/share/locale/el/LC_MESSAGES/apt.mo", "/usr/share/locale/es/LC_MESSAGES/apt.mo", "/usr/share/locale/eu/LC_MESSAGES/apt.mo", "/usr/share/locale/fi/LC_MESSAGES/apt.mo", "/usr/share/locale/fr/LC_MESSAGES/apt.mo", "/usr/share/locale/gl/LC_MESSAGES/apt.mo", "/usr/share/locale/hu/LC_MESSAGES/apt.mo", "/usr/share/locale/it/LC_MESSAGES/apt.mo", "/usr/share/locale/ja/LC_MESSAGES/apt.mo", "/usr/share/locale/km/LC_MESSAGES/apt.mo", "/usr/share/locale/ko/LC_MESSAGES/apt.mo", "/usr/share/locale/ku/LC_MESSAGES/apt.mo", "/usr/share/locale/lt/LC_MESSAGES/apt.mo", "/usr/share/locale/mr/LC_MESSAGES/apt.mo", "/usr/share/locale/nb/LC_MESSAGES/apt.mo", "/usr/share/locale/ne/LC_MESSAGES/apt.mo", "/usr/share/locale/nl/LC_MESSAGES/apt.mo", "/usr/share/locale/nn/LC_MESSAGES/apt.mo", "/usr/share/locale/pl/LC_MESSAGES/apt.mo", "/usr/share/locale/pt/LC_MESSAGES/apt.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/apt.mo", "/usr/share/locale/ro/LC_MESSAGES/apt.mo", "/usr/share/locale/ru/LC_MESSAGES/apt.mo", "/usr/share/locale/sk/LC_MESSAGES/apt.mo", "/usr/share/locale/sl/LC_MESSAGES/apt.mo", "/usr/share/locale/sv/LC_MESSAGES/apt.mo", "/usr/share/locale/th/LC_MESSAGES/apt.mo", "/usr/share/locale/tl/LC_MESSAGES/apt.mo", "/usr/share/locale/tr/LC_MESSAGES/apt.mo", "/usr/share/locale/uk/LC_MESSAGES/apt.mo", "/usr/share/locale/vi/LC_MESSAGES/apt.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/apt.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/apt.mo", "/usr/share/man/de/man1/apt-transport-http.1.gz", "/usr/share/man/de/man1/apt-transport-https.1.gz", "/usr/share/man/de/man1/apt-transport-mirror.1.gz", "/usr/share/man/de/man5/apt.conf.5.gz", "/usr/share/man/de/man5/apt_auth.conf.5.gz", "/usr/share/man/de/man5/apt_preferences.5.gz", "/usr/share/man/de/man5/sources.list.5.gz", "/usr/share/man/de/man7/apt-patterns.7.gz", "/usr/share/man/de/man8/apt-cache.8.gz", "/usr/share/man/de/man8/apt-cdrom.8.gz", "/usr/share/man/de/man8/apt-config.8.gz", "/usr/share/man/de/man8/apt-get.8.gz", "/usr/share/man/de/man8/apt-mark.8.gz", "/usr/share/man/de/man8/apt-secure.8.gz", "/usr/share/man/de/man8/apt.8.gz", "/usr/share/man/es/man5/apt_preferences.5.gz", "/usr/share/man/es/man8/apt-cache.8.gz", "/usr/share/man/es/man8/apt-cdrom.8.gz", "/usr/share/man/es/man8/apt-config.8.gz", "/usr/share/man/fr/man1/apt-transport-http.1.gz", "/usr/share/man/fr/man1/apt-transport-https.1.gz", "/usr/share/man/fr/man1/apt-transport-mirror.1.gz", "/usr/share/man/fr/man5/apt.conf.5.gz", "/usr/share/man/fr/man5/apt_auth.conf.5.gz", "/usr/share/man/fr/man5/apt_preferences.5.gz", "/usr/share/man/fr/man5/sources.list.5.gz", "/usr/share/man/fr/man7/apt-patterns.7.gz", "/usr/share/man/fr/man8/apt-cache.8.gz", "/usr/share/man/fr/man8/apt-cdrom.8.gz", "/usr/share/man/fr/man8/apt-config.8.gz", "/usr/share/man/fr/man8/apt-get.8.gz", "/usr/share/man/fr/man8/apt-mark.8.gz", "/usr/share/man/fr/man8/apt-secure.8.gz", "/usr/share/man/fr/man8/apt.8.gz", "/usr/share/man/it/man5/apt.conf.5.gz", "/usr/share/man/it/man5/apt_preferences.5.gz", "/usr/share/man/it/man8/apt-cache.8.gz", "/usr/share/man/it/man8/apt-cdrom.8.gz", "/usr/share/man/it/man8/apt-config.8.gz", "/usr/share/man/it/man8/apt-mark.8.gz", "/usr/share/man/it/man8/apt.8.gz", "/usr/share/man/ja/man5/apt.conf.5.gz", "/usr/share/man/ja/man5/apt_preferences.5.gz", "/usr/share/man/ja/man8/apt-cache.8.gz", "/usr/share/man/ja/man8/apt-cdrom.8.gz", "/usr/share/man/ja/man8/apt-config.8.gz", "/usr/share/man/ja/man8/apt-mark.8.gz", "/usr/share/man/ja/man8/apt.8.gz", "/usr/share/man/man1/apt-transport-http.1.gz", "/usr/share/man/man1/apt-transport-https.1.gz", "/usr/share/man/man1/apt-transport-mirror.1.gz", "/usr/share/man/man5/apt.conf.5.gz", "/usr/share/man/man5/apt_auth.conf.5.gz", "/usr/share/man/man5/apt_preferences.5.gz", "/usr/share/man/man5/sources.list.5.gz", "/usr/share/man/man7/apt-patterns.7.gz", "/usr/share/man/man8/apt-cache.8.gz", "/usr/share/man/man8/apt-cdrom.8.gz", "/usr/share/man/man8/apt-config.8.gz", "/usr/share/man/man8/apt-get.8.gz", "/usr/share/man/man8/apt-mark.8.gz", "/usr/share/man/man8/apt-secure.8.gz", "/usr/share/man/man8/apt.8.gz", "/usr/share/man/nl/man1/apt-transport-http.1.gz", "/usr/share/man/nl/man1/apt-transport-https.1.gz", "/usr/share/man/nl/man1/apt-transport-mirror.1.gz", "/usr/share/man/nl/man5/apt.conf.5.gz", "/usr/share/man/nl/man5/apt_auth.conf.5.gz", "/usr/share/man/nl/man5/apt_preferences.5.gz", "/usr/share/man/nl/man5/sources.list.5.gz", "/usr/share/man/nl/man7/apt-patterns.7.gz", "/usr/share/man/nl/man8/apt-cache.8.gz", "/usr/share/man/nl/man8/apt-cdrom.8.gz", "/usr/share/man/nl/man8/apt-config.8.gz", "/usr/share/man/nl/man8/apt-get.8.gz", "/usr/share/man/nl/man8/apt-mark.8.gz", "/usr/share/man/nl/man8/apt-secure.8.gz", "/usr/share/man/nl/man8/apt.8.gz", "/usr/share/man/pl/man5/apt_preferences.5.gz", "/usr/share/man/pl/man8/apt-cache.8.gz", "/usr/share/man/pl/man8/apt-cdrom.8.gz", "/usr/share/man/pl/man8/apt-config.8.gz", "/usr/share/man/pt/man1/apt-transport-http.1.gz", "/usr/share/man/pt/man1/apt-transport-https.1.gz", "/usr/share/man/pt/man1/apt-transport-mirror.1.gz", "/usr/share/man/pt/man5/apt.conf.5.gz", "/usr/share/man/pt/man5/apt_auth.conf.5.gz", "/usr/share/man/pt/man5/apt_preferences.5.gz", "/usr/share/man/pt/man5/sources.list.5.gz", "/usr/share/man/pt/man7/apt-patterns.7.gz", "/usr/share/man/pt/man8/apt-cache.8.gz", "/usr/share/man/pt/man8/apt-cdrom.8.gz", "/usr/share/man/pt/man8/apt-config.8.gz", "/usr/share/man/pt/man8/apt-get.8.gz", "/usr/share/man/pt/man8/apt-mark.8.gz", "/usr/share/man/pt/man8/apt-secure.8.gz", "/usr/share/man/pt/man8/apt.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "base-files@13.8+deb13u5", "Name": "base-files", "Identifier": { "PURL": "pkg:deb/debian/base-files@13.8%2Bdeb13u5?arch=amd64\u0026distro=debian-13.5", "UID": "6b13e330b45e6f4f" }, "Version": "13.8+deb13u5", "Arch": "amd64", "SrcName": "base-files", "SrcVersion": "13.8+deb13u5", "Licenses": [ "GPL-2.0-or-later", "verbatim" ], "Maintainer": "Santiago Vila \u003csanvila@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/os-release", "/usr/share/base-files/dot.bashrc", "/usr/share/base-files/dot.profile", "/usr/share/base-files/dot.profile.md5sums", "/usr/share/base-files/info.dir", "/usr/share/base-files/motd", "/usr/share/base-files/profile", "/usr/share/base-files/profile.md5sums", "/usr/share/base-files/staff-group-for-usr-local", "/usr/share/common-licenses/Apache-2.0", "/usr/share/common-licenses/Artistic", "/usr/share/common-licenses/BSD", "/usr/share/common-licenses/CC0-1.0", "/usr/share/common-licenses/GFDL-1.2", "/usr/share/common-licenses/GFDL-1.3", "/usr/share/common-licenses/GPL-1", "/usr/share/common-licenses/GPL-2", "/usr/share/common-licenses/GPL-3", "/usr/share/common-licenses/LGPL-2", "/usr/share/common-licenses/LGPL-2.1", "/usr/share/common-licenses/LGPL-3", "/usr/share/common-licenses/MPL-1.1", "/usr/share/common-licenses/MPL-2.0", "/usr/share/doc/base-files/NEWS.Debian.gz", "/usr/share/doc/base-files/README", "/usr/share/doc/base-files/README.FHS", "/usr/share/doc/base-files/changelog.gz", "/usr/share/doc/base-files/copyright", "/usr/share/lintian/overrides/base-files" ], "AnalyzedBy": "dpkg" }, { "ID": "base-passwd@3.6.7", "Name": "base-passwd", "Identifier": { "PURL": "pkg:deb/debian/base-passwd@3.6.7?arch=amd64\u0026distro=debian-13.5", "UID": "f77779fa356eca05" }, "Version": "3.6.7", "Arch": "amd64", "SrcName": "base-passwd", "SrcVersion": "3.6.7", "Licenses": [ "GPL-2.0-only", "public-domain" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdebconfclient0@0.280", "libselinux1@3.8.1-1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/sbin/update-passwd", "/usr/share/base-passwd/group.master", "/usr/share/base-passwd/passwd.master", "/usr/share/doc-base/base-passwd.users-and-groups", "/usr/share/doc/base-passwd/README", "/usr/share/doc/base-passwd/changelog.gz", "/usr/share/doc/base-passwd/copyright", "/usr/share/doc/base-passwd/users-and-groups.html", "/usr/share/doc/base-passwd/users-and-groups.txt.gz", "/usr/share/lintian/overrides/base-passwd", "/usr/share/man/de/man8/update-passwd.8.gz", "/usr/share/man/es/man8/update-passwd.8.gz", "/usr/share/man/fr/man8/update-passwd.8.gz", "/usr/share/man/ja/man8/update-passwd.8.gz", "/usr/share/man/man8/update-passwd.8.gz", "/usr/share/man/pl/man8/update-passwd.8.gz", "/usr/share/man/ro/man8/update-passwd.8.gz", "/usr/share/man/ru/man8/update-passwd.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "bash@5.2.37-2+b9", "Name": "bash", "Identifier": { "PURL": "pkg:deb/debian/bash@5.2.37-2%2Bb9?arch=amd64\u0026distro=debian-13.5", "UID": "f36f9b3693158651" }, "Version": "5.2.37", "Release": "2+b9", "Arch": "amd64", "SrcName": "bash", "SrcVersion": "5.2.37", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-3+ with Bison exception", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only", "Latex2e", "BSD-4-Clause-UC", "MIT", "permissive" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "base-files@13.8+deb13u5", "debianutils@5.23.2" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/bash", "/usr/bin/bashbug", "/usr/bin/clear_console", "/usr/share/debianutils/shells.d/bash", "/usr/share/doc/bash/CHANGES.gz", "/usr/share/doc/bash/COMPAT.gz", "/usr/share/doc/bash/INTRO.gz", "/usr/share/doc/bash/NEWS.gz", "/usr/share/doc/bash/POSIX.gz", "/usr/share/doc/bash/RBASH", "/usr/share/doc/bash/README.Debian.gz", "/usr/share/doc/bash/README.abs-guide", "/usr/share/doc/bash/README.commands.gz", "/usr/share/doc/bash/README.gz", "/usr/share/doc/bash/changelog.Debian.amd64.gz", "/usr/share/doc/bash/changelog.Debian.gz", "/usr/share/doc/bash/changelog.gz", "/usr/share/doc/bash/copyright", "/usr/share/doc/bash/inputrc.arrows", "/usr/share/lintian/overrides/bash", "/usr/share/locale/af/LC_MESSAGES/bash.mo", "/usr/share/locale/bg/LC_MESSAGES/bash.mo", "/usr/share/locale/ca/LC_MESSAGES/bash.mo", "/usr/share/locale/cs/LC_MESSAGES/bash.mo", "/usr/share/locale/da/LC_MESSAGES/bash.mo", "/usr/share/locale/de/LC_MESSAGES/bash.mo", "/usr/share/locale/el/LC_MESSAGES/bash.mo", "/usr/share/locale/en@boldquot/LC_MESSAGES/bash.mo", "/usr/share/locale/en@quot/LC_MESSAGES/bash.mo", "/usr/share/locale/eo/LC_MESSAGES/bash.mo", "/usr/share/locale/es/LC_MESSAGES/bash.mo", "/usr/share/locale/et/LC_MESSAGES/bash.mo", "/usr/share/locale/fi/LC_MESSAGES/bash.mo", "/usr/share/locale/fr/LC_MESSAGES/bash.mo", "/usr/share/locale/ga/LC_MESSAGES/bash.mo", "/usr/share/locale/gl/LC_MESSAGES/bash.mo", "/usr/share/locale/hr/LC_MESSAGES/bash.mo", "/usr/share/locale/hu/LC_MESSAGES/bash.mo", "/usr/share/locale/id/LC_MESSAGES/bash.mo", "/usr/share/locale/it/LC_MESSAGES/bash.mo", "/usr/share/locale/ja/LC_MESSAGES/bash.mo", "/usr/share/locale/ko/LC_MESSAGES/bash.mo", "/usr/share/locale/lt/LC_MESSAGES/bash.mo", "/usr/share/locale/nb/LC_MESSAGES/bash.mo", "/usr/share/locale/nl/LC_MESSAGES/bash.mo", "/usr/share/locale/pl/LC_MESSAGES/bash.mo", "/usr/share/locale/pt/LC_MESSAGES/bash.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/bash.mo", "/usr/share/locale/ro/LC_MESSAGES/bash.mo", "/usr/share/locale/ru/LC_MESSAGES/bash.mo", "/usr/share/locale/sk/LC_MESSAGES/bash.mo", "/usr/share/locale/sl/LC_MESSAGES/bash.mo", "/usr/share/locale/sr/LC_MESSAGES/bash.mo", "/usr/share/locale/sv/LC_MESSAGES/bash.mo", "/usr/share/locale/tr/LC_MESSAGES/bash.mo", "/usr/share/locale/uk/LC_MESSAGES/bash.mo", "/usr/share/locale/vi/LC_MESSAGES/bash.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/bash.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/bash.mo", "/usr/share/man/man1/bash.1.gz", "/usr/share/man/man1/bashbug.1.gz", "/usr/share/man/man1/clear_console.1.gz", "/usr/share/man/man1/rbash.1.gz", "/usr/share/man/man7/bash-builtins.7.gz", "/usr/share/menu/bash" ], "AnalyzedBy": "dpkg" }, { "ID": "bsdutils@1:2.41-5", "Name": "bsdutils", "Identifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "5843733a461e6ce1" }, "Version": "2.41", "Release": "5", "Epoch": 1, "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/logger", "/usr/bin/renice", "/usr/bin/script", "/usr/bin/scriptlive", "/usr/bin/scriptreplay", "/usr/bin/wall", "/usr/share/bash-completion/completions/logger", "/usr/share/bash-completion/completions/renice", "/usr/share/bash-completion/completions/script", "/usr/share/bash-completion/completions/scriptlive", "/usr/share/bash-completion/completions/scriptreplay", "/usr/share/bash-completion/completions/wall", "/usr/share/doc/bsdutils/NEWS.Debian.gz", "/usr/share/doc/bsdutils/changelog.Debian.gz", "/usr/share/doc/bsdutils/changelog.gz", "/usr/share/doc/bsdutils/copyright", "/usr/share/lintian/overrides/bsdutils", "/usr/share/man/man1/logger.1.gz", "/usr/share/man/man1/renice.1.gz", "/usr/share/man/man1/script.1.gz", "/usr/share/man/man1/scriptlive.1.gz", "/usr/share/man/man1/scriptreplay.1.gz", "/usr/share/man/man1/wall.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ca-certificates@20250419", "Name": "ca-certificates", "Identifier": { "PURL": "pkg:deb/debian/ca-certificates@20250419?arch=all\u0026distro=debian-13.5", "UID": "2c691dbd8cebdf2a" }, "Version": "20250419", "Arch": "all", "SrcName": "ca-certificates", "SrcVersion": "20250419", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "MPL-2.0" ], "Maintainer": "Julien Cristau \u003cjcristau@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "openssl@3.5.6-1~deb13u1" ], "Layer": { "DiffID": "sha256:ae0096d57d7f18e7861848f1103983488102f78517c11444120d8a938884de54" }, "InstalledFiles": [ "/usr/sbin/update-ca-certificates", "/usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", "/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", "/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", "/usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", "/usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", "/usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", "/usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", "/usr/share/ca-certificates/mozilla/Baltimore_CyberTrust_Root.crt", "/usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", "/usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", "/usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", "/usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", "/usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", "/usr/share/ca-certificates/mozilla/Certigna.crt", "/usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_ECC_Root-01.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_ECC_Root-02.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_RSA_Root-01.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_RSA_Root-02.crt", "/usr/share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", "/usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", "/usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", "/usr/share/ca-certificates/mozilla/Entrust.net_Premium_2048_Secure_Server_CA.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/FIRMAPROFESIONAL_CA_ROOT-A_WEB.crt", "/usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", "/usr/share/ca-certificates/mozilla/GLOBALTRUST_2020.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R2.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", "/usr/share/ca-certificates/mozilla/Go_Daddy_Class_2_CA.crt", "/usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", "/usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", "/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", "/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", "/usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", "/usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", "/usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", "/usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Izenpe.com.crt", "/usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", "/usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", "/usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", "/usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", "/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", "/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", "/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", "/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", "/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", "/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", "/usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", "/usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", "/usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", "/usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", "/usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", "/usr/share/ca-certificates/mozilla/SecureSign_Root_CA12.crt", "/usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", "/usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", "/usr/share/ca-certificates/mozilla/SecureTrust_CA.crt", "/usr/share/ca-certificates/mozilla/Secure_Global_CA.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", "/usr/share/ca-certificates/mozilla/Starfield_Class_2_CA.crt", "/usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt", "/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", "/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", "/usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", "/usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", "/usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", "/usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", "/usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", "/usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt", "/usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", "/usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", "/usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P256_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P384_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", "/usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", "/usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", "/usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/XRamp_Global_CA_Root.crt", "/usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt", "/usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", "/usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", "/usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", "/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", "/usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", "/usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", "/usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", "/usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt", "/usr/share/doc/ca-certificates/README.Debian", "/usr/share/doc/ca-certificates/changelog.gz", "/usr/share/doc/ca-certificates/copyright", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/Makefile", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/README", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/ca-certificates-local.triggers", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/changelog", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/compat", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/control", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/copyright", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/postrm", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/rules", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/source/format", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/local/Local_Root_CA.crt", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/local/Makefile", "/usr/share/man/man8/update-ca-certificates.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "coreutils@9.7-3", "Name": "coreutils", "Identifier": { "PURL": "pkg:deb/debian/coreutils@9.7-3?arch=amd64\u0026distro=debian-13.5", "UID": "cb4a55f50bda2393" }, "Version": "9.7", "Release": "3", "Arch": "amd64", "SrcName": "coreutils", "SrcVersion": "9.7", "SrcRelease": "3", "Licenses": [ "GPL-3.0-or-later", "BSD-4-Clause-UC", "GPL-3.0-only", "ISC", "FSFULLR", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only" ], "Maintainer": "Michael Stone \u003cmstone@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/[", "/usr/bin/arch", "/usr/bin/b2sum", "/usr/bin/base32", "/usr/bin/base64", "/usr/bin/basename", "/usr/bin/basenc", "/usr/bin/cat", "/usr/bin/chcon", "/usr/bin/chgrp", "/usr/bin/chmod", "/usr/bin/chown", "/usr/bin/cksum", "/usr/bin/comm", "/usr/bin/cp", "/usr/bin/csplit", "/usr/bin/cut", "/usr/bin/date", "/usr/bin/dd", "/usr/bin/df", "/usr/bin/dir", "/usr/bin/dircolors", "/usr/bin/dirname", "/usr/bin/du", "/usr/bin/echo", "/usr/bin/env", "/usr/bin/expand", "/usr/bin/expr", "/usr/bin/factor", "/usr/bin/false", "/usr/bin/fmt", "/usr/bin/fold", "/usr/bin/groups", "/usr/bin/head", "/usr/bin/hostid", "/usr/bin/id", "/usr/bin/install", "/usr/bin/join", "/usr/bin/link", "/usr/bin/ln", "/usr/bin/logname", "/usr/bin/ls", "/usr/bin/md5sum", "/usr/bin/mkdir", "/usr/bin/mkfifo", "/usr/bin/mknod", "/usr/bin/mktemp", "/usr/bin/mv", "/usr/bin/nice", "/usr/bin/nl", "/usr/bin/nohup", "/usr/bin/nproc", "/usr/bin/numfmt", "/usr/bin/od", "/usr/bin/paste", "/usr/bin/pathchk", "/usr/bin/pinky", "/usr/bin/pr", "/usr/bin/printenv", "/usr/bin/printf", "/usr/bin/ptx", "/usr/bin/pwd", "/usr/bin/readlink", "/usr/bin/realpath", "/usr/bin/rm", "/usr/bin/rmdir", "/usr/bin/runcon", "/usr/bin/seq", "/usr/bin/sha1sum", "/usr/bin/sha224sum", "/usr/bin/sha256sum", "/usr/bin/sha384sum", "/usr/bin/sha512sum", "/usr/bin/shred", "/usr/bin/shuf", "/usr/bin/sleep", "/usr/bin/sort", "/usr/bin/split", "/usr/bin/stat", "/usr/bin/stdbuf", "/usr/bin/stty", "/usr/bin/sum", "/usr/bin/sync", "/usr/bin/tac", "/usr/bin/tail", "/usr/bin/tee", "/usr/bin/test", "/usr/bin/timeout", "/usr/bin/touch", "/usr/bin/tr", "/usr/bin/true", "/usr/bin/truncate", "/usr/bin/tsort", "/usr/bin/tty", "/usr/bin/uname", "/usr/bin/unexpand", "/usr/bin/uniq", "/usr/bin/unlink", "/usr/bin/users", "/usr/bin/vdir", "/usr/bin/wc", "/usr/bin/who", "/usr/bin/whoami", "/usr/bin/yes", "/usr/libexec/coreutils/libstdbuf.so", "/usr/sbin/chroot", "/usr/share/doc/coreutils/AUTHORS", "/usr/share/doc/coreutils/NEWS.gz", "/usr/share/doc/coreutils/README.Debian", "/usr/share/doc/coreutils/README.gz", "/usr/share/doc/coreutils/THANKS.gz", "/usr/share/doc/coreutils/TODO.gz", "/usr/share/doc/coreutils/changelog.Debian.gz", "/usr/share/doc/coreutils/changelog.gz", "/usr/share/doc/coreutils/copyright", "/usr/share/info/coreutils.info.gz", "/usr/share/lintian/overrides/coreutils", "/usr/share/locale/af/LC_MESSAGES/coreutils.mo", "/usr/share/locale/be/LC_MESSAGES/coreutils.mo", "/usr/share/locale/bg/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ca/LC_MESSAGES/coreutils.mo", "/usr/share/locale/cs/LC_MESSAGES/coreutils.mo", "/usr/share/locale/da/LC_MESSAGES/coreutils.mo", "/usr/share/locale/de/LC_MESSAGES/coreutils.mo", "/usr/share/locale/el/LC_MESSAGES/coreutils.mo", "/usr/share/locale/eo/LC_MESSAGES/coreutils.mo", "/usr/share/locale/es/LC_MESSAGES/coreutils.mo", "/usr/share/locale/et/LC_MESSAGES/coreutils.mo", "/usr/share/locale/eu/LC_MESSAGES/coreutils.mo", "/usr/share/locale/fi/LC_MESSAGES/coreutils.mo", "/usr/share/locale/fr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ga/LC_MESSAGES/coreutils.mo", "/usr/share/locale/gl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/hr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/hu/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ia/LC_MESSAGES/coreutils.mo", "/usr/share/locale/id/LC_MESSAGES/coreutils.mo", "/usr/share/locale/it/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ja/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ka/LC_MESSAGES/coreutils.mo", "/usr/share/locale/kk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ko/LC_MESSAGES/coreutils.mo", "/usr/share/locale/lg/LC_MESSAGES/coreutils.mo", "/usr/share/locale/lt/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ms/LC_MESSAGES/coreutils.mo", "/usr/share/locale/nb/LC_MESSAGES/coreutils.mo", "/usr/share/locale/nl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pt/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ro/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ru/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sv/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ta/LC_MESSAGES/coreutils.mo", "/usr/share/locale/tr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/uk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/vi/LC_MESSAGES/coreutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/coreutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/coreutils.mo", "/usr/share/man/man1/arch.1.gz", "/usr/share/man/man1/b2sum.1.gz", "/usr/share/man/man1/base32.1.gz", "/usr/share/man/man1/base64.1.gz", "/usr/share/man/man1/basename.1.gz", "/usr/share/man/man1/basenc.1.gz", "/usr/share/man/man1/cat.1.gz", "/usr/share/man/man1/chcon.1.gz", "/usr/share/man/man1/chgrp.1.gz", "/usr/share/man/man1/chmod.1.gz", "/usr/share/man/man1/chown.1.gz", "/usr/share/man/man1/cksum.1.gz", "/usr/share/man/man1/comm.1.gz", "/usr/share/man/man1/cp.1.gz", "/usr/share/man/man1/csplit.1.gz", "/usr/share/man/man1/cut.1.gz", "/usr/share/man/man1/date.1.gz", "/usr/share/man/man1/dd.1.gz", "/usr/share/man/man1/df.1.gz", "/usr/share/man/man1/dir.1.gz", "/usr/share/man/man1/dircolors.1.gz", "/usr/share/man/man1/dirname.1.gz", "/usr/share/man/man1/du.1.gz", "/usr/share/man/man1/echo.1.gz", "/usr/share/man/man1/env.1.gz", "/usr/share/man/man1/expand.1.gz", "/usr/share/man/man1/expr.1.gz", "/usr/share/man/man1/factor.1.gz", "/usr/share/man/man1/false.1.gz", "/usr/share/man/man1/fmt.1.gz", "/usr/share/man/man1/fold.1.gz", "/usr/share/man/man1/groups.1.gz", "/usr/share/man/man1/head.1.gz", "/usr/share/man/man1/hostid.1.gz", "/usr/share/man/man1/id.1.gz", "/usr/share/man/man1/install.1.gz", "/usr/share/man/man1/join.1.gz", "/usr/share/man/man1/link.1.gz", "/usr/share/man/man1/ln.1.gz", "/usr/share/man/man1/logname.1.gz", "/usr/share/man/man1/ls.1.gz", "/usr/share/man/man1/md5sum.1.gz", "/usr/share/man/man1/mkdir.1.gz", "/usr/share/man/man1/mkfifo.1.gz", "/usr/share/man/man1/mknod.1.gz", "/usr/share/man/man1/mktemp.1.gz", "/usr/share/man/man1/mv.1.gz", "/usr/share/man/man1/nice.1.gz", "/usr/share/man/man1/nl.1.gz", "/usr/share/man/man1/nohup.1.gz", "/usr/share/man/man1/nproc.1.gz", "/usr/share/man/man1/numfmt.1.gz", "/usr/share/man/man1/od.1.gz", "/usr/share/man/man1/paste.1.gz", "/usr/share/man/man1/pathchk.1.gz", "/usr/share/man/man1/pinky.1.gz", "/usr/share/man/man1/pr.1.gz", "/usr/share/man/man1/printenv.1.gz", "/usr/share/man/man1/printf.1.gz", "/usr/share/man/man1/ptx.1.gz", "/usr/share/man/man1/pwd.1.gz", "/usr/share/man/man1/readlink.1.gz", "/usr/share/man/man1/realpath.1.gz", "/usr/share/man/man1/rm.1.gz", "/usr/share/man/man1/rmdir.1.gz", "/usr/share/man/man1/runcon.1.gz", "/usr/share/man/man1/seq.1.gz", "/usr/share/man/man1/sha1sum.1.gz", "/usr/share/man/man1/sha224sum.1.gz", "/usr/share/man/man1/sha256sum.1.gz", "/usr/share/man/man1/sha384sum.1.gz", "/usr/share/man/man1/sha512sum.1.gz", "/usr/share/man/man1/shred.1.gz", "/usr/share/man/man1/shuf.1.gz", "/usr/share/man/man1/sleep.1.gz", "/usr/share/man/man1/sort.1.gz", "/usr/share/man/man1/split.1.gz", "/usr/share/man/man1/stat.1.gz", "/usr/share/man/man1/stdbuf.1.gz", "/usr/share/man/man1/stty.1.gz", "/usr/share/man/man1/sum.1.gz", "/usr/share/man/man1/sync.1.gz", "/usr/share/man/man1/tac.1.gz", "/usr/share/man/man1/tail.1.gz", "/usr/share/man/man1/tee.1.gz", "/usr/share/man/man1/test.1.gz", "/usr/share/man/man1/timeout.1.gz", "/usr/share/man/man1/touch.1.gz", "/usr/share/man/man1/tr.1.gz", "/usr/share/man/man1/true.1.gz", "/usr/share/man/man1/truncate.1.gz", "/usr/share/man/man1/tsort.1.gz", "/usr/share/man/man1/tty.1.gz", "/usr/share/man/man1/uname.1.gz", "/usr/share/man/man1/unexpand.1.gz", "/usr/share/man/man1/uniq.1.gz", "/usr/share/man/man1/unlink.1.gz", "/usr/share/man/man1/users.1.gz", "/usr/share/man/man1/vdir.1.gz", "/usr/share/man/man1/wc.1.gz", "/usr/share/man/man1/who.1.gz", "/usr/share/man/man1/whoami.1.gz", "/usr/share/man/man1/yes.1.gz", "/usr/share/man/man8/chroot.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "curl@8.14.1-2+deb13u3", "Name": "curl", "Identifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "19710875c10d58d0" }, "Version": "8.14.1", "Release": "2+deb13u3", "Arch": "amd64", "SrcName": "curl", "SrcVersion": "8.14.1", "SrcRelease": "2+deb13u3", "Licenses": [ "curl", "OLDAP-2.8", "ISC", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "GPL-2+ with Libtool exception", "BSD-3-Clause", "BSD-4-Clause-UC", "FSFULLR", "X11", "GPL-2.0-only" ], "Maintainer": "Debian Curl Maintainers \u003cteam+curl@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcurl4t64@8.14.1-2+deb13u3", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/bin/curl", "/usr/bin/wcurl", "/usr/share/doc/curl/NEWS.Debian.gz", "/usr/share/doc/curl/README.Debian", "/usr/share/doc/curl/changelog.Debian.gz", "/usr/share/doc/curl/changelog.gz", "/usr/share/doc/curl/copyright", "/usr/share/fish/vendor_completions.d/curl.fish", "/usr/share/man/man1/curl.1.gz", "/usr/share/man/man1/wcurl.1.gz", "/usr/share/zsh/vendor-completions/_curl" ], "AnalyzedBy": "dpkg" }, { "ID": "dash@0.5.12-12", "Name": "dash", "Identifier": { "PURL": "pkg:deb/debian/dash@0.5.12-12?arch=amd64\u0026distro=debian-13.5", "UID": "4990b2098a2a3724" }, "Version": "0.5.12", "Release": "12", "Arch": "amd64", "SrcName": "dash", "SrcVersion": "0.5.12", "SrcRelease": "12", "Licenses": [ "BSD-3-Clause", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Andrej Shadura \u003candrewsh@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debianutils@5.23.2" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/dash", "/usr/share/debianutils/shells.d/dash", "/usr/share/doc/dash/README.Debian.diet", "/usr/share/doc/dash/README.source", "/usr/share/doc/dash/changelog.Debian.gz", "/usr/share/doc/dash/changelog.gz", "/usr/share/doc/dash/copyright", "/usr/share/lintian/overrides/dash", "/usr/share/man/man1/dash.1.gz", "/usr/share/menu/dash" ], "AnalyzedBy": "dpkg" }, { "ID": "debconf@1.5.91", "Name": "debconf", "Identifier": { "PURL": "pkg:deb/debian/debconf@1.5.91?arch=all\u0026distro=debian-13.5", "UID": "f7c8b7ba83ed5cfe" }, "Version": "1.5.91", "Arch": "all", "SrcName": "debconf", "SrcVersion": "1.5.91", "Licenses": [ "BSD-2-Clause" ], "Maintainer": "Debconf Developers \u003cdebconf-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/debconf", "/usr/bin/debconf-apt-progress", "/usr/bin/debconf-communicate", "/usr/bin/debconf-copydb", "/usr/bin/debconf-escape", "/usr/bin/debconf-set-selections", "/usr/bin/debconf-show", "/usr/sbin/dpkg-preconfigure", "/usr/sbin/dpkg-reconfigure", "/usr/share/bash-completion/completions/debconf", "/usr/share/debconf/confmodule", "/usr/share/debconf/confmodule.sh", "/usr/share/debconf/debconf.conf", "/usr/share/debconf/fix_db.pl", "/usr/share/debconf/frontend", "/usr/share/doc/debconf/README.Debian", "/usr/share/doc/debconf/changelog.gz", "/usr/share/doc/debconf/copyright", "/usr/share/lintian/overrides/debconf", "/usr/share/man/man1/debconf-apt-progress.1.gz", "/usr/share/man/man1/debconf-communicate.1.gz", "/usr/share/man/man1/debconf-copydb.1.gz", "/usr/share/man/man1/debconf-escape.1.gz", "/usr/share/man/man1/debconf-set-selections.1.gz", "/usr/share/man/man1/debconf-show.1.gz", "/usr/share/man/man1/debconf.1.gz", "/usr/share/man/man8/dpkg-preconfigure.8.gz", "/usr/share/man/man8/dpkg-reconfigure.8.gz", "/usr/share/perl5/Debconf/AutoSelect.pm", "/usr/share/perl5/Debconf/Base.pm", "/usr/share/perl5/Debconf/Client/ConfModule.pm", "/usr/share/perl5/Debconf/ConfModule.pm", "/usr/share/perl5/Debconf/Config.pm", "/usr/share/perl5/Debconf/Db.pm", "/usr/share/perl5/Debconf/DbDriver.pm", "/usr/share/perl5/Debconf/DbDriver/Backup.pm", "/usr/share/perl5/Debconf/DbDriver/Cache.pm", "/usr/share/perl5/Debconf/DbDriver/Copy.pm", "/usr/share/perl5/Debconf/DbDriver/Debug.pm", "/usr/share/perl5/Debconf/DbDriver/DirTree.pm", "/usr/share/perl5/Debconf/DbDriver/Directory.pm", "/usr/share/perl5/Debconf/DbDriver/File.pm", "/usr/share/perl5/Debconf/DbDriver/LDAP.pm", "/usr/share/perl5/Debconf/DbDriver/PackageDir.pm", "/usr/share/perl5/Debconf/DbDriver/Pipe.pm", "/usr/share/perl5/Debconf/DbDriver/Stack.pm", "/usr/share/perl5/Debconf/Element.pm", "/usr/share/perl5/Debconf/Element/Dialog/Boolean.pm", "/usr/share/perl5/Debconf/Element/Dialog/Error.pm", "/usr/share/perl5/Debconf/Element/Dialog/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Dialog/Note.pm", "/usr/share/perl5/Debconf/Element/Dialog/Password.pm", "/usr/share/perl5/Debconf/Element/Dialog/Progress.pm", "/usr/share/perl5/Debconf/Element/Dialog/Select.pm", "/usr/share/perl5/Debconf/Element/Dialog/String.pm", "/usr/share/perl5/Debconf/Element/Dialog/Text.pm", "/usr/share/perl5/Debconf/Element/Editor/Boolean.pm", "/usr/share/perl5/Debconf/Element/Editor/Error.pm", "/usr/share/perl5/Debconf/Element/Editor/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Editor/Note.pm", "/usr/share/perl5/Debconf/Element/Editor/Password.pm", "/usr/share/perl5/Debconf/Element/Editor/Progress.pm", "/usr/share/perl5/Debconf/Element/Editor/Select.pm", "/usr/share/perl5/Debconf/Element/Editor/String.pm", "/usr/share/perl5/Debconf/Element/Editor/Text.pm", "/usr/share/perl5/Debconf/Element/Gnome.pm", "/usr/share/perl5/Debconf/Element/Gnome/Boolean.pm", "/usr/share/perl5/Debconf/Element/Gnome/Error.pm", "/usr/share/perl5/Debconf/Element/Gnome/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Gnome/Note.pm", "/usr/share/perl5/Debconf/Element/Gnome/Password.pm", "/usr/share/perl5/Debconf/Element/Gnome/Progress.pm", "/usr/share/perl5/Debconf/Element/Gnome/Select.pm", "/usr/share/perl5/Debconf/Element/Gnome/String.pm", "/usr/share/perl5/Debconf/Element/Gnome/Text.pm", "/usr/share/perl5/Debconf/Element/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Noninteractive.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Boolean.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Error.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Note.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Password.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Progress.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Select.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/String.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Text.pm", "/usr/share/perl5/Debconf/Element/Select.pm", "/usr/share/perl5/Debconf/Element/Teletype/Boolean.pm", "/usr/share/perl5/Debconf/Element/Teletype/Error.pm", "/usr/share/perl5/Debconf/Element/Teletype/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Teletype/Note.pm", "/usr/share/perl5/Debconf/Element/Teletype/Password.pm", "/usr/share/perl5/Debconf/Element/Teletype/Progress.pm", "/usr/share/perl5/Debconf/Element/Teletype/Select.pm", "/usr/share/perl5/Debconf/Element/Teletype/String.pm", "/usr/share/perl5/Debconf/Element/Teletype/Text.pm", "/usr/share/perl5/Debconf/Element/Web/Boolean.pm", "/usr/share/perl5/Debconf/Element/Web/Error.pm", "/usr/share/perl5/Debconf/Element/Web/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Web/Note.pm", "/usr/share/perl5/Debconf/Element/Web/Password.pm", "/usr/share/perl5/Debconf/Element/Web/Progress.pm", "/usr/share/perl5/Debconf/Element/Web/Select.pm", "/usr/share/perl5/Debconf/Element/Web/String.pm", "/usr/share/perl5/Debconf/Element/Web/Text.pm", "/usr/share/perl5/Debconf/Encoding.pm", "/usr/share/perl5/Debconf/Format.pm", "/usr/share/perl5/Debconf/Format/822.pm", "/usr/share/perl5/Debconf/FrontEnd.pm", "/usr/share/perl5/Debconf/FrontEnd/Dialog.pm", "/usr/share/perl5/Debconf/FrontEnd/Editor.pm", "/usr/share/perl5/Debconf/FrontEnd/Gnome.pm", "/usr/share/perl5/Debconf/FrontEnd/Kde.pm", "/usr/share/perl5/Debconf/FrontEnd/Noninteractive.pm", "/usr/share/perl5/Debconf/FrontEnd/Passthrough.pm", "/usr/share/perl5/Debconf/FrontEnd/Readline.pm", "/usr/share/perl5/Debconf/FrontEnd/ScreenSize.pm", "/usr/share/perl5/Debconf/FrontEnd/Teletype.pm", "/usr/share/perl5/Debconf/FrontEnd/Text.pm", "/usr/share/perl5/Debconf/FrontEnd/Web.pm", "/usr/share/perl5/Debconf/Gettext.pm", "/usr/share/perl5/Debconf/Iterator.pm", "/usr/share/perl5/Debconf/Log.pm", "/usr/share/perl5/Debconf/Path.pm", "/usr/share/perl5/Debconf/Priority.pm", "/usr/share/perl5/Debconf/Question.pm", "/usr/share/perl5/Debconf/Template.pm", "/usr/share/perl5/Debconf/Template/Transient.pm", "/usr/share/perl5/Debconf/TmpFile.pm", "/usr/share/perl5/Debian/DebConf/Client/ConfModule.pm", "/usr/share/pixmaps/debian-logo.png" ], "AnalyzedBy": "dpkg" }, { "ID": "debian-archive-keyring@2025.1", "Name": "debian-archive-keyring", "Identifier": { "PURL": "pkg:deb/debian/debian-archive-keyring@2025.1?arch=all\u0026distro=debian-13.5", "UID": "a22d861380b1187c" }, "Version": "2025.1", "Arch": "all", "SrcName": "debian-archive-keyring", "SrcVersion": "2025.1", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian Release Team \u003cpackages@release.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/share/doc/debian-archive-keyring/NEWS.Debian.gz", "/usr/share/doc/debian-archive-keyring/README", "/usr/share/doc/debian-archive-keyring/changelog.gz", "/usr/share/doc/debian-archive-keyring/copyright", "/usr/share/keyrings/debian-archive-bookworm-automatic.pgp", "/usr/share/keyrings/debian-archive-bookworm-security-automatic.pgp", "/usr/share/keyrings/debian-archive-bookworm-stable.pgp", "/usr/share/keyrings/debian-archive-bullseye-automatic.pgp", "/usr/share/keyrings/debian-archive-bullseye-security-automatic.pgp", "/usr/share/keyrings/debian-archive-bullseye-stable.pgp", "/usr/share/keyrings/debian-archive-keyring.pgp", "/usr/share/keyrings/debian-archive-removed-keys.pgp", "/usr/share/keyrings/debian-archive-trixie-automatic.pgp", "/usr/share/keyrings/debian-archive-trixie-security-automatic.pgp", "/usr/share/keyrings/debian-archive-trixie-stable.pgp" ], "AnalyzedBy": "dpkg" }, { "ID": "debianutils@5.23.2", "Name": "debianutils", "Identifier": { "PURL": "pkg:deb/debian/debianutils@5.23.2?arch=amd64\u0026distro=debian-13.5", "UID": "3c5d0b66afafddbb" }, "Version": "5.23.2", "Arch": "amd64", "SrcName": "debianutils", "SrcVersion": "5.23.2", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "public-domain", "SMAIL-GPL" ], "Maintainer": "Ileana Dumitrescu \u003cileanadumitrescu95@gmail.com\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/ischroot", "/usr/bin/run-parts", "/usr/bin/savelog", "/usr/bin/tempfile", "/usr/bin/which.debianutils", "/usr/sbin/add-shell", "/usr/sbin/installkernel", "/usr/sbin/remove-shell", "/usr/sbin/update-shells", "/usr/share/debianutils/shells", "/usr/share/doc/debianutils/README.shells", "/usr/share/doc/debianutils/changelog.gz", "/usr/share/doc/debianutils/copyright", "/usr/share/man/de/man1/which.debianutils.1.gz", "/usr/share/man/de/man8/add-shell.8.gz", "/usr/share/man/de/man8/installkernel.8.gz", "/usr/share/man/de/man8/remove-shell.8.gz", "/usr/share/man/de/man8/run-parts.8.gz", "/usr/share/man/de/man8/savelog.8.gz", "/usr/share/man/es/man1/which.debianutils.1.gz", "/usr/share/man/es/man8/add-shell.8.gz", "/usr/share/man/es/man8/installkernel.8.gz", "/usr/share/man/es/man8/remove-shell.8.gz", "/usr/share/man/es/man8/run-parts.8.gz", "/usr/share/man/es/man8/savelog.8.gz", "/usr/share/man/fr/man1/which.debianutils.1.gz", "/usr/share/man/fr/man8/add-shell.8.gz", "/usr/share/man/fr/man8/installkernel.8.gz", "/usr/share/man/fr/man8/remove-shell.8.gz", "/usr/share/man/fr/man8/run-parts.8.gz", "/usr/share/man/fr/man8/savelog.8.gz", "/usr/share/man/it/man1/which.debianutils.1.gz", "/usr/share/man/it/man8/add-shell.8.gz", "/usr/share/man/it/man8/installkernel.8.gz", "/usr/share/man/it/man8/remove-shell.8.gz", "/usr/share/man/it/man8/run-parts.8.gz", "/usr/share/man/it/man8/savelog.8.gz", "/usr/share/man/ja/man1/which.debianutils.1.gz", "/usr/share/man/ja/man8/add-shell.8.gz", "/usr/share/man/ja/man8/installkernel.8.gz", "/usr/share/man/ja/man8/remove-shell.8.gz", "/usr/share/man/ja/man8/run-parts.8.gz", "/usr/share/man/ja/man8/savelog.8.gz", "/usr/share/man/man1/ischroot.1.gz", "/usr/share/man/man1/tempfile.1.gz", "/usr/share/man/man1/which.debianutils.1.gz", "/usr/share/man/man8/add-shell.8.gz", "/usr/share/man/man8/installkernel.8.gz", "/usr/share/man/man8/remove-shell.8.gz", "/usr/share/man/man8/run-parts.8.gz", "/usr/share/man/man8/savelog.8.gz", "/usr/share/man/man8/update-shells.8.gz", "/usr/share/man/pl/man1/which.debianutils.1.gz", "/usr/share/man/pl/man8/add-shell.8.gz", "/usr/share/man/pl/man8/installkernel.8.gz", "/usr/share/man/pl/man8/remove-shell.8.gz", "/usr/share/man/pl/man8/run-parts.8.gz", "/usr/share/man/pl/man8/savelog.8.gz", "/usr/share/man/pt/man1/which.debianutils.1.gz", "/usr/share/man/pt/man8/add-shell.8.gz", "/usr/share/man/pt/man8/installkernel.8.gz", "/usr/share/man/pt/man8/remove-shell.8.gz", "/usr/share/man/pt/man8/run-parts.8.gz", "/usr/share/man/pt/man8/savelog.8.gz", "/usr/share/man/sl/man1/which.debianutils.1.gz", "/usr/share/man/sl/man8/add-shell.8.gz", "/usr/share/man/sl/man8/installkernel.8.gz", "/usr/share/man/sl/man8/remove-shell.8.gz", "/usr/share/man/sl/man8/run-parts.8.gz", "/usr/share/man/sl/man8/savelog.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "diffutils@1:3.10-4", "Name": "diffutils", "Identifier": { "PURL": "pkg:deb/debian/diffutils@3.10-4?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "852f693a78aaa149" }, "Version": "3.10", "Release": "4", "Epoch": 1, "Arch": "amd64", "SrcName": "diffutils", "SrcVersion": "3.10", "SrcRelease": "4", "SrcEpoch": 1, "Licenses": [ "GPL-3.0-or-later", "FSFULLR", "LGPL-2.1-or-later", "GPL-3.0-with-autoconf-exception+", "GPL-3.0-only", "GPL-3+ with texinfo exception", "LGPL-2.0-or-later", "GPL-2.0-or-later", "X11", "FSFAP", "GFDL-1.3-no-invariants-only", "LGPL-3.0-or-later", "LGPL-3.0-only", "public-domain", "LGPL-2.0-only", "LGPL-2.1-only", "GPL-2.0-only", "GFDL-1.3-only" ], "Maintainer": "Santiago Vila \u003csanvila@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/cmp", "/usr/bin/diff", "/usr/bin/diff3", "/usr/bin/sdiff", "/usr/share/doc/diffutils/NEWS.gz", "/usr/share/doc/diffutils/changelog.Debian.gz", "/usr/share/doc/diffutils/changelog.gz", "/usr/share/doc/diffutils/copyright", "/usr/share/info/diffutils.info.gz", "/usr/share/locale/bg/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ca/LC_MESSAGES/diffutils.mo", "/usr/share/locale/cs/LC_MESSAGES/diffutils.mo", "/usr/share/locale/da/LC_MESSAGES/diffutils.mo", "/usr/share/locale/de/LC_MESSAGES/diffutils.mo", "/usr/share/locale/el/LC_MESSAGES/diffutils.mo", "/usr/share/locale/eo/LC_MESSAGES/diffutils.mo", "/usr/share/locale/es/LC_MESSAGES/diffutils.mo", "/usr/share/locale/fi/LC_MESSAGES/diffutils.mo", "/usr/share/locale/fr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ga/LC_MESSAGES/diffutils.mo", "/usr/share/locale/gl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/he/LC_MESSAGES/diffutils.mo", "/usr/share/locale/hr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/hu/LC_MESSAGES/diffutils.mo", "/usr/share/locale/id/LC_MESSAGES/diffutils.mo", "/usr/share/locale/it/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ja/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ka/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ko/LC_MESSAGES/diffutils.mo", "/usr/share/locale/lv/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ms/LC_MESSAGES/diffutils.mo", "/usr/share/locale/nb/LC_MESSAGES/diffutils.mo", "/usr/share/locale/nl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pt/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ro/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ru/LC_MESSAGES/diffutils.mo", "/usr/share/locale/sr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/sv/LC_MESSAGES/diffutils.mo", "/usr/share/locale/tr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/uk/LC_MESSAGES/diffutils.mo", "/usr/share/locale/vi/LC_MESSAGES/diffutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/diffutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/diffutils.mo", "/usr/share/man/man1/cmp.1.gz", "/usr/share/man/man1/diff.1.gz", "/usr/share/man/man1/diff3.1.gz", "/usr/share/man/man1/sdiff.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "dpkg@1.22.22", "Name": "dpkg", "Identifier": { "PURL": "pkg:deb/debian/dpkg@1.22.22?arch=amd64\u0026distro=debian-13.5", "UID": "7b97f27e3bec0417" }, "Version": "1.22.22", "Arch": "amd64", "SrcName": "dpkg", "SrcVersion": "1.22.22", "Licenses": [ "GPL-2.0-or-later", "public-domain-s-s-d", "GPL-2.0-only" ], "Maintainer": "Dpkg Developers \u003cdebian-dpkg@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "tar@1.35+dfsg-3.1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/dpkg", "/usr/bin/dpkg-deb", "/usr/bin/dpkg-divert", "/usr/bin/dpkg-maintscript-helper", "/usr/bin/dpkg-query", "/usr/bin/dpkg-realpath", "/usr/bin/dpkg-split", "/usr/bin/dpkg-statoverride", "/usr/bin/dpkg-trigger", "/usr/bin/update-alternatives", "/usr/lib/systemd/system/dpkg-db-backup.service", "/usr/lib/systemd/system/dpkg-db-backup.timer", "/usr/libexec/dpkg/dpkg-db-backup", "/usr/libexec/dpkg/dpkg-db-keeper", "/usr/sbin/start-stop-daemon", "/usr/share/doc/dpkg/AUTHORS", "/usr/share/doc/dpkg/README.api", "/usr/share/doc/dpkg/README.bug-usertags.gz", "/usr/share/doc/dpkg/README.feature-removal-schedule.gz", "/usr/share/doc/dpkg/THANKS.gz", "/usr/share/doc/dpkg/changelog.gz", "/usr/share/doc/dpkg/copyright", "/usr/share/dpkg/abitable", "/usr/share/dpkg/cputable", "/usr/share/dpkg/ostable", "/usr/share/dpkg/sh/dpkg-error.sh", "/usr/share/dpkg/tupletable", "/usr/share/lintian/overrides/dpkg", "/usr/share/lintian/profiles/dpkg/main.profile", "/usr/share/locale/ast/LC_MESSAGES/dpkg.mo", "/usr/share/locale/bs/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ca/LC_MESSAGES/dpkg.mo", "/usr/share/locale/cs/LC_MESSAGES/dpkg.mo", "/usr/share/locale/da/LC_MESSAGES/dpkg.mo", "/usr/share/locale/de/LC_MESSAGES/dpkg.mo", "/usr/share/locale/dz/LC_MESSAGES/dpkg.mo", "/usr/share/locale/el/LC_MESSAGES/dpkg.mo", "/usr/share/locale/eo/LC_MESSAGES/dpkg.mo", "/usr/share/locale/es/LC_MESSAGES/dpkg.mo", "/usr/share/locale/et/LC_MESSAGES/dpkg.mo", "/usr/share/locale/eu/LC_MESSAGES/dpkg.mo", "/usr/share/locale/fr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/gl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/hu/LC_MESSAGES/dpkg.mo", "/usr/share/locale/id/LC_MESSAGES/dpkg.mo", "/usr/share/locale/it/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ja/LC_MESSAGES/dpkg.mo", "/usr/share/locale/km/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ko/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ku/LC_MESSAGES/dpkg.mo", "/usr/share/locale/lt/LC_MESSAGES/dpkg.mo", "/usr/share/locale/mr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nb/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ne/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nn/LC_MESSAGES/dpkg.mo", "/usr/share/locale/oc/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pa/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pt/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ro/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ru/LC_MESSAGES/dpkg.mo", "/usr/share/locale/sk/LC_MESSAGES/dpkg.mo", "/usr/share/locale/sv/LC_MESSAGES/dpkg.mo", "/usr/share/locale/th/LC_MESSAGES/dpkg.mo", "/usr/share/locale/tl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/tr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/vi/LC_MESSAGES/dpkg.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/dpkg.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/dpkg.mo", "/usr/share/man/de/man1/dpkg-deb.1.gz", "/usr/share/man/de/man1/dpkg-divert.1.gz", "/usr/share/man/de/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/de/man1/dpkg-query.1.gz", "/usr/share/man/de/man1/dpkg-realpath.1.gz", "/usr/share/man/de/man1/dpkg-split.1.gz", "/usr/share/man/de/man1/dpkg-statoverride.1.gz", "/usr/share/man/de/man1/dpkg-trigger.1.gz", "/usr/share/man/de/man1/dpkg.1.gz", "/usr/share/man/de/man1/update-alternatives.1.gz", "/usr/share/man/de/man5/dpkg.cfg.5.gz", "/usr/share/man/de/man8/start-stop-daemon.8.gz", "/usr/share/man/es/man5/dpkg.cfg.5.gz", "/usr/share/man/fr/man1/dpkg-divert.1.gz", "/usr/share/man/fr/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/fr/man1/dpkg-query.1.gz", "/usr/share/man/fr/man1/dpkg-realpath.1.gz", "/usr/share/man/fr/man1/dpkg-split.1.gz", "/usr/share/man/fr/man1/dpkg-trigger.1.gz", "/usr/share/man/fr/man1/update-alternatives.1.gz", "/usr/share/man/fr/man5/dpkg.cfg.5.gz", "/usr/share/man/fr/man8/start-stop-daemon.8.gz", "/usr/share/man/it/man5/dpkg.cfg.5.gz", "/usr/share/man/ja/man5/dpkg.cfg.5.gz", "/usr/share/man/man1/dpkg-deb.1.gz", "/usr/share/man/man1/dpkg-divert.1.gz", "/usr/share/man/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/man1/dpkg-query.1.gz", "/usr/share/man/man1/dpkg-realpath.1.gz", "/usr/share/man/man1/dpkg-split.1.gz", "/usr/share/man/man1/dpkg-statoverride.1.gz", "/usr/share/man/man1/dpkg-trigger.1.gz", "/usr/share/man/man1/dpkg.1.gz", "/usr/share/man/man1/update-alternatives.1.gz", "/usr/share/man/man5/dpkg.cfg.5.gz", "/usr/share/man/man8/start-stop-daemon.8.gz", "/usr/share/man/nl/man1/dpkg-deb.1.gz", "/usr/share/man/nl/man1/dpkg-divert.1.gz", "/usr/share/man/nl/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/nl/man1/dpkg-query.1.gz", "/usr/share/man/nl/man1/dpkg-realpath.1.gz", "/usr/share/man/nl/man1/dpkg-split.1.gz", "/usr/share/man/nl/man1/dpkg-statoverride.1.gz", "/usr/share/man/nl/man1/dpkg-trigger.1.gz", "/usr/share/man/nl/man1/dpkg.1.gz", "/usr/share/man/nl/man1/update-alternatives.1.gz", "/usr/share/man/nl/man5/dpkg.cfg.5.gz", "/usr/share/man/nl/man8/start-stop-daemon.8.gz", "/usr/share/man/pl/man5/dpkg.cfg.5.gz", "/usr/share/man/pt/man1/dpkg-deb.1.gz", "/usr/share/man/pt/man1/dpkg-divert.1.gz", "/usr/share/man/pt/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/pt/man1/dpkg-query.1.gz", "/usr/share/man/pt/man1/dpkg-realpath.1.gz", "/usr/share/man/pt/man1/dpkg-split.1.gz", "/usr/share/man/pt/man1/dpkg-statoverride.1.gz", "/usr/share/man/pt/man1/dpkg-trigger.1.gz", "/usr/share/man/pt/man1/dpkg.1.gz", "/usr/share/man/pt/man1/update-alternatives.1.gz", "/usr/share/man/pt/man5/dpkg.cfg.5.gz", "/usr/share/man/pt/man8/start-stop-daemon.8.gz", "/usr/share/man/sv/man1/dpkg-deb.1.gz", "/usr/share/man/sv/man1/dpkg-divert.1.gz", "/usr/share/man/sv/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/sv/man1/dpkg-query.1.gz", "/usr/share/man/sv/man1/dpkg-realpath.1.gz", "/usr/share/man/sv/man1/dpkg-split.1.gz", "/usr/share/man/sv/man1/dpkg-statoverride.1.gz", "/usr/share/man/sv/man1/dpkg-trigger.1.gz", "/usr/share/man/sv/man1/dpkg.1.gz", "/usr/share/man/sv/man1/update-alternatives.1.gz", "/usr/share/man/sv/man5/dpkg.cfg.5.gz", "/usr/share/man/sv/man8/start-stop-daemon.8.gz", "/usr/share/polkit-1/actions/org.dpkg.pkexec.update-alternatives.policy" ], "AnalyzedBy": "dpkg" }, { "ID": "findutils@4.10.0-3", "Name": "findutils", "Identifier": { "PURL": "pkg:deb/debian/findutils@4.10.0-3?arch=amd64\u0026distro=debian-13.5", "UID": "12e741692291b42a" }, "Version": "4.10.0", "Release": "3", "Arch": "amd64", "SrcName": "findutils", "SrcVersion": "4.10.0", "SrcRelease": "3", "Licenses": [ "GFDL-1.3-no-invariants-or-later", "GPL-3.0-or-later", "FSFAP", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "FSFULLR", "GPL-2.0-or-later", "X11", "public-domain", "LGPL-2.1-or-later", "GPL with automake exception", "LGPL-2.0-or-later", "LGPL-3.0-or-later", "BSD-3-Clause", "GPL-3+ with Bison-2.2 exception", "LGPL-3.0-only", "ISC", "GFDL-1.3-only", "GPL-2.0-only", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Andreas Metzler \u003cametzler@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/find", "/usr/bin/xargs", "/usr/share/doc-base/findutils.findutils", "/usr/share/doc/findutils/NEWS.gz", "/usr/share/doc/findutils/README.gz", "/usr/share/doc/findutils/TODO", "/usr/share/doc/findutils/changelog.Debian.gz", "/usr/share/doc/findutils/changelog.gz", "/usr/share/doc/findutils/copyright", "/usr/share/info/find-maint.info.gz", "/usr/share/info/find.info.gz", "/usr/share/locale/be/LC_MESSAGES/findutils.mo", "/usr/share/locale/bg/LC_MESSAGES/findutils.mo", "/usr/share/locale/ca/LC_MESSAGES/findutils.mo", "/usr/share/locale/cs/LC_MESSAGES/findutils.mo", "/usr/share/locale/da/LC_MESSAGES/findutils.mo", "/usr/share/locale/de/LC_MESSAGES/findutils.mo", "/usr/share/locale/el/LC_MESSAGES/findutils.mo", "/usr/share/locale/eo/LC_MESSAGES/findutils.mo", "/usr/share/locale/es/LC_MESSAGES/findutils.mo", "/usr/share/locale/et/LC_MESSAGES/findutils.mo", "/usr/share/locale/fi/LC_MESSAGES/findutils.mo", "/usr/share/locale/fr/LC_MESSAGES/findutils.mo", "/usr/share/locale/ga/LC_MESSAGES/findutils.mo", "/usr/share/locale/gl/LC_MESSAGES/findutils.mo", "/usr/share/locale/hr/LC_MESSAGES/findutils.mo", "/usr/share/locale/hu/LC_MESSAGES/findutils.mo", "/usr/share/locale/id/LC_MESSAGES/findutils.mo", "/usr/share/locale/it/LC_MESSAGES/findutils.mo", "/usr/share/locale/ja/LC_MESSAGES/findutils.mo", "/usr/share/locale/ka/LC_MESSAGES/findutils.mo", "/usr/share/locale/ko/LC_MESSAGES/findutils.mo", "/usr/share/locale/lg/LC_MESSAGES/findutils.mo", "/usr/share/locale/lt/LC_MESSAGES/findutils.mo", "/usr/share/locale/ms/LC_MESSAGES/findutils.mo", "/usr/share/locale/nb/LC_MESSAGES/findutils.mo", "/usr/share/locale/nl/LC_MESSAGES/findutils.mo", "/usr/share/locale/pl/LC_MESSAGES/findutils.mo", "/usr/share/locale/pt/LC_MESSAGES/findutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/findutils.mo", "/usr/share/locale/ro/LC_MESSAGES/findutils.mo", "/usr/share/locale/ru/LC_MESSAGES/findutils.mo", "/usr/share/locale/sk/LC_MESSAGES/findutils.mo", "/usr/share/locale/sl/LC_MESSAGES/findutils.mo", "/usr/share/locale/sr/LC_MESSAGES/findutils.mo", "/usr/share/locale/sv/LC_MESSAGES/findutils.mo", "/usr/share/locale/tr/LC_MESSAGES/findutils.mo", "/usr/share/locale/uk/LC_MESSAGES/findutils.mo", "/usr/share/locale/vi/LC_MESSAGES/findutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/findutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/findutils.mo", "/usr/share/man/man1/find.1.gz", "/usr/share/man/man1/xargs.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gcc-14-base@14.2.0-19", "Name": "gcc-14-base", "Identifier": { "PURL": "pkg:deb/debian/gcc-14-base@14.2.0-19?arch=amd64\u0026distro=debian-13.5", "UID": "371c061d08215a1b" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Licenses": [ "GPL-2.0-or-later", "GPL-3.0-only", "GFDL-1.2-only", "Artistic-2.0", "LGPL-2.0-or-later" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/share/doc/gcc-14-base/README.Debian.amd64.gz", "/usr/share/doc/gcc-14-base/TODO.Debian", "/usr/share/doc/gcc-14-base/changelog.Debian.gz", "/usr/share/doc/gcc-14-base/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "grep@3.11-4", "Name": "grep", "Identifier": { "PURL": "pkg:deb/debian/grep@3.11-4?arch=amd64\u0026distro=debian-13.5", "UID": "6ce8b4eed9c0d137" }, "Version": "3.11", "Release": "4", "Arch": "amd64", "SrcName": "grep", "SrcVersion": "3.11", "SrcRelease": "4", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/egrep", "/usr/bin/fgrep", "/usr/bin/grep", "/usr/bin/rgrep", "/usr/share/doc/grep/AUTHORS", "/usr/share/doc/grep/NEWS.Debian.gz", "/usr/share/doc/grep/NEWS.gz", "/usr/share/doc/grep/README", "/usr/share/doc/grep/THANKS.gz", "/usr/share/doc/grep/TODO.gz", "/usr/share/doc/grep/changelog.Debian.gz", "/usr/share/doc/grep/changelog.gz", "/usr/share/doc/grep/copyright", "/usr/share/info/grep.info.gz", "/usr/share/locale/af/LC_MESSAGES/grep.mo", "/usr/share/locale/be/LC_MESSAGES/grep.mo", "/usr/share/locale/bg/LC_MESSAGES/grep.mo", "/usr/share/locale/ca/LC_MESSAGES/grep.mo", "/usr/share/locale/cs/LC_MESSAGES/grep.mo", "/usr/share/locale/da/LC_MESSAGES/grep.mo", "/usr/share/locale/de/LC_MESSAGES/grep.mo", "/usr/share/locale/el/LC_MESSAGES/grep.mo", "/usr/share/locale/eo/LC_MESSAGES/grep.mo", "/usr/share/locale/es/LC_MESSAGES/grep.mo", "/usr/share/locale/et/LC_MESSAGES/grep.mo", "/usr/share/locale/eu/LC_MESSAGES/grep.mo", "/usr/share/locale/fi/LC_MESSAGES/grep.mo", "/usr/share/locale/fr/LC_MESSAGES/grep.mo", "/usr/share/locale/ga/LC_MESSAGES/grep.mo", "/usr/share/locale/gl/LC_MESSAGES/grep.mo", "/usr/share/locale/he/LC_MESSAGES/grep.mo", "/usr/share/locale/hr/LC_MESSAGES/grep.mo", "/usr/share/locale/hu/LC_MESSAGES/grep.mo", "/usr/share/locale/id/LC_MESSAGES/grep.mo", "/usr/share/locale/it/LC_MESSAGES/grep.mo", "/usr/share/locale/ja/LC_MESSAGES/grep.mo", "/usr/share/locale/ka/LC_MESSAGES/grep.mo", "/usr/share/locale/ko/LC_MESSAGES/grep.mo", "/usr/share/locale/ky/LC_MESSAGES/grep.mo", "/usr/share/locale/lt/LC_MESSAGES/grep.mo", "/usr/share/locale/nb/LC_MESSAGES/grep.mo", "/usr/share/locale/nl/LC_MESSAGES/grep.mo", "/usr/share/locale/pa/LC_MESSAGES/grep.mo", "/usr/share/locale/pl/LC_MESSAGES/grep.mo", "/usr/share/locale/pt/LC_MESSAGES/grep.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/grep.mo", "/usr/share/locale/ro/LC_MESSAGES/grep.mo", "/usr/share/locale/ru/LC_MESSAGES/grep.mo", "/usr/share/locale/sk/LC_MESSAGES/grep.mo", "/usr/share/locale/sl/LC_MESSAGES/grep.mo", "/usr/share/locale/sr/LC_MESSAGES/grep.mo", "/usr/share/locale/sv/LC_MESSAGES/grep.mo", "/usr/share/locale/ta/LC_MESSAGES/grep.mo", "/usr/share/locale/th/LC_MESSAGES/grep.mo", "/usr/share/locale/tr/LC_MESSAGES/grep.mo", "/usr/share/locale/uk/LC_MESSAGES/grep.mo", "/usr/share/locale/vi/LC_MESSAGES/grep.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/grep.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/grep.mo", "/usr/share/man/man1/grep.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gzip@1.13-1", "Name": "gzip", "Identifier": { "PURL": "pkg:deb/debian/gzip@1.13-1?arch=amd64\u0026distro=debian-13.5", "UID": "954545ce99bc687e" }, "Version": "1.13", "Release": "1", "Arch": "amd64", "SrcName": "gzip", "SrcVersion": "1.13", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "GFDL-1.3+-no-invariant", "FSF-manpages", "GPL-3.0-only", "GFDL-3" ], "Maintainer": "Milan Kupcevic \u003cmilan@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/gunzip", "/usr/bin/gzexe", "/usr/bin/gzip", "/usr/bin/zcat", "/usr/bin/zcmp", "/usr/bin/zdiff", "/usr/bin/zegrep", "/usr/bin/zfgrep", "/usr/bin/zforce", "/usr/bin/zgrep", "/usr/bin/zless", "/usr/bin/zmore", "/usr/bin/znew", "/usr/share/doc/gzip/NEWS.gz", "/usr/share/doc/gzip/README.gz", "/usr/share/doc/gzip/TODO", "/usr/share/doc/gzip/changelog.Debian.gz", "/usr/share/doc/gzip/changelog.gz", "/usr/share/doc/gzip/copyright", "/usr/share/info/gzip.info.gz", "/usr/share/man/man1/gzexe.1.gz", "/usr/share/man/man1/gzip.1.gz", "/usr/share/man/man1/zdiff.1.gz", "/usr/share/man/man1/zforce.1.gz", "/usr/share/man/man1/zgrep.1.gz", "/usr/share/man/man1/zless.1.gz", "/usr/share/man/man1/zmore.1.gz", "/usr/share/man/man1/znew.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "hostname@3.25", "Name": "hostname", "Identifier": { "PURL": "pkg:deb/debian/hostname@3.25?arch=amd64\u0026distro=debian-13.5", "UID": "641772722328aedf" }, "Version": "3.25", "Arch": "amd64", "SrcName": "hostname", "SrcVersion": "3.25", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Michael Meskes \u003cmeskes@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/hostname", "/usr/share/doc/hostname/changelog.gz", "/usr/share/doc/hostname/copyright", "/usr/share/man/man1/hostname.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "init-system-helpers@1.69~deb13u1", "Name": "init-system-helpers", "Identifier": { "PURL": "pkg:deb/debian/init-system-helpers@1.69~deb13u1?arch=all\u0026distro=debian-13.5", "UID": "cb52819ec2f1a236" }, "Version": "1.69~deb13u1", "Arch": "all", "SrcName": "init-system-helpers", "SrcVersion": "1.69~deb13u1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/deb-systemd-helper", "/usr/bin/deb-systemd-invoke", "/usr/sbin/invoke-rc.d", "/usr/sbin/service", "/usr/sbin/update-rc.d", "/usr/share/bug/init-system-helpers/control", "/usr/share/doc/init-system-helpers/README.invoke-rc.d.gz", "/usr/share/doc/init-system-helpers/README.policy-rc.d.gz", "/usr/share/doc/init-system-helpers/changelog.gz", "/usr/share/doc/init-system-helpers/copyright", "/usr/share/lintian/overrides/init-system-helpers", "/usr/share/man/man1/deb-systemd-helper.1p.gz", "/usr/share/man/man1/deb-systemd-invoke.1p.gz", "/usr/share/man/man8/invoke-rc.d.8.gz", "/usr/share/man/man8/service.8.gz", "/usr/share/man/man8/update-rc.d.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libacl1@2.3.2-2+b1", "Name": "libacl1", "Identifier": { "PURL": "pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64\u0026distro=debian-13.5", "UID": "f9f7789d147b9636" }, "Version": "2.3.2", "Release": "2+b1", "Arch": "amd64", "SrcName": "acl", "SrcVersion": "2.3.2", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.1-only" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libacl.so.1.1.2302", "/usr/share/doc/libacl1/changelog.Debian.amd64.gz", "/usr/share/doc/libacl1/changelog.Debian.gz", "/usr/share/doc/libacl1/changelog.gz", "/usr/share/doc/libacl1/copyright", "/usr/share/lintian/overrides/libacl1" ], "AnalyzedBy": "dpkg" }, { "ID": "libapt-pkg7.0@3.0.3", "Name": "libapt-pkg7.0", "Identifier": { "PURL": "pkg:deb/debian/libapt-pkg7.0@3.0.3?arch=amd64\u0026distro=debian-13.5", "UID": "5549812c55d79bea" }, "Version": "3.0.3", "Arch": "amd64", "SrcName": "apt", "SrcVersion": "3.0.3", "Licenses": [ "GPL-2.0-or-later", "curl", "BSD-3-Clause", "MIT", "GPL-2.0-only" ], "Maintainer": "APT Development Team \u003cdeity@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-6", "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "liblz4-1@1.10.0-4", "liblzma5@5.8.1-1", "libssl3t64@3.5.6-1~deb13u1", "libstdc++6@14.2.0-19", "libsystemd0@257.13-1~deb13u1", "libudev1@257.13-1~deb13u1", "libxxhash0@0.8.3-2", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libapt-pkg.so.7.0.0", "/usr/share/doc/libapt-pkg7.0/NEWS.Debian.gz", "/usr/share/doc/libapt-pkg7.0/changelog.gz", "/usr/share/doc/libapt-pkg7.0/copyright", "/usr/share/locale/ar/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ast/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/bg/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/bs/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ca/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/cs/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/cy/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/da/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/de/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/dz/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/el/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/es/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/eu/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/fi/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/fr/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/gl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/hu/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/it/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ja/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/km/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ko/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ku/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/lt/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/mr/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/nb/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ne/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/nl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/nn/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/pl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/pt/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ro/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ru/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/sk/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/sl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/sv/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/th/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/tl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/tr/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/uk/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/vi/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/libapt-pkg7.0.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libattr1@1:2.5.2-3", "Name": "libattr1", "Identifier": { "PURL": "pkg:deb/debian/libattr1@2.5.2-3?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "90d554a582a8683b" }, "Version": "2.5.2", "Release": "3", "Epoch": 1, "Arch": "amd64", "SrcName": "attr", "SrcVersion": "2.5.2", "SrcRelease": "3", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.1-only" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libattr.so.1.1.2502", "/usr/share/doc/libattr1/changelog.Debian.gz", "/usr/share/doc/libattr1/changelog.gz", "/usr/share/doc/libattr1/copyright", "/usr/share/lintian/overrides/libattr1" ], "AnalyzedBy": "dpkg" }, { "ID": "libaudit-common@1:4.0.2-2", "Name": "libaudit-common", "Identifier": { "PURL": "pkg:deb/debian/libaudit-common@4.0.2-2?arch=all\u0026distro=debian-13.5\u0026epoch=1", "UID": "d20cd9a11d8e018d" }, "Version": "4.0.2", "Release": "2", "Epoch": 1, "Arch": "all", "SrcName": "audit", "SrcVersion": "4.0.2", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only", "GPL-1.0-only" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/share/doc/libaudit-common/changelog.Debian.gz", "/usr/share/doc/libaudit-common/changelog.gz", "/usr/share/doc/libaudit-common/copyright", "/usr/share/man/man5/libaudit.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libaudit1@1:4.0.2-2+b2", "Name": "libaudit1", "Identifier": { "PURL": "pkg:deb/debian/libaudit1@4.0.2-2%2Bb2?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "c47a55b8e27ace3c" }, "Version": "4.0.2", "Release": "2+b2", "Epoch": 1, "Arch": "amd64", "SrcName": "audit", "SrcVersion": "4.0.2", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only", "GPL-1.0-only" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit-common@1:4.0.2-2", "libc6@2.41-12+deb13u3", "libcap-ng0@0.8.5-4+b1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0", "/usr/share/doc/libaudit1/changelog.Debian.amd64.gz", "/usr/share/doc/libaudit1/changelog.Debian.gz", "/usr/share/doc/libaudit1/changelog.gz", "/usr/share/doc/libaudit1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libblkid1@2.41-5", "Name": "libblkid1", "Identifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "51bf0af8d40f4a01" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0", "/usr/share/doc/libblkid1/NEWS.Debian.gz", "/usr/share/doc/libblkid1/changelog.Debian.gz", "/usr/share/doc/libblkid1/changelog.gz", "/usr/share/doc/libblkid1/copyright", "/usr/share/lintian/overrides/libblkid1" ], "AnalyzedBy": "dpkg" }, { "ID": "libbrotli1@1.1.0-2+b7", "Name": "libbrotli1", "Identifier": { "PURL": "pkg:deb/debian/libbrotli1@1.1.0-2%2Bb7?arch=amd64\u0026distro=debian-13.5", "UID": "3f78e505ac03922b" }, "Version": "1.1.0", "Release": "2+b7", "Arch": "amd64", "SrcName": "brotli", "SrcVersion": "1.1.0", "SrcRelease": "2", "Licenses": [ "MIT" ], "Maintainer": "Tomasz Buchert \u003ctomasz@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbrotlicommon.so.1.1.0", "/usr/lib/x86_64-linux-gnu/libbrotlidec.so.1.1.0", "/usr/lib/x86_64-linux-gnu/libbrotlienc.so.1.1.0", "/usr/share/doc/libbrotli1/changelog.Debian.amd64.gz", "/usr/share/doc/libbrotli1/changelog.Debian.gz", "/usr/share/doc/libbrotli1/changelog.gz", "/usr/share/doc/libbrotli1/copyright", "/usr/share/lintian/overrides/libbrotli1" ], "AnalyzedBy": "dpkg" }, { "ID": "libbsd0@0.12.2-2", "Name": "libbsd0", "Identifier": { "PURL": "pkg:deb/debian/libbsd0@0.12.2-2?arch=amd64\u0026distro=debian-13.5", "UID": "a8f4afa42f768363" }, "Version": "0.12.2", "Release": "2", "Arch": "amd64", "SrcName": "libbsd", "SrcVersion": "0.12.2", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-Regents", "BSD-2-Clause-NetBSD", "BSD-3-clause-author", "BSD-3-clause-John-Birrell", "BSD-5-clause-Peter-Wemm", "BSD-2-Clause", "BSD-2-clause-verbatim", "BSD-2-clause-author", "ISC", "ISC-Original", "MIT", "public-domain", "Beerware" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libmd0@1.1.0-2+b1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbsd.so.0.12.2", "/usr/share/doc/libbsd0/changelog.Debian.gz", "/usr/share/doc/libbsd0/changelog.gz", "/usr/share/doc/libbsd0/copyright", "/usr/share/lintian/overrides/libbsd0" ], "AnalyzedBy": "dpkg" }, { "ID": "libbz2-1.0@1.0.8-6", "Name": "libbz2-1.0", "Identifier": { "PURL": "pkg:deb/debian/libbz2-1.0@1.0.8-6?arch=amd64\u0026distro=debian-13.5", "UID": "2da429aca83dde92" }, "Version": "1.0.8", "Release": "6", "Arch": "amd64", "SrcName": "bzip2", "SrcVersion": "1.0.8", "SrcRelease": "6", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbz2.so.1.0.4", "/usr/share/doc/libbz2-1.0/changelog.Debian.gz", "/usr/share/doc/libbz2-1.0/changelog.gz", "/usr/share/doc/libbz2-1.0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libc-bin@2.41-12+deb13u3", "Name": "libc-bin", "Identifier": { "PURL": "pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "c45af597301c8c0b" }, "Version": "2.41", "Release": "12+deb13u3", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.41", "SrcRelease": "12+deb13u3", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.0-or-later", "LGPL-2.1+-with-link-exception", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2+-with-link-exception", "GPL-2.0-only", "GPL-3.0-or-later", "FSFAP", "Carnegie", "Inner-Net", "MIT-like-Lord", "BSD-like-Spencer", "PCRE", "BSD-3-clause-Carnegie", "Unicode-DFS-2016", "BSL-1.0", "SunPro", "CORE-MATH", "BSD-3-clause-Berkeley", "BSD-3-clause-WIDE", "BSD-2-Clause", "BSD-3-clause-Oracle", "DEC", "IBM", "ISC", "Univ-Coimbra", "public-domain", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/getconf", "/usr/bin/getent", "/usr/bin/iconv", "/usr/bin/ldd", "/usr/bin/locale", "/usr/bin/localedef", "/usr/bin/pldd", "/usr/bin/tzselect", "/usr/bin/zdump", "/usr/lib/locale/C.utf8/LC_ADDRESS", "/usr/lib/locale/C.utf8/LC_COLLATE", "/usr/lib/locale/C.utf8/LC_CTYPE", "/usr/lib/locale/C.utf8/LC_IDENTIFICATION", "/usr/lib/locale/C.utf8/LC_MEASUREMENT", "/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES", "/usr/lib/locale/C.utf8/LC_MONETARY", "/usr/lib/locale/C.utf8/LC_NAME", "/usr/lib/locale/C.utf8/LC_NUMERIC", "/usr/lib/locale/C.utf8/LC_PAPER", "/usr/lib/locale/C.utf8/LC_TELEPHONE", "/usr/lib/locale/C.utf8/LC_TIME", "/usr/sbin/iconvconfig", "/usr/sbin/ldconfig", "/usr/sbin/zic", "/usr/share/doc/libc-bin/changelog.Debian.gz", "/usr/share/doc/libc-bin/changelog.gz", "/usr/share/doc/libc-bin/copyright", "/usr/share/libc-bin/nsswitch.conf", "/usr/share/lintian/overrides/libc-bin", "/usr/share/man/man1/getconf.1.gz", "/usr/share/man/man1/tzselect.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libc6@2.41-12+deb13u3", "Name": "libc6", "Identifier": { "PURL": "pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "2a1acf211abcdd46" }, "Version": "2.41", "Release": "12+deb13u3", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.41", "SrcRelease": "12+deb13u3", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.0-or-later", "LGPL-2.1+-with-link-exception", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2+-with-link-exception", "GPL-2.0-only", "GPL-3.0-or-later", "FSFAP", "Carnegie", "Inner-Net", "MIT-like-Lord", "BSD-like-Spencer", "PCRE", "BSD-3-clause-Carnegie", "Unicode-DFS-2016", "BSL-1.0", "SunPro", "CORE-MATH", "BSD-3-clause-Berkeley", "BSD-3-clause-WIDE", "BSD-2-Clause", "BSD-3-clause-Oracle", "DEC", "IBM", "ISC", "Univ-Coimbra", "public-domain", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/gconv/ANSI_X3.110.so", "/usr/lib/x86_64-linux-gnu/gconv/ARMSCII-8.so", "/usr/lib/x86_64-linux-gnu/gconv/ASMO_449.so", "/usr/lib/x86_64-linux-gnu/gconv/BIG5.so", "/usr/lib/x86_64-linux-gnu/gconv/BIG5HKSCS.so", "/usr/lib/x86_64-linux-gnu/gconv/BRF.so", "/usr/lib/x86_64-linux-gnu/gconv/CP10007.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1125.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1250.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1251.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1252.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1253.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1254.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1255.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1256.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1257.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1258.so", "/usr/lib/x86_64-linux-gnu/gconv/CP737.so", "/usr/lib/x86_64-linux-gnu/gconv/CP770.so", "/usr/lib/x86_64-linux-gnu/gconv/CP771.so", "/usr/lib/x86_64-linux-gnu/gconv/CP772.so", "/usr/lib/x86_64-linux-gnu/gconv/CP773.so", "/usr/lib/x86_64-linux-gnu/gconv/CP774.so", "/usr/lib/x86_64-linux-gnu/gconv/CP775.so", "/usr/lib/x86_64-linux-gnu/gconv/CP932.so", "/usr/lib/x86_64-linux-gnu/gconv/CSN_369103.so", "/usr/lib/x86_64-linux-gnu/gconv/CWI.so", "/usr/lib/x86_64-linux-gnu/gconv/DEC-MCS.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-AT-DE-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-AT-DE.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-CA-FR.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-DK-NO-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-DK-NO.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES-S.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FI-SE-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FI-SE.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FR.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-IS-FRISS.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-IT.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-PT.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-UK.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-US.so", "/usr/lib/x86_64-linux-gnu/gconv/ECMA-CYRILLIC.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-CN.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JP-MS.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JP.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-KR.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-TW.so", "/usr/lib/x86_64-linux-gnu/gconv/GB18030.so", "/usr/lib/x86_64-linux-gnu/gconv/GBBIG5.so", "/usr/lib/x86_64-linux-gnu/gconv/GBGBK.so", "/usr/lib/x86_64-linux-gnu/gconv/GBK.so", "/usr/lib/x86_64-linux-gnu/gconv/GEORGIAN-ACADEMY.so", "/usr/lib/x86_64-linux-gnu/gconv/GEORGIAN-PS.so", "/usr/lib/x86_64-linux-gnu/gconv/GOST_19768-74.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK-CCITT.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK7-OLD.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK7.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-GREEK8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-ROMAN8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-ROMAN9.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-THAI8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-TURKISH8.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM037.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM038.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1004.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1008.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1008_420.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1025.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1026.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1046.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1047.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1097.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1112.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1122.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1123.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1124.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1129.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1130.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1132.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1133.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1137.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1140.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1141.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1142.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1143.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1144.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1145.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1146.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1147.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1148.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1149.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1153.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1154.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1155.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1156.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1157.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1158.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1160.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1161.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1162.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1163.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1164.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1166.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1167.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM12712.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1364.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1371.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1388.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1390.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1399.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM16804.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM256.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM273.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM274.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM275.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM277.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM278.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM280.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM281.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM284.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM285.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM290.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM297.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM420.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM423.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM424.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM437.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4517.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4899.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4909.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4971.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM500.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM5347.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM803.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM850.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM851.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM852.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM855.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM856.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM857.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM858.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM860.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM861.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM862.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM863.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM864.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM865.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM866.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM866NAV.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM868.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM869.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM870.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM871.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM874.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM875.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM880.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM891.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM901.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM902.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM903.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9030.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM904.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM905.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9066.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM918.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM921.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM922.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM930.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM932.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM933.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM935.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM937.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM939.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM943.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9448.so", "/usr/lib/x86_64-linux-gnu/gconv/IEC_P27-1.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS-8.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS-CYRILLIC.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS.so", "/usr/lib/x86_64-linux-gnu/gconv/ISIRI-3342.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-CN-EXT.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-CN.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-JP-3.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-JP.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-KR.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-IR-197.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-IR-209.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO646.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-1.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-10.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-11.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-13.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-14.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-15.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-16.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-2.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-3.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-4.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-5.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-6.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-7.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-8.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-9.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-9E.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_10367-BOX.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_11548-1.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_2033.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5427-EXT.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5427.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5428.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_6937-2.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_6937.so", "/usr/lib/x86_64-linux-gnu/gconv/JOHAB.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI-8.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-R.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-RU.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-T.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-U.so", "/usr/lib/x86_64-linux-gnu/gconv/LATIN-GREEK-1.so", "/usr/lib/x86_64-linux-gnu/gconv/LATIN-GREEK.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-CENTRALEUROPE.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-IS.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-SAMI.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-UK.so", "/usr/lib/x86_64-linux-gnu/gconv/MACINTOSH.so", "/usr/lib/x86_64-linux-gnu/gconv/MIK.so", "/usr/lib/x86_64-linux-gnu/gconv/NATS-DANO.so", "/usr/lib/x86_64-linux-gnu/gconv/NATS-SEFI.so", "/usr/lib/x86_64-linux-gnu/gconv/PT154.so", "/usr/lib/x86_64-linux-gnu/gconv/RK1048.so", "/usr/lib/x86_64-linux-gnu/gconv/SAMI-WS2.so", "/usr/lib/x86_64-linux-gnu/gconv/SHIFT_JISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/SJIS.so", "/usr/lib/x86_64-linux-gnu/gconv/T.61.so", "/usr/lib/x86_64-linux-gnu/gconv/TCVN5712-1.so", "/usr/lib/x86_64-linux-gnu/gconv/TIS-620.so", "/usr/lib/x86_64-linux-gnu/gconv/TSCII.so", "/usr/lib/x86_64-linux-gnu/gconv/UHC.so", "/usr/lib/x86_64-linux-gnu/gconv/UNICODE.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-16.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-32.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-7.so", "/usr/lib/x86_64-linux-gnu/gconv/VISCII.so", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.d/gconv-modules-extra.conf", "/usr/lib/x86_64-linux-gnu/gconv/libCNS.so", "/usr/lib/x86_64-linux-gnu/gconv/libGB.so", "/usr/lib/x86_64-linux-gnu/gconv/libISOIR165.so", "/usr/lib/x86_64-linux-gnu/gconv/libJIS.so", "/usr/lib/x86_64-linux-gnu/gconv/libJISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/libKSC.so", "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", "/usr/lib/x86_64-linux-gnu/libBrokenLocale.so.1", "/usr/lib/x86_64-linux-gnu/libanl.so.1", "/usr/lib/x86_64-linux-gnu/libc.so.6", "/usr/lib/x86_64-linux-gnu/libc_malloc_debug.so.0", "/usr/lib/x86_64-linux-gnu/libdl.so.2", "/usr/lib/x86_64-linux-gnu/libm.so.6", "/usr/lib/x86_64-linux-gnu/libmemusage.so", "/usr/lib/x86_64-linux-gnu/libmvec.so.1", "/usr/lib/x86_64-linux-gnu/libnsl.so.1", "/usr/lib/x86_64-linux-gnu/libnss_compat.so.2", "/usr/lib/x86_64-linux-gnu/libnss_dns.so.2", "/usr/lib/x86_64-linux-gnu/libnss_files.so.2", "/usr/lib/x86_64-linux-gnu/libnss_hesiod.so.2", "/usr/lib/x86_64-linux-gnu/libpcprofile.so", "/usr/lib/x86_64-linux-gnu/libpthread.so.0", "/usr/lib/x86_64-linux-gnu/libresolv.so.2", "/usr/lib/x86_64-linux-gnu/librt.so.1", "/usr/lib/x86_64-linux-gnu/libthread_db.so.1", "/usr/lib/x86_64-linux-gnu/libutil.so.1", "/usr/share/doc/libc6/NEWS.Debian.gz", "/usr/share/doc/libc6/NEWS.gz", "/usr/share/doc/libc6/README.Debian.gz", "/usr/share/doc/libc6/README.hesiod.gz", "/usr/share/doc/libc6/changelog.Debian.gz", "/usr/share/doc/libc6/changelog.gz", "/usr/share/doc/libc6/copyright", "/usr/share/lintian/overrides/libc6" ], "AnalyzedBy": "dpkg" }, { "ID": "libcap-ng0@0.8.5-4+b1", "Name": "libcap-ng0", "Identifier": { "PURL": "pkg:deb/debian/libcap-ng0@0.8.5-4%2Bb1?arch=amd64\u0026distro=debian-13.5", "UID": "9b7c2d5667513e48" }, "Version": "0.8.5", "Release": "4+b1", "Arch": "amd64", "SrcName": "libcap-ng", "SrcVersion": "0.8.5", "SrcRelease": "4", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later", "GPL-3.0-only", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Håvard F. Aasen \u003chavard.f.aasen@pfft.no\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0", "/usr/lib/x86_64-linux-gnu/libdrop_ambient.so.0.0.0", "/usr/share/doc/libcap-ng0/changelog.Debian.amd64.gz", "/usr/share/doc/libcap-ng0/changelog.Debian.gz", "/usr/share/doc/libcap-ng0/changelog.gz", "/usr/share/doc/libcap-ng0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcap2@1:2.75-10+deb13u1+b1", "Name": "libcap2", "Identifier": { "PURL": "pkg:deb/debian/libcap2@2.75-10%2Bdeb13u1%2Bb1?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "7cefa0399e4d88d4" }, "Version": "2.75", "Release": "10+deb13u1+b1", "Epoch": 1, "Arch": "amd64", "SrcName": "libcap2", "SrcVersion": "2.75", "SrcRelease": "10+deb13u1", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Christian Kastner \u003cckk@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcap.so.2.75", "/usr/lib/x86_64-linux-gnu/libpsx.so.2.75", "/usr/share/doc/libcap2/changelog.Debian.amd64.gz", "/usr/share/doc/libcap2/changelog.Debian.gz", "/usr/share/doc/libcap2/changelog.gz", "/usr/share/doc/libcap2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcom-err2@1.47.2-3+b11", "Name": "libcom-err2", "Identifier": { "PURL": "pkg:deb/debian/libcom-err2@1.47.2-3%2Bb11?arch=amd64\u0026distro=debian-13.5", "UID": "4f71a9cbca45d908" }, "Version": "1.47.2", "Release": "3+b11", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.2", "SrcRelease": "3", "Licenses": [ "GPL-2.0-only", "GPL-2.0-or-later", "0BSD", "MIT", "BSD-3-Clause-Variant", "BSD-3-Clause", "BSD-4-Clause-CMU", "LGPL-2.0-only", "Apache-2.0", "ISC", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcom_err.so.2.1", "/usr/share/doc/libcom-err2/changelog.Debian.amd64.gz", "/usr/share/doc/libcom-err2/changelog.Debian.gz", "/usr/share/doc/libcom-err2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcrypt1@1:4.4.38-1", "Name": "libcrypt1", "Identifier": { "PURL": "pkg:deb/debian/libcrypt1@4.4.38-1?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "afe984ba824f92ac" }, "Version": "4.4.38", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxcrypt", "SrcVersion": "4.4.38", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcrypt.so.1.1.0", "/usr/share/doc/libcrypt1/changelog.Debian.gz", "/usr/share/doc/libcrypt1/changelog.gz", "/usr/share/doc/libcrypt1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcurl4t64@8.14.1-2+deb13u3", "Name": "libcurl4t64", "Identifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "b5b704983d824ef5" }, "Version": "8.14.1", "Release": "2+deb13u3", "Arch": "amd64", "SrcName": "curl", "SrcVersion": "8.14.1", "SrcRelease": "2+deb13u3", "Licenses": [ "curl", "OLDAP-2.8", "ISC", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "GPL-2+ with Libtool exception", "BSD-3-Clause", "BSD-4-Clause-UC", "FSFULLR", "X11", "GPL-2.0-only" ], "Maintainer": "Debian Curl Maintainers \u003cteam+curl@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbrotli1@1.1.0-2+b7", "libc6@2.41-12+deb13u3", "libgssapi-krb5-2@1.21.3-5+deb13u1", "libidn2-0@2.3.8-2", "libldap2@2.6.10+dfsg-1", "libnghttp2-14@1.64.0-1.1+deb13u1", "libnghttp3-9@1.8.0-1", "libpsl5t64@0.21.2-1.1+b1", "librtmp1@2.4+20151223.gitfa8646d.1-2+b5", "libssh2-1t64@1.11.1-1", "libssl3t64@3.5.6-1~deb13u1", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcurl.so.4.8.0", "/usr/share/doc/libcurl4t64/changelog.Debian.gz", "/usr/share/doc/libcurl4t64/changelog.gz", "/usr/share/doc/libcurl4t64/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdb5.3t64@5.3.28+dfsg2-9", "Name": "libdb5.3t64", "Identifier": { "PURL": "pkg:deb/debian/libdb5.3t64@5.3.28%2Bdfsg2-9?arch=amd64\u0026distro=debian-13.5", "UID": "2f5f1c2fd77295dc" }, "Version": "5.3.28+dfsg2", "Release": "9", "Arch": "amd64", "SrcName": "db5.3", "SrcVersion": "5.3.28+dfsg2", "SrcRelease": "9", "Licenses": [ "Sleepycat", "BSD-3-Clause", "MS-PL", "GPL-2.0-or-later", "Artistic-2.0", "X11", "MIT-old", "TCL-like", "BSD-3-clause-fjord", "GPL-3.0-only", "Zlib" ], "Maintainer": "Debian QA Group \u003cpackages@qa.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdb-5.3.so", "/usr/share/doc/libdb5.3t64/build_signature_amd64.txt", "/usr/share/doc/libdb5.3t64/changelog.Debian.gz", "/usr/share/doc/libdb5.3t64/copyright", "/usr/share/lintian/overrides/libdb5.3t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libdebconfclient0@0.280", "Name": "libdebconfclient0", "Identifier": { "PURL": "pkg:deb/debian/libdebconfclient0@0.280?arch=amd64\u0026distro=debian-13.5", "UID": "fcad452fa456130" }, "Version": "0.280", "Arch": "amd64", "SrcName": "cdebconf", "SrcVersion": "0.280", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Install System Team \u003cdebian-boot@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdebconfclient.so.0.0.0", "/usr/share/doc/libdebconfclient0/changelog.gz", "/usr/share/doc/libdebconfclient0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libffi8@3.4.8-2", "Name": "libffi8", "Identifier": { "PURL": "pkg:deb/debian/libffi8@3.4.8-2?arch=amd64\u0026distro=debian-13.5", "UID": "9b9f5a0532948cab" }, "Version": "3.4.8", "Release": "2", "Arch": "amd64", "SrcName": "libffi", "SrcVersion": "3.4.8", "SrcRelease": "2", "Licenses": [ "MIT", "X11", "GPL-2.0-or-later", "GPL-3.0-or-later", "MPL-1.1", "LGPL-2.1-or-later", "public-domain" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:c529e1b2553946dcc9afa2d77e33a75f23d3702e0b4a7911b67e2f1fe45a4939" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libffi.so.8.1.4", "/usr/share/doc/libffi8/changelog.Debian.gz", "/usr/share/doc/libffi8/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgcc-s1@14.2.0-19", "Name": "libgcc-s1", "Identifier": { "PURL": "pkg:deb/debian/libgcc-s1@14.2.0-19?arch=amd64\u0026distro=debian-13.5", "UID": "6ebf985ba3bd76f3" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgcc_s.so.1", "/usr/share/lintian/overrides/libgcc-s1" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdbm6t64@1.24-2", "Name": "libgdbm6t64", "Identifier": { "PURL": "pkg:deb/debian/libgdbm6t64@1.24-2?arch=amd64\u0026distro=debian-13.5", "UID": "942142133e693ac4" }, "Version": "1.24", "Release": "2", "Arch": "amd64", "SrcName": "gdbm", "SrcVersion": "1.24", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-2.0-or-later", "GFDL-1.3-no-invariants-or-later", "GPL-3.0-only", "GPL-2.0-only" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:c529e1b2553946dcc9afa2d77e33a75f23d3702e0b4a7911b67e2f1fe45a4939" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgdbm.so.6.0.0", "/usr/share/doc/libgdbm6t64/changelog.Debian.gz", "/usr/share/doc/libgdbm6t64/changelog.gz", "/usr/share/doc/libgdbm6t64/copyright", "/usr/share/lintian/overrides/libgdbm6t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libgmp10@2:6.3.0+dfsg-3", "Name": "libgmp10", "Identifier": { "PURL": "pkg:deb/debian/libgmp10@6.3.0%2Bdfsg-3?arch=amd64\u0026distro=debian-13.5\u0026epoch=2", "UID": "fec85c1b440262e2" }, "Version": "6.3.0+dfsg", "Release": "3", "Epoch": 2, "Arch": "amd64", "SrcName": "gmp", "SrcVersion": "6.3.0+dfsg", "SrcRelease": "3", "SrcEpoch": 2, "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later", "GPL-3.0-or-later", "GPL-3+ with Bison exception", "GPL-2.0-only", "GPL-3.0-only", "LGPL-3.0-only" ], "Maintainer": "Debian Science Maintainers \u003cdebian-science-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgmp.so.10.5.0", "/usr/share/doc/libgmp10/README.Debian", "/usr/share/doc/libgmp10/changelog.Debian.gz", "/usr/share/doc/libgmp10/changelog.gz", "/usr/share/doc/libgmp10/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgnutls30t64@3.8.9-3+deb13u4", "Name": "libgnutls30t64", "Identifier": { "PURL": "pkg:deb/debian/libgnutls30t64@3.8.9-3%2Bdeb13u4?arch=amd64\u0026distro=debian-13.5", "UID": "fb4387077b382704" }, "Version": "3.8.9", "Release": "3+deb13u4", "Arch": "amd64", "SrcName": "gnutls28", "SrcVersion": "3.8.9", "SrcRelease": "3+deb13u4", "Licenses": [ "LGPL-2.1-only", "LGPL-2.0-or-later", "LGPL-3.0-only", "GPL-2.0-or-later", "GPL-3.0-only", "GFDL-1.3-only", "CC0-1.0", "MIT", "Apache-2.0", "LGPL-3.0-or-later", "LGPL-2.1-or-later", "GPL-3.0-or-later", "BSD-3-Clause", "FSFAP" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgmp10@2:6.3.0+dfsg-3", "libhogweed6t64@3.10.1-1", "libidn2-0@2.3.8-2", "libnettle8t64@3.10.1-1", "libp11-kit0@0.25.5-3", "libtasn1-6@4.20.0-2", "libunistring5@1.3-2" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgnutls.so.30.40.3", "/usr/share/doc/libgnutls30t64/AUTHORS.gz", "/usr/share/doc/libgnutls30t64/NEWS.gz", "/usr/share/doc/libgnutls30t64/README.md.gz", "/usr/share/doc/libgnutls30t64/THANKS.gz", "/usr/share/doc/libgnutls30t64/changelog.Debian.gz", "/usr/share/doc/libgnutls30t64/changelog.gz", "/usr/share/doc/libgnutls30t64/copyright", "/usr/share/lintian/overrides/libgnutls30t64", "/usr/share/locale/cs/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/de/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/eo/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/es/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/fi/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/fr/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/it/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ka/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ms/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/nl/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/pl/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ro/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/sr/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/sv/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/uk/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/vi/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/gnutls30.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libgssapi-krb5-2@1.21.3-5+deb13u1", "Name": "libgssapi-krb5-2", "Identifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "5d4dffd38d290d53" }, "Version": "1.21.3", "Release": "5+deb13u1", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5+deb13u1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcom-err2@1.47.2-3+b11", "libk5crypto3@1.21.3-5+deb13u1", "libkrb5-3@1.21.3-5+deb13u1", "libkrb5support0@1.21.3-5+deb13u1" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2", "/usr/share/doc/libgssapi-krb5-2/changelog.Debian.gz", "/usr/share/doc/libgssapi-krb5-2/copyright", "/usr/share/lintian/overrides/libgssapi-krb5-2" ], "AnalyzedBy": "dpkg" }, { "ID": "libhogweed6t64@3.10.1-1", "Name": "libhogweed6t64", "Identifier": { "PURL": "pkg:deb/debian/libhogweed6t64@3.10.1-1?arch=amd64\u0026distro=debian-13.5", "UID": "8a048285d77ff6c0" }, "Version": "3.10.1", "Release": "1", "Arch": "amd64", "SrcName": "nettle", "SrcVersion": "3.10.1", "SrcRelease": "1", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "MIT", "GPL-3.0-with-autoconf-exception+", "public-domain", "GPL-2.0-only", "GAP" ], "Maintainer": "Magnus Holmgren \u003cholmgren@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgmp10@2:6.3.0+dfsg-3", "libnettle8t64@3.10.1-1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhogweed.so.6.10", "/usr/share/doc/libhogweed6t64/changelog.Debian.gz", "/usr/share/doc/libhogweed6t64/changelog.gz", "/usr/share/doc/libhogweed6t64/copyright", "/usr/share/lintian/overrides/libhogweed6t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libidn2-0@2.3.8-2", "Name": "libidn2-0", "Identifier": { "PURL": "pkg:deb/debian/libidn2-0@2.3.8-2?arch=amd64\u0026distro=debian-13.5", "UID": "52b3aaa65fda94bc" }, "Version": "2.3.8", "Release": "2", "Arch": "amd64", "SrcName": "libidn2", "SrcVersion": "2.3.8", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "LGPL-3.0-or-later", "GPL-2.0-or-later", "MIT", "Unicode", "GPL-3.0-only", "GPL-2.0-only", "LGPL-3.0-only" ], "Maintainer": "Debian Libidn team \u003chelp-libidn@gnu.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libunistring5@1.3-2" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libidn2.so.0.4.0", "/usr/share/doc/libidn2-0/AUTHORS", "/usr/share/doc/libidn2-0/NEWS.gz", "/usr/share/doc/libidn2-0/README.md.gz", "/usr/share/doc/libidn2-0/changelog.Debian.gz", "/usr/share/doc/libidn2-0/copyright", "/usr/share/lintian/overrides/libidn2-0", "/usr/share/locale/cs/LC_MESSAGES/libidn2.mo", "/usr/share/locale/da/LC_MESSAGES/libidn2.mo", "/usr/share/locale/de/LC_MESSAGES/libidn2.mo", "/usr/share/locale/eo/LC_MESSAGES/libidn2.mo", "/usr/share/locale/es/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fi/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fur/LC_MESSAGES/libidn2.mo", "/usr/share/locale/hr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/hu/LC_MESSAGES/libidn2.mo", "/usr/share/locale/id/LC_MESSAGES/libidn2.mo", "/usr/share/locale/it/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ja/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ka/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ko/LC_MESSAGES/libidn2.mo", "/usr/share/locale/lv/LC_MESSAGES/libidn2.mo", "/usr/share/locale/nl/LC_MESSAGES/libidn2.mo", "/usr/share/locale/pl/LC_MESSAGES/libidn2.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ro/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ru/LC_MESSAGES/libidn2.mo", "/usr/share/locale/sr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/sv/LC_MESSAGES/libidn2.mo", "/usr/share/locale/uk/LC_MESSAGES/libidn2.mo", "/usr/share/locale/vi/LC_MESSAGES/libidn2.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/libidn2.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libk5crypto3@1.21.3-5+deb13u1", "Name": "libk5crypto3", "Identifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "c62ac626db2eb5f6" }, "Version": "1.21.3", "Release": "5+deb13u1", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5+deb13u1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libkrb5support0@1.21.3-5+deb13u1" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1", "/usr/share/doc/libk5crypto3/changelog.Debian.gz", "/usr/share/doc/libk5crypto3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libkeyutils1@1.6.3-6", "Name": "libkeyutils1", "Identifier": { "PURL": "pkg:deb/debian/libkeyutils1@1.6.3-6?arch=amd64\u0026distro=debian-13.5", "UID": "40429856846c1f9a" }, "Version": "1.6.3", "Release": "6", "Arch": "amd64", "SrcName": "keyutils", "SrcVersion": "1.6.3", "SrcRelease": "6", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only" ], "Maintainer": "Christian Kastner \u003cckk@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libkeyutils.so.1.10", "/usr/share/doc/libkeyutils1/changelog.Debian.gz", "/usr/share/doc/libkeyutils1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libkrb5-3@1.21.3-5+deb13u1", "Name": "libkrb5-3", "Identifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "10e950b47198dc86" }, "Version": "1.21.3", "Release": "5+deb13u1", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5+deb13u1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcom-err2@1.47.2-3+b11", "libk5crypto3@1.21.3-5+deb13u1", "libkeyutils1@1.6.3-6", "libkrb5support0@1.21.3-5+deb13u1", "libssl3t64@3.5.6-1~deb13u1" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so", "/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3", "/usr/share/doc/libkrb5-3/README.Debian", "/usr/share/doc/libkrb5-3/README.gz", "/usr/share/doc/libkrb5-3/changelog.Debian.gz", "/usr/share/doc/libkrb5-3/copyright", "/usr/share/lintian/overrides/libkrb5-3" ], "AnalyzedBy": "dpkg" }, { "ID": "libkrb5support0@1.21.3-5+deb13u1", "Name": "libkrb5support0", "Identifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "9a69f9b1048a28cf" }, "Version": "1.21.3", "Release": "5+deb13u1", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5+deb13u1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1", "/usr/share/doc/libkrb5support0/changelog.Debian.gz", "/usr/share/doc/libkrb5support0/copyright", "/usr/share/lintian/overrides/libkrb5support0" ], "AnalyzedBy": "dpkg" }, { "ID": "liblastlog2-2@2.41-5", "Name": "liblastlog2-2", "Identifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "eb4f5430aea34a10" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libsqlite3-0@3.46.1-7+deb13u1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblastlog2.so.2.0.0", "/usr/share/doc/liblastlog2-2/NEWS.Debian.gz", "/usr/share/doc/liblastlog2-2/changelog.Debian.gz", "/usr/share/doc/liblastlog2-2/changelog.gz", "/usr/share/doc/liblastlog2-2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libldap2@2.6.10+dfsg-1", "Name": "libldap2", "Identifier": { "PURL": "pkg:deb/debian/libldap2@2.6.10%2Bdfsg-1?arch=amd64\u0026distro=debian-13.5", "UID": "79fa21faeefecc11" }, "Version": "2.6.10+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "openldap", "SrcVersion": "2.6.10+dfsg", "SrcRelease": "1", "Licenses": [ "OpenLDAP-2.8", "FSF-unlimited", "GPL-2.0-with-autoconf-exception+", "GPL-3.0-with-autoconf-exception+", "GPL-2+ with Libtool exception", "GPL-3+ with Libtool exception", "GPL-3.0-or-later", "GPL-2.0-or-later", "UMich", "F5", "JCG", "MIT-XC", "NeoSoft-permissive", "BSD-3-Clause", "Beerware", "public-domain", "BSD-4-clause-California", "BSD-3-clause-variant", "Expat-ISC", "Expat-UNM", "MIT", "BSD-3-clause-California", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian OpenLDAP Maintainers \u003cpkg-openldap-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libsasl2-2@2.1.28+dfsg1-9", "libssl3t64@3.5.6-1~deb13u1" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblber.so.2.0.200", "/usr/lib/x86_64-linux-gnu/libldap.so.2.0.200", "/usr/share/doc/libldap2/NEWS.Debian.gz", "/usr/share/doc/libldap2/changelog.Debian.gz", "/usr/share/doc/libldap2/changelog.gz", "/usr/share/doc/libldap2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblz4-1@1.10.0-4", "Name": "liblz4-1", "Identifier": { "PURL": "pkg:deb/debian/liblz4-1@1.10.0-4?arch=amd64\u0026distro=debian-13.5", "UID": "c31b43410c927de" }, "Version": "1.10.0", "Release": "4", "Arch": "amd64", "SrcName": "lz4", "SrcVersion": "1.10.0", "SrcRelease": "4", "Licenses": [ "GPL-2.0-or-later", "BSD-2-Clause", "GPL-2.0-only" ], "Maintainer": "Nobuhiro Iwamatsu \u003ciwamatsu@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libxxhash0@0.8.3-2" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblz4.so.1.10.0", "/usr/share/doc/liblz4-1/changelog.Debian.gz", "/usr/share/doc/liblz4-1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblzma5@5.8.1-1", "Name": "liblzma5", "Identifier": { "PURL": "pkg:deb/debian/liblzma5@5.8.1-1?arch=amd64\u0026distro=debian-13.5", "UID": "d7b58e04f1a265ed" }, "Version": "5.8.1", "Release": "1", "Arch": "amd64", "SrcName": "xz-utils", "SrcVersion": "5.8.1", "SrcRelease": "1", "Licenses": [ "0BSD", "GPL-2.0-or-later", "LGPL-2.1-or-later", "FSFULLR", "GPL-3.0-or-later-WITH-Autoconf-exception-macro", "none", "PD", "permissive-nowarranty", "FSFUL", "noderivs", "PD-debian", "LGPL-2.1-only", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Sebastian Andrzej Siewior \u003csebastian@breakpoint.cc\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblzma.so.5.8.1", "/usr/share/doc/liblzma5/AUTHORS", "/usr/share/doc/liblzma5/NEWS.gz", "/usr/share/doc/liblzma5/THANKS.gz", "/usr/share/doc/liblzma5/changelog.Debian.gz", "/usr/share/doc/liblzma5/changelog.gz", "/usr/share/doc/liblzma5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmd0@1.1.0-2+b1", "Name": "libmd0", "Identifier": { "PURL": "pkg:deb/debian/libmd0@1.1.0-2%2Bb1?arch=amd64\u0026distro=debian-13.5", "UID": "f3971c5b48c68b3c" }, "Version": "1.1.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libmd", "SrcVersion": "1.1.0", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-Aaron-D-Gifford", "BSD-2-Clause", "BSD-2-Clause-NetBSD", "ISC", "Beerware", "public-domain-md4", "public-domain-md5", "public-domain-sha1" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmd.so.0.1.0", "/usr/share/doc/libmd0/changelog.Debian.amd64.gz", "/usr/share/doc/libmd0/changelog.Debian.gz", "/usr/share/doc/libmd0/changelog.gz", "/usr/share/doc/libmd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmount1@2.41-5", "Name": "libmount1", "Identifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "84ccd0371833b76" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libblkid1@2.41-5", "libc6@2.41-12+deb13u3", "libselinux1@3.8.1-1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmount.so.1.1.0", "/usr/share/doc/libmount1/NEWS.Debian.gz", "/usr/share/doc/libmount1/changelog.Debian.gz", "/usr/share/doc/libmount1/changelog.gz", "/usr/share/doc/libmount1/copyright", "/usr/share/lintian/overrides/libmount1" ], "AnalyzedBy": "dpkg" }, { "ID": "libncursesw6@6.5+20250216-2", "Name": "libncursesw6", "Identifier": { "PURL": "pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.5", "UID": "c7a5d333a8ad931e" }, "Version": "6.5+20250216", "Release": "2", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libtinfo6@6.5+20250216-2" ], "Layer": { "DiffID": "sha256:c529e1b2553946dcc9afa2d77e33a75f23d3702e0b4a7911b67e2f1fe45a4939" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libformw.so.6.5", "/usr/lib/x86_64-linux-gnu/libmenuw.so.6.5", "/usr/lib/x86_64-linux-gnu/libncursesw.so.6.5", "/usr/lib/x86_64-linux-gnu/libpanelw.so.6.5" ], "AnalyzedBy": "dpkg" }, { "ID": "libnettle8t64@3.10.1-1", "Name": "libnettle8t64", "Identifier": { "PURL": "pkg:deb/debian/libnettle8t64@3.10.1-1?arch=amd64\u0026distro=debian-13.5", "UID": "fd78e15d23b25c1f" }, "Version": "3.10.1", "Release": "1", "Arch": "amd64", "SrcName": "nettle", "SrcVersion": "3.10.1", "SrcRelease": "1", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "MIT", "GPL-3.0-with-autoconf-exception+", "public-domain", "GPL-2.0-only", "GAP" ], "Maintainer": "Magnus Holmgren \u003cholmgren@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnettle.so.8.10", "/usr/share/doc/libnettle8t64/NEWS.gz", "/usr/share/doc/libnettle8t64/README", "/usr/share/doc/libnettle8t64/changelog.Debian.gz", "/usr/share/doc/libnettle8t64/changelog.gz", "/usr/share/doc/libnettle8t64/copyright", "/usr/share/lintian/overrides/libnettle8t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libnghttp2-14@1.64.0-1.1+deb13u1", "Name": "libnghttp2-14", "Identifier": { "PURL": "pkg:deb/debian/libnghttp2-14@1.64.0-1.1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "a7ff7fecdde3e964" }, "Version": "1.64.0", "Release": "1.1+deb13u1", "Arch": "amd64", "SrcName": "nghttp2", "SrcVersion": "1.64.0", "SrcRelease": "1.1+deb13u1", "Licenses": [ "MIT", "all-permissive", "GPL-3.0-with-autoconf-exception+", "BSD-2-Clause", "GPL-3.0-only" ], "Maintainer": "Tomasz Buchert \u003ctomasz@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnghttp2.so.14.28.3", "/usr/share/doc/libnghttp2-14/AUTHORS", "/usr/share/doc/libnghttp2-14/README.rst.gz", "/usr/share/doc/libnghttp2-14/changelog.Debian.gz", "/usr/share/doc/libnghttp2-14/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libnghttp3-9@1.8.0-1", "Name": "libnghttp3-9", "Identifier": { "PURL": "pkg:deb/debian/libnghttp3-9@1.8.0-1?arch=amd64\u0026distro=debian-13.5", "UID": "aee3592d5bb90e6b" }, "Version": "1.8.0", "Release": "1", "Arch": "amd64", "SrcName": "nghttp3", "SrcVersion": "1.8.0", "SrcRelease": "1", "Licenses": [ "MIT", "FSFULLR", "GPL-3+ with Autoconf generic exception", "FSFUL", "GPL-2+ with Autoconf generic exception", "FSFAP", "GPL-2+ with Libtool Exception", "GPL-3.0-or-later", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Curl Maintainers \u003cteam+curl@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnghttp3.so.9.2.6", "/usr/share/doc/libnghttp3-9/changelog.Debian.gz", "/usr/share/doc/libnghttp3-9/changelog.gz", "/usr/share/doc/libnghttp3-9/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libp11-kit0@0.25.5-3", "Name": "libp11-kit0", "Identifier": { "PURL": "pkg:deb/debian/libp11-kit0@0.25.5-3?arch=amd64\u0026distro=debian-13.5", "UID": "f2b2270e59ecccd9" }, "Version": "0.25.5", "Release": "3", "Arch": "amd64", "SrcName": "p11-kit", "SrcVersion": "0.25.5", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause", "FSFULLR", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "X11", "ISC", "customFSFULLRWD", "LGPL-2.1-or-later", "Apache-2.0", "customFSFUL", "FSFAP", "LGPL-2.1-only" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libffi8@3.4.8-2" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libp11-kit.so.0.4.1", "/usr/share/doc/libp11-kit0/changelog.Debian.gz", "/usr/share/doc/libp11-kit0/changelog.gz", "/usr/share/doc/libp11-kit0/copyright", "/usr/share/doc/libp11-kit0/examples/pkcs11.conf.example" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-modules@1.7.0-5", "Name": "libpam-modules", "Identifier": { "PURL": "pkg:deb/debian/libpam-modules@1.7.0-5?arch=amd64\u0026distro=debian-13.5", "UID": "274a704398461ef0" }, "Version": "1.7.0", "Release": "5", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/security/pam_access.so", "/usr/lib/x86_64-linux-gnu/security/pam_canonicalize_user.so", "/usr/lib/x86_64-linux-gnu/security/pam_debug.so", "/usr/lib/x86_64-linux-gnu/security/pam_deny.so", "/usr/lib/x86_64-linux-gnu/security/pam_echo.so", "/usr/lib/x86_64-linux-gnu/security/pam_env.so", "/usr/lib/x86_64-linux-gnu/security/pam_exec.so", "/usr/lib/x86_64-linux-gnu/security/pam_faildelay.so", "/usr/lib/x86_64-linux-gnu/security/pam_faillock.so", "/usr/lib/x86_64-linux-gnu/security/pam_filter.so", "/usr/lib/x86_64-linux-gnu/security/pam_ftp.so", "/usr/lib/x86_64-linux-gnu/security/pam_group.so", "/usr/lib/x86_64-linux-gnu/security/pam_issue.so", "/usr/lib/x86_64-linux-gnu/security/pam_keyinit.so", "/usr/lib/x86_64-linux-gnu/security/pam_limits.so", "/usr/lib/x86_64-linux-gnu/security/pam_listfile.so", "/usr/lib/x86_64-linux-gnu/security/pam_localuser.so", "/usr/lib/x86_64-linux-gnu/security/pam_loginuid.so", "/usr/lib/x86_64-linux-gnu/security/pam_mail.so", "/usr/lib/x86_64-linux-gnu/security/pam_mkhomedir.so", "/usr/lib/x86_64-linux-gnu/security/pam_motd.so", "/usr/lib/x86_64-linux-gnu/security/pam_namespace.so", "/usr/lib/x86_64-linux-gnu/security/pam_nologin.so", "/usr/lib/x86_64-linux-gnu/security/pam_permit.so", "/usr/lib/x86_64-linux-gnu/security/pam_pwhistory.so", "/usr/lib/x86_64-linux-gnu/security/pam_rhosts.so", "/usr/lib/x86_64-linux-gnu/security/pam_rootok.so", "/usr/lib/x86_64-linux-gnu/security/pam_securetty.so", "/usr/lib/x86_64-linux-gnu/security/pam_selinux.so", "/usr/lib/x86_64-linux-gnu/security/pam_sepermit.so", "/usr/lib/x86_64-linux-gnu/security/pam_setquota.so", "/usr/lib/x86_64-linux-gnu/security/pam_shells.so", "/usr/lib/x86_64-linux-gnu/security/pam_stress.so", "/usr/lib/x86_64-linux-gnu/security/pam_succeed_if.so", "/usr/lib/x86_64-linux-gnu/security/pam_time.so", "/usr/lib/x86_64-linux-gnu/security/pam_timestamp.so", "/usr/lib/x86_64-linux-gnu/security/pam_tty_audit.so", "/usr/lib/x86_64-linux-gnu/security/pam_umask.so", "/usr/lib/x86_64-linux-gnu/security/pam_unix.so", "/usr/lib/x86_64-linux-gnu/security/pam_userdb.so", "/usr/lib/x86_64-linux-gnu/security/pam_usertype.so", "/usr/lib/x86_64-linux-gnu/security/pam_warn.so", "/usr/lib/x86_64-linux-gnu/security/pam_wheel.so", "/usr/lib/x86_64-linux-gnu/security/pam_xauth.so", "/usr/share/doc/libpam-modules/NEWS.Debian.gz", "/usr/share/doc/libpam-modules/changelog.Debian.gz", "/usr/share/doc/libpam-modules/changelog.gz", "/usr/share/doc/libpam-modules/copyright", "/usr/share/doc/libpam-modules/examples/upperLOWER.c", "/usr/share/lintian/overrides/libpam-modules", "/usr/share/pam-configs/mkhomedir" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-modules-bin@1.7.0-5", "Name": "libpam-modules-bin", "Identifier": { "PURL": "pkg:deb/debian/libpam-modules-bin@1.7.0-5?arch=amd64\u0026distro=debian-13.5", "UID": "c9cbae9084b28bae" }, "Version": "1.7.0", "Release": "5", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:4.0.2-2+b2", "libc6@2.41-12+deb13u3", "libcrypt1@1:4.4.38-1", "libpam0g@1.7.0-5", "libselinux1@3.8.1-1", "libsystemd0@257.13-1~deb13u1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/systemd/system/pam_namespace.service", "/usr/sbin/faillock", "/usr/sbin/mkhomedir_helper", "/usr/sbin/pam_namespace_helper", "/usr/sbin/pam_timestamp_check", "/usr/sbin/pwhistory_helper", "/usr/sbin/unix_chkpwd", "/usr/sbin/unix_update", "/usr/share/doc/libpam-modules-bin/changelog.Debian.gz", "/usr/share/doc/libpam-modules-bin/changelog.gz", "/usr/share/doc/libpam-modules-bin/copyright", "/usr/share/lintian/overrides/libpam-modules-bin" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-runtime@1.7.0-5", "Name": "libpam-runtime", "Identifier": { "PURL": "pkg:deb/debian/libpam-runtime@1.7.0-5?arch=all\u0026distro=debian-13.5", "UID": "1d4f3eaf1c0f9548" }, "Version": "1.7.0", "Release": "5", "Arch": "all", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "libpam-modules@1.7.0-5" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/sbin/pam-auth-update", "/usr/sbin/pam_getenv", "/usr/share/doc/libpam-runtime/changelog.Debian.gz", "/usr/share/doc/libpam-runtime/changelog.gz", "/usr/share/doc/libpam-runtime/copyright", "/usr/share/lintian/overrides/libpam-runtime", "/usr/share/locale/af/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/am/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ar/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/as/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/az/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/be/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bg/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bn_IN/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bs/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ca/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/cs/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/cy/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/da/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/de/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/de_CH/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/el/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/eo/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/es/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/et/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/eu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fa/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ga/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/gl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/gu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/he/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ia/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/id/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/is/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/it/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ja/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ka/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/km/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ko/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kw_GB/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ky/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/lt/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/lv/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ml/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ms/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/my/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nb/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ne/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/or/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pa/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pt/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ro/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ru/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/si/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sq/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sr@latin/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sv/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ta/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/te/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/tg/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/th/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/tr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/uk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ur/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/vi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/yo/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_HK/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/man/man5/access.conf.5.gz", "/usr/share/man/man5/faillock.conf.5.gz", "/usr/share/man/man5/group.conf.5.gz", "/usr/share/man/man5/limits.conf.5.gz", "/usr/share/man/man5/namespace.conf.5.gz", "/usr/share/man/man5/pam.conf.5.gz", "/usr/share/man/man5/pam_env.conf.5.gz", "/usr/share/man/man5/pwhistory.conf.5.gz", "/usr/share/man/man5/sepermit.conf.5.gz", "/usr/share/man/man5/time.conf.5.gz", "/usr/share/man/man7/PAM.7.gz", "/usr/share/man/man8/faillock.8.gz", "/usr/share/man/man8/mkhomedir_helper.8.gz", "/usr/share/man/man8/pam-auth-update.8.gz", "/usr/share/man/man8/pam_access.8.gz", "/usr/share/man/man8/pam_canonicalize_user.8.gz", "/usr/share/man/man8/pam_debug.8.gz", "/usr/share/man/man8/pam_deny.8.gz", "/usr/share/man/man8/pam_echo.8.gz", "/usr/share/man/man8/pam_env.8.gz", "/usr/share/man/man8/pam_exec.8.gz", "/usr/share/man/man8/pam_faildelay.8.gz", "/usr/share/man/man8/pam_faillock.8.gz", "/usr/share/man/man8/pam_filter.8.gz", "/usr/share/man/man8/pam_ftp.8.gz", "/usr/share/man/man8/pam_getenv.8.gz", "/usr/share/man/man8/pam_group.8.gz", "/usr/share/man/man8/pam_issue.8.gz", "/usr/share/man/man8/pam_keyinit.8.gz", "/usr/share/man/man8/pam_limits.8.gz", "/usr/share/man/man8/pam_listfile.8.gz", "/usr/share/man/man8/pam_localuser.8.gz", "/usr/share/man/man8/pam_loginuid.8.gz", "/usr/share/man/man8/pam_mail.8.gz", "/usr/share/man/man8/pam_mkhomedir.8.gz", "/usr/share/man/man8/pam_motd.8.gz", "/usr/share/man/man8/pam_namespace.8.gz", "/usr/share/man/man8/pam_namespace_helper.8.gz", "/usr/share/man/man8/pam_nologin.8.gz", "/usr/share/man/man8/pam_permit.8.gz", "/usr/share/man/man8/pam_pwhistory.8.gz", "/usr/share/man/man8/pam_rhosts.8.gz", "/usr/share/man/man8/pam_rootok.8.gz", "/usr/share/man/man8/pam_securetty.8.gz", "/usr/share/man/man8/pam_selinux.8.gz", "/usr/share/man/man8/pam_sepermit.8.gz", "/usr/share/man/man8/pam_setquota.8.gz", "/usr/share/man/man8/pam_shells.8.gz", "/usr/share/man/man8/pam_stress.8.gz", "/usr/share/man/man8/pam_succeed_if.8.gz", "/usr/share/man/man8/pam_time.8.gz", "/usr/share/man/man8/pam_timestamp.8.gz", "/usr/share/man/man8/pam_timestamp_check.8.gz", "/usr/share/man/man8/pam_tty_audit.8.gz", "/usr/share/man/man8/pam_umask.8.gz", "/usr/share/man/man8/pam_unix.8.gz", "/usr/share/man/man8/pam_userdb.8.gz", "/usr/share/man/man8/pam_usertype.8.gz", "/usr/share/man/man8/pam_warn.8.gz", "/usr/share/man/man8/pam_wheel.8.gz", "/usr/share/man/man8/pam_xauth.8.gz", "/usr/share/man/man8/pwhistory_helper.8.gz", "/usr/share/man/man8/unix_chkpwd.8.gz", "/usr/share/man/man8/unix_update.8.gz", "/usr/share/pam-configs/unix", "/usr/share/pam/common-account", "/usr/share/pam/common-account.md5sums", "/usr/share/pam/common-auth", "/usr/share/pam/common-auth.md5sums", "/usr/share/pam/common-password", "/usr/share/pam/common-password.md5sums", "/usr/share/pam/common-session", "/usr/share/pam/common-session-noninteractive", "/usr/share/pam/common-session-noninteractive.md5sums", "/usr/share/pam/common-session.md5sums" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam0g@1.7.0-5", "Name": "libpam0g", "Identifier": { "PURL": "pkg:deb/debian/libpam0g@1.7.0-5?arch=amd64\u0026distro=debian-13.5", "UID": "50a3886f7361785c" }, "Version": "1.7.0", "Release": "5", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "libaudit1@1:4.0.2-2+b2", "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1", "/usr/lib/x86_64-linux-gnu/libpam_misc.so.0.82.1", "/usr/lib/x86_64-linux-gnu/libpamc.so.0.82.1", "/usr/share/doc/libpam0g/Debian-PAM-MiniPolicy.gz", "/usr/share/doc/libpam0g/README", "/usr/share/doc/libpam0g/README.Debian", "/usr/share/doc/libpam0g/TODO.Debian", "/usr/share/doc/libpam0g/changelog.Debian.gz", "/usr/share/doc/libpam0g/changelog.gz", "/usr/share/doc/libpam0g/copyright", "/usr/share/lintian/overrides/libpam0g" ], "AnalyzedBy": "dpkg" }, { "ID": "libpcre2-8-0@10.46-1~deb13u1", "Name": "libpcre2-8-0", "Identifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "aa7e3a6ab471d889" }, "Version": "10.46", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "pcre2", "SrcVersion": "10.46", "SrcRelease": "1~deb13u1", "Licenses": [ "BSD-3-clause-Cambridge with BINARY LIBRARY-LIKE PACKAGES exception", "BSD-3-Clause", "X11", "BSD-2-Clause", "public-domain" ], "Maintainer": "Matthew Vernon \u003cmatthew@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.14.0", "/usr/share/doc/libpcre2-8-0/README.Debian", "/usr/share/doc/libpcre2-8-0/changelog.Debian.gz", "/usr/share/doc/libpcre2-8-0/changelog.gz", "/usr/share/doc/libpcre2-8-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpsl5t64@0.21.2-1.1+b1", "Name": "libpsl5t64", "Identifier": { "PURL": "pkg:deb/debian/libpsl5t64@0.21.2-1.1%2Bb1?arch=amd64\u0026distro=debian-13.5", "UID": "819cc502d1118c2a" }, "Version": "0.21.2", "Release": "1.1+b1", "Arch": "amd64", "SrcName": "libpsl", "SrcVersion": "0.21.2", "SrcRelease": "1.1", "Licenses": [ "MIT", "gnulib", "Chromium" ], "Maintainer": "Tim Rühsen \u003ctim.ruehsen@gmx.de\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libidn2-0@2.3.8-2", "libunistring5@1.3-2" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpsl.so.5.3.4", "/usr/share/doc/libpsl5t64/changelog.Debian.amd64.gz", "/usr/share/doc/libpsl5t64/changelog.Debian.gz", "/usr/share/doc/libpsl5t64/changelog.gz", "/usr/share/doc/libpsl5t64/copyright", "/usr/share/lintian/overrides/libpsl5t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libreadline8t64@8.2-6", "Name": "libreadline8t64", "Identifier": { "PURL": "pkg:deb/debian/libreadline8t64@8.2-6?arch=amd64\u0026distro=debian-13.5", "UID": "50325e363223cfdc" }, "Version": "8.2", "Release": "6", "Arch": "amd64", "SrcName": "readline", "SrcVersion": "8.2", "SrcRelease": "6", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-or-later", "ISC-no-attribution" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libtinfo6@6.5+20250216-2", "readline-common@8.2-6" ], "Layer": { "DiffID": "sha256:c529e1b2553946dcc9afa2d77e33a75f23d3702e0b4a7911b67e2f1fe45a4939" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhistory.so.8.2", "/usr/lib/x86_64-linux-gnu/libreadline.so.8.2", "/usr/share/doc/libreadline8t64/README.Debian", "/usr/share/doc/libreadline8t64/USAGE", "/usr/share/doc/libreadline8t64/changelog.Debian.gz", "/usr/share/doc/libreadline8t64/changelog.gz", "/usr/share/doc/libreadline8t64/copyright", "/usr/share/doc/libreadline8t64/examples/Inputrc", "/usr/share/doc/libreadline8t64/inputrc.arrows" ], "AnalyzedBy": "dpkg" }, { "ID": "librtmp1@2.4+20151223.gitfa8646d.1-2+b5", "Name": "librtmp1", "Identifier": { "PURL": "pkg:deb/debian/librtmp1@2.4%2B20151223.gitfa8646d.1-2%2Bb5?arch=amd64\u0026distro=debian-13.5", "UID": "5606cf7f9169aeeb" }, "Version": "2.4+20151223.gitfa8646d.1", "Release": "2+b5", "Arch": "amd64", "SrcName": "rtmpdump", "SrcVersion": "2.4+20151223.gitfa8646d.1", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgmp10@2:6.3.0+dfsg-3", "libgnutls30t64@3.8.9-3+deb13u4", "libhogweed6t64@3.10.1-1", "libnettle8t64@3.10.1-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librtmp.so.1", "/usr/share/doc/librtmp1/changelog.Debian.amd64.gz", "/usr/share/doc/librtmp1/changelog.Debian.gz", "/usr/share/doc/librtmp1/changelog.gz", "/usr/share/doc/librtmp1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsasl2-2@2.1.28+dfsg1-9", "Name": "libsasl2-2", "Identifier": { "PURL": "pkg:deb/debian/libsasl2-2@2.1.28%2Bdfsg1-9?arch=amd64\u0026distro=debian-13.5", "UID": "94ebdce0d9719b3a" }, "Version": "2.1.28+dfsg1", "Release": "9", "Arch": "amd64", "SrcName": "cyrus-sasl2", "SrcVersion": "2.1.28+dfsg1", "SrcRelease": "9", "Licenses": [ "BSD-3-Clause-Attribution", "BSD-3-Clause", "BSD-2-Clause", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-4-Clause-UC", "RSA-MD", "text://BSD-3-Clause-Attribution and IBM-as-is", "BSD-3-clause-JANET", "BSD-3-clause-PADL", "MIT-OpenVision", "OpenLDAP", "FSFULLR", "MIT-CMU", "MIT-Export", "BSD-2.2-clause", "text://IBM-as-is" ], "Maintainer": "Debian Cyrus Team \u003cteam+cyrus@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libsasl2-modules-db@2.1.28+dfsg1-9", "libssl3t64@3.5.6-1~deb13u1" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsasl2.so.2.0.25", "/usr/share/doc/libsasl2-2/README.Debian", "/usr/share/doc/libsasl2-2/changelog.Debian.gz", "/usr/share/doc/libsasl2-2/copyright", "/usr/share/man/man5/libsasl.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libsasl2-modules-db@2.1.28+dfsg1-9", "Name": "libsasl2-modules-db", "Identifier": { "PURL": "pkg:deb/debian/libsasl2-modules-db@2.1.28%2Bdfsg1-9?arch=amd64\u0026distro=debian-13.5", "UID": "5be604f52b393651" }, "Version": "2.1.28+dfsg1", "Release": "9", "Arch": "amd64", "SrcName": "cyrus-sasl2", "SrcVersion": "2.1.28+dfsg1", "SrcRelease": "9", "Licenses": [ "BSD-3-Clause-Attribution", "BSD-3-Clause", "BSD-2-Clause", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-4-Clause-UC", "RSA-MD", "text://BSD-3-Clause-Attribution and IBM-as-is", "BSD-3-clause-JANET", "BSD-3-clause-PADL", "MIT-OpenVision", "OpenLDAP", "FSFULLR", "MIT-CMU", "MIT-Export", "BSD-2.2-clause", "text://IBM-as-is" ], "Maintainer": "Debian Cyrus Team \u003cteam+cyrus@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdb5.3t64@5.3.28+dfsg2-9" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/sasl2/libsasldb.so.2.0.25", "/usr/share/doc/libsasl2-modules-db/changelog.Debian.gz", "/usr/share/doc/libsasl2-modules-db/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libseccomp2@2.6.0-2", "Name": "libseccomp2", "Identifier": { "PURL": "pkg:deb/debian/libseccomp2@2.6.0-2?arch=amd64\u0026distro=debian-13.5", "UID": "97e0ed663a98e78b" }, "Version": "2.6.0", "Release": "2", "Arch": "amd64", "SrcName": "libseccomp", "SrcVersion": "2.6.0", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Kees Cook \u003ckees@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libseccomp.so.2.6.0", "/usr/share/doc/libseccomp2/changelog.Debian.gz", "/usr/share/doc/libseccomp2/changelog.gz", "/usr/share/doc/libseccomp2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libselinux1@3.8.1-1", "Name": "libselinux1", "Identifier": { "PURL": "pkg:deb/debian/libselinux1@3.8.1-1?arch=amd64\u0026distro=debian-13.5", "UID": "f7d3a23ad693e5cb" }, "Version": "3.8.1", "Release": "1", "Arch": "amd64", "SrcName": "libselinux", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "public-domain", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libpcre2-8-0@10.46-1~deb13u1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/tmpfiles.d/libselinux1.conf", "/usr/lib/x86_64-linux-gnu/libselinux.so.1", "/usr/share/doc/libselinux1/changelog.Debian.gz", "/usr/share/doc/libselinux1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsemanage-common@3.8.1-1", "Name": "libsemanage-common", "Identifier": { "PURL": "pkg:deb/debian/libsemanage-common@3.8.1-1?arch=all\u0026distro=debian-13.5", "UID": "ecc6b54d8bc6318c" }, "Version": "3.8.1", "Release": "1", "Arch": "all", "SrcName": "libsemanage", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/share/doc/libsemanage-common/changelog.Debian.gz", "/usr/share/doc/libsemanage-common/copyright", "/usr/share/man/man5/semanage.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libsemanage2@3.8.1-1", "Name": "libsemanage2", "Identifier": { "PURL": "pkg:deb/debian/libsemanage2@3.8.1-1?arch=amd64\u0026distro=debian-13.5", "UID": "5684bd063761ddb3" }, "Version": "3.8.1", "Release": "1", "Arch": "amd64", "SrcName": "libsemanage", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:4.0.2-2+b2", "libbz2-1.0@1.0.8-6", "libc6@2.41-12+deb13u3", "libselinux1@3.8.1-1", "libsemanage-common@3.8.1-1", "libsepol2@3.8.1-1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsemanage.so.2", "/usr/share/doc/libsemanage2/changelog.Debian.gz", "/usr/share/doc/libsemanage2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsepol2@3.8.1-1", "Name": "libsepol2", "Identifier": { "PURL": "pkg:deb/debian/libsepol2@3.8.1-1?arch=amd64\u0026distro=debian-13.5", "UID": "9990a97d658e13ae" }, "Version": "3.8.1", "Release": "1", "Arch": "amd64", "SrcName": "libsepol", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "Zlib", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsepol.so.2", "/usr/share/doc/libsepol2/changelog.Debian.gz", "/usr/share/doc/libsepol2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsmartcols1@2.41-5", "Name": "libsmartcols1", "Identifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "780dbec0869ab8e" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsmartcols.so.1.1.0", "/usr/share/doc/libsmartcols1/NEWS.Debian.gz", "/usr/share/doc/libsmartcols1/changelog.Debian.gz", "/usr/share/doc/libsmartcols1/changelog.gz", "/usr/share/doc/libsmartcols1/copyright", "/usr/share/lintian/overrides/libsmartcols1" ], "AnalyzedBy": "dpkg" }, { "ID": "libsqlite3-0@3.46.1-7+deb13u1", "Name": "libsqlite3-0", "Identifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "c7da287e696e8198" }, "Version": "3.46.1", "Release": "7+deb13u1", "Arch": "amd64", "SrcName": "sqlite3", "SrcVersion": "3.46.1", "SrcRelease": "7+deb13u1", "Licenses": [ "public-domain", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6", "/usr/share/doc/libsqlite3-0/README.Debian", "/usr/share/doc/libsqlite3-0/changelog.Debian.gz", "/usr/share/doc/libsqlite3-0/changelog.gz", "/usr/share/doc/libsqlite3-0/changelog.html.gz", "/usr/share/doc/libsqlite3-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libssh2-1t64@1.11.1-1", "Name": "libssh2-1t64", "Identifier": { "PURL": "pkg:deb/debian/libssh2-1t64@1.11.1-1?arch=amd64\u0026distro=debian-13.5", "UID": "e580ac70f64ee5cb" }, "Version": "1.11.1", "Release": "1", "Arch": "amd64", "SrcName": "libssh2", "SrcVersion": "1.11.1", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "ISC" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libssl3t64@3.5.6-1~deb13u1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libssh2.so.1.0.1", "/usr/share/doc/libssh2-1t64/AUTHORS", "/usr/share/doc/libssh2-1t64/RELEASE-NOTES.gz", "/usr/share/doc/libssh2-1t64/changelog.Debian.gz", "/usr/share/doc/libssh2-1t64/changelog.gz", "/usr/share/doc/libssh2-1t64/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libssl3t64@3.5.6-1~deb13u1", "Name": "libssl3t64", "Identifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.6-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "19bca5c02c5a9632" }, "Version": "3.5.6", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.5.6", "SrcRelease": "1~deb13u1", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libzstd1@1.5.7+dfsg-1", "openssl-provider-legacy@3.5.6-1~deb13u1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/engines-3/afalg.so", "/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so", "/usr/lib/x86_64-linux-gnu/engines-3/padlock.so", "/usr/lib/x86_64-linux-gnu/libcrypto.so.3", "/usr/lib/x86_64-linux-gnu/libssl.so.3", "/usr/share/doc/libssl3t64/NEWS.Debian.gz", "/usr/share/doc/libssl3t64/changelog.Debian.gz", "/usr/share/doc/libssl3t64/changelog.gz", "/usr/share/doc/libssl3t64/copyright", "/usr/share/lintian/overrides/libssl3t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libstdc++6@14.2.0-19", "Name": "libstdc++6", "Identifier": { "PURL": "pkg:deb/debian/libstdc%2B%2B6@14.2.0-19?arch=amd64\u0026distro=debian-13.5", "UID": "1b384a6346513d7c" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.33", "/usr/share/gcc/python/libstdcxx/__init__.py", "/usr/share/gcc/python/libstdcxx/v6/__init__.py", "/usr/share/gcc/python/libstdcxx/v6/printers.py", "/usr/share/gcc/python/libstdcxx/v6/xmethods.py", "/usr/share/gdb/auto-load/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.33-gdb.py" ], "AnalyzedBy": "dpkg" }, { "ID": "libsystemd0@257.13-1~deb13u1", "Name": "libsystemd0", "Identifier": { "PURL": "pkg:deb/debian/libsystemd0@257.13-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "a2b4ba47389f858e" }, "Version": "257.13", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "systemd", "SrcVersion": "257.13", "SrcRelease": "1~deb13u1", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "GPL-2 with Linux-syscall-note exception", "MIT", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcap2@1:2.75-10+deb13u1+b1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsystemd.so.0.40.0", "/usr/share/doc/libsystemd0/NEWS.Debian.gz", "/usr/share/doc/libsystemd0/changelog.Debian.gz", "/usr/share/doc/libsystemd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtasn1-6@4.20.0-2", "Name": "libtasn1-6", "Identifier": { "PURL": "pkg:deb/debian/libtasn1-6@4.20.0-2?arch=amd64\u0026distro=debian-13.5", "UID": "3e2c5dbbd9b14ae6" }, "Version": "4.20.0", "Release": "2", "Arch": "amd64", "SrcName": "libtasn1-6", "SrcVersion": "4.20.0", "SrcRelease": "2", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-only", "GPL-3.0-only", "GFDL-1.3-only" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtasn1.so.6.6.4", "/usr/share/doc/libtasn1-6/AUTHORS", "/usr/share/doc/libtasn1-6/README.md", "/usr/share/doc/libtasn1-6/THANKS", "/usr/share/doc/libtasn1-6/changelog.Debian.gz", "/usr/share/doc/libtasn1-6/changelog.gz", "/usr/share/doc/libtasn1-6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtinfo6@6.5+20250216-2", "Name": "libtinfo6", "Identifier": { "PURL": "pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.5", "UID": "ba2c2b464f07108a" }, "Version": "6.5+20250216", "Release": "2", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtic.so.6.5", "/usr/lib/x86_64-linux-gnu/libtinfo.so.6.5", "/usr/share/doc/libtinfo6/changelog.Debian.gz", "/usr/share/doc/libtinfo6/changelog.gz", "/usr/share/doc/libtinfo6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libudev1@257.13-1~deb13u1", "Name": "libudev1", "Identifier": { "PURL": "pkg:deb/debian/libudev1@257.13-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "3b7a2f1a9ab169b" }, "Version": "257.13", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "systemd", "SrcVersion": "257.13", "SrcRelease": "1~deb13u1", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "GPL-2 with Linux-syscall-note exception", "MIT", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcap2@1:2.75-10+deb13u1+b1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libudev.so.1.7.10", "/usr/share/doc/libudev1/NEWS.Debian.gz", "/usr/share/doc/libudev1/changelog.Debian.gz", "/usr/share/doc/libudev1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libunistring5@1.3-2", "Name": "libunistring5", "Identifier": { "PURL": "pkg:deb/debian/libunistring5@1.3-2?arch=amd64\u0026distro=debian-13.5", "UID": "ff12343cd2297c69" }, "Version": "1.3", "Release": "2", "Arch": "amd64", "SrcName": "libunistring", "SrcVersion": "1.3", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "LGPL-3.0-or-later", "LGPL-2.0-or-later", "GFDL-1.3-or-later", "GFDL-1.2-or-later", "LGPL-3.0-only", "LGPL-2.1-or-later", "BSD-3-Clause", "ISC", "Unicode-DFS-2016", "public-domain", "FreeSoftware", "GPL-2.0-or-later", "GPL-2+ with distribution exception", "MIT", "X11", "GPL-3.0-only", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Jörg Frings-Fürst \u003cdebian@jff.email\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libunistring.so.5.2.0", "/usr/share/doc/libunistring5/changelog.Debian.gz", "/usr/share/doc/libunistring5/changelog.gz", "/usr/share/doc/libunistring5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libuuid1@2.41-5", "Name": "libuuid1", "Identifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "1afbb50818377478" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0", "/usr/share/doc/libuuid1/NEWS.Debian.gz", "/usr/share/doc/libuuid1/changelog.Debian.gz", "/usr/share/doc/libuuid1/changelog.gz", "/usr/share/doc/libuuid1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxxhash0@0.8.3-2", "Name": "libxxhash0", "Identifier": { "PURL": "pkg:deb/debian/libxxhash0@0.8.3-2?arch=amd64\u0026distro=debian-13.5", "UID": "d91110b5edcae2d8" }, "Version": "0.8.3", "Release": "2", "Arch": "amd64", "SrcName": "xxhash", "SrcVersion": "0.8.3", "SrcRelease": "2", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Josue Ortega \u003cjosue@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxxhash.so.0.8.3", "/usr/share/doc/libxxhash0/changelog.Debian.gz", "/usr/share/doc/libxxhash0/changelog.gz", "/usr/share/doc/libxxhash0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzstd1@1.5.7+dfsg-1", "Name": "libzstd1", "Identifier": { "PURL": "pkg:deb/debian/libzstd1@1.5.7%2Bdfsg-1?arch=amd64\u0026distro=debian-13.5", "UID": "ca4814a2bfd07696" }, "Version": "1.5.7+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "libzstd", "SrcVersion": "1.5.7+dfsg", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "Zlib", "MIT" ], "Maintainer": "RPM packaging team \u003cteam+pkg-rpm@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzstd.so.1.5.7", "/usr/share/doc/libzstd1/changelog.Debian.gz", "/usr/share/doc/libzstd1/changelog.gz", "/usr/share/doc/libzstd1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "login@1:4.16.0-2+really2.41-5", "Name": "login", "Identifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "c0ab0b857644733b" }, "Version": "4.16.0-2+really2.41", "Release": "5", "Epoch": 1, "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:4.0.2-2+b2", "libc6@2.41-12+deb13u3", "libcrypt1@1:4.4.38-1", "libpam-modules@1.7.0-5", "libpam-runtime@1.7.0-5", "libpam0g@1.7.0-5" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/login", "/usr/bin/newgrp", "/usr/sbin/nologin", "/usr/share/bash-completion/completions/newgrp", "/usr/share/doc/login/NEWS.Debian.gz", "/usr/share/doc/login/changelog.Debian.gz", "/usr/share/doc/login/changelog.gz", "/usr/share/doc/login/copyright", "/usr/share/lintian/overrides/login", "/usr/share/man/de/man1/login.1.gz", "/usr/share/man/de/man8/nologin.8.gz", "/usr/share/man/fr/man1/login.1.gz", "/usr/share/man/man1/login.1.gz", "/usr/share/man/man1/newgrp.1.gz", "/usr/share/man/man8/nologin.8.gz", "/usr/share/man/pl/man1/login.1.gz", "/usr/share/man/pl/man1/newgrp.1.gz", "/usr/share/man/pl/man8/nologin.8.gz", "/usr/share/man/ro/man1/login.1.gz", "/usr/share/man/ro/man1/newgrp.1.gz", "/usr/share/man/ro/man8/nologin.8.gz", "/usr/share/man/sr/man1/login.1.gz", "/usr/share/man/sr/man8/nologin.8.gz", "/usr/share/man/uk/man1/login.1.gz", "/usr/share/man/uk/man1/newgrp.1.gz", "/usr/share/man/uk/man8/nologin.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "login.defs@1:4.17.4-2", "Name": "login.defs", "Identifier": { "PURL": "pkg:deb/debian/login.defs@4.17.4-2?arch=all\u0026distro=debian-13.5\u0026epoch=1", "UID": "b6a337588c67d5a3" }, "Version": "4.17.4", "Release": "2", "Epoch": 1, "Arch": "all", "SrcName": "shadow", "SrcVersion": "4.17.4", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-1.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/share/doc/login.defs/NEWS.Debian.gz", "/usr/share/doc/login.defs/changelog.Debian.gz", "/usr/share/doc/login.defs/changelog.gz", "/usr/share/doc/login.defs/copyright", "/usr/share/man/de/man5/login.defs.5.gz", "/usr/share/man/fr/man5/login.defs.5.gz", "/usr/share/man/it/man5/login.defs.5.gz", "/usr/share/man/ja/man5/login.defs.5.gz", "/usr/share/man/man5/login.defs.5.gz", "/usr/share/man/ru/man5/login.defs.5.gz", "/usr/share/man/uk/man5/login.defs.5.gz", "/usr/share/man/zh_CN/man5/login.defs.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "mawk@1.3.4.20250131-1", "Name": "mawk", "Identifier": { "PURL": "pkg:deb/debian/mawk@1.3.4.20250131-1?arch=amd64\u0026distro=debian-13.5", "UID": "a4460701c66e182d" }, "Version": "1.3.4.20250131", "Release": "1", "Arch": "amd64", "SrcName": "mawk", "SrcVersion": "1.3.4.20250131", "SrcRelease": "1", "Licenses": [ "GPL-2.0-only", "X11", "CC-BY-3.0" ], "Maintainer": "Boyuan Yang \u003cbyang@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/mawk", "/usr/share/doc/mawk/ACKNOWLEDGMENT", "/usr/share/doc/mawk/README", "/usr/share/doc/mawk/changelog.Debian.gz", "/usr/share/doc/mawk/changelog.gz", "/usr/share/doc/mawk/copyright", "/usr/share/doc/mawk/examples/ct_length.awk", "/usr/share/doc/mawk/examples/decl.awk", "/usr/share/doc/mawk/examples/deps.awk", "/usr/share/doc/mawk/examples/eatc.awk", "/usr/share/doc/mawk/examples/gdecl.awk", "/usr/share/doc/mawk/examples/hcal", "/usr/share/doc/mawk/examples/hical", "/usr/share/doc/mawk/examples/nocomment.awk", "/usr/share/doc/mawk/examples/primes.awk", "/usr/share/doc/mawk/examples/qsort.awk", "/usr/share/man/man1/mawk.1.gz", "/usr/share/man/man7/mawk-arrays.7.gz", "/usr/share/man/man7/mawk-code.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "mount@2.41-5", "Name": "mount", "Identifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "55c835c674d0a0e5" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/mount", "/usr/bin/umount", "/usr/sbin/losetup", "/usr/sbin/swapoff", "/usr/sbin/swapon", "/usr/share/bash-completion/completions/losetup", "/usr/share/bash-completion/completions/mount", "/usr/share/bash-completion/completions/swapoff", "/usr/share/bash-completion/completions/swapon", "/usr/share/bash-completion/completions/umount", "/usr/share/doc/mount/NEWS.Debian.gz", "/usr/share/doc/mount/changelog.Debian.gz", "/usr/share/doc/mount/changelog.gz", "/usr/share/doc/mount/copyright", "/usr/share/doc/mount/examples/filesystems", "/usr/share/doc/mount/examples/fstab", "/usr/share/doc/mount/examples/mount.fstab", "/usr/share/doc/mount/mount.txt", "/usr/share/lintian/overrides/mount", "/usr/share/man/man5/fstab.5.gz", "/usr/share/man/man8/losetup.8.gz", "/usr/share/man/man8/mount.8.gz", "/usr/share/man/man8/swapon.8.gz", "/usr/share/man/man8/umount.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ncurses-base@6.5+20250216-2", "Name": "ncurses-base", "Identifier": { "PURL": "pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all\u0026distro=debian-13.5", "UID": "767a0231348a5cb5" }, "Version": "6.5+20250216", "Release": "2", "Arch": "all", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/share/doc/ncurses-base/FAQ", "/usr/share/doc/ncurses-base/TODO.Debian", "/usr/share/doc/ncurses-base/changelog.Debian.gz", "/usr/share/doc/ncurses-base/changelog.gz", "/usr/share/doc/ncurses-base/copyright", "/usr/share/lintian/overrides/ncurses-base", "/usr/share/tabset/std", "/usr/share/tabset/stdcrt", "/usr/share/tabset/vt100", "/usr/share/tabset/vt300", "/usr/share/terminfo/E/Eterm", "/usr/share/terminfo/a/ansi", "/usr/share/terminfo/c/cons25", "/usr/share/terminfo/c/cygwin", "/usr/share/terminfo/d/dumb", "/usr/share/terminfo/h/hurd", "/usr/share/terminfo/l/linux", "/usr/share/terminfo/m/mach", "/usr/share/terminfo/m/mach-bold", "/usr/share/terminfo/m/mach-color", "/usr/share/terminfo/m/mach-gnu", "/usr/share/terminfo/m/mach-gnu-color", "/usr/share/terminfo/p/pcansi", "/usr/share/terminfo/r/rxvt", "/usr/share/terminfo/r/rxvt-basic", "/usr/share/terminfo/r/rxvt-unicode", "/usr/share/terminfo/r/rxvt-unicode-256color", "/usr/share/terminfo/s/screen", "/usr/share/terminfo/s/screen-256color", "/usr/share/terminfo/s/screen-256color-bce", "/usr/share/terminfo/s/screen-bce", "/usr/share/terminfo/s/screen-s", "/usr/share/terminfo/s/screen-w", "/usr/share/terminfo/s/screen.xterm-256color", "/usr/share/terminfo/s/sun", "/usr/share/terminfo/t/tmux", "/usr/share/terminfo/t/tmux-256color", "/usr/share/terminfo/v/vt100", "/usr/share/terminfo/v/vt102", "/usr/share/terminfo/v/vt220", "/usr/share/terminfo/v/vt52", "/usr/share/terminfo/w/wsvt25", "/usr/share/terminfo/w/wsvt25m", "/usr/share/terminfo/x/xterm", "/usr/share/terminfo/x/xterm-256color", "/usr/share/terminfo/x/xterm-color", "/usr/share/terminfo/x/xterm-mono", "/usr/share/terminfo/x/xterm-r5", "/usr/share/terminfo/x/xterm-r6", "/usr/share/terminfo/x/xterm-vt220", "/usr/share/terminfo/x/xterm-xfree86" ], "AnalyzedBy": "dpkg" }, { "ID": "ncurses-bin@6.5+20250216-2", "Name": "ncurses-bin", "Identifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.5", "UID": "5b541563cf6587e5" }, "Version": "6.5+20250216", "Release": "2", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/clear", "/usr/bin/infocmp", "/usr/bin/tabs", "/usr/bin/tic", "/usr/bin/toe", "/usr/bin/tput", "/usr/bin/tset", "/usr/share/doc/ncurses-bin/changelog.Debian.gz", "/usr/share/doc/ncurses-bin/changelog.gz", "/usr/share/doc/ncurses-bin/copyright", "/usr/share/man/man1/captoinfo.1.gz", "/usr/share/man/man1/clear.1.gz", "/usr/share/man/man1/infocmp.1.gz", "/usr/share/man/man1/infotocap.1.gz", "/usr/share/man/man1/tabs.1.gz", "/usr/share/man/man1/tic.1.gz", "/usr/share/man/man1/toe.1.gz", "/usr/share/man/man1/tput.1.gz", "/usr/share/man/man1/tset.1.gz", "/usr/share/man/man5/scr_dump.5.gz", "/usr/share/man/man5/term.5.gz", "/usr/share/man/man5/terminfo.5.gz", "/usr/share/man/man5/user_caps.5.gz", "/usr/share/man/man7/term.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "netbase@6.5", "Name": "netbase", "Identifier": { "PURL": "pkg:deb/debian/netbase@6.5?arch=all\u0026distro=debian-13.5", "UID": "9929ff265179fc61" }, "Version": "6.5", "Arch": "all", "SrcName": "netbase", "SrcVersion": "6.5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:ae0096d57d7f18e7861848f1103983488102f78517c11444120d8a938884de54" }, "InstalledFiles": [ "/usr/share/doc/netbase/changelog.gz", "/usr/share/doc/netbase/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "openssl@3.5.6-1~deb13u1", "Name": "openssl", "Identifier": { "PURL": "pkg:deb/debian/openssl@3.5.6-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "ee88be94d89898bf" }, "Version": "3.5.6", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.5.6", "SrcRelease": "1~deb13u1", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libssl3t64@3.5.6-1~deb13u1" ], "Layer": { "DiffID": "sha256:ae0096d57d7f18e7861848f1103983488102f78517c11444120d8a938884de54" }, "InstalledFiles": [ "/usr/bin/c_rehash", "/usr/bin/openssl", "/usr/lib/ssl/misc/CA.pl", "/usr/lib/ssl/misc/tsget.pl", "/usr/share/doc/openssl/HOWTO/certificates.txt.gz", "/usr/share/doc/openssl/HOWTO/documenting-functions-and-macros.md.gz", "/usr/share/doc/openssl/HOWTO/keys.txt.gz", "/usr/share/doc/openssl/NEWS.md.gz", "/usr/share/doc/openssl/README-ENGINES.md.gz", "/usr/share/doc/openssl/README-PROVIDERS.md.gz", "/usr/share/doc/openssl/README-QUIC.md.gz", "/usr/share/doc/openssl/README.Debian", "/usr/share/doc/openssl/README.md.gz", "/usr/share/doc/openssl/changelog.Debian.gz", "/usr/share/doc/openssl/changelog.gz", "/usr/share/doc/openssl/copyright", "/usr/share/doc/openssl/fingerprints.txt", "/usr/share/lintian/overrides/openssl", "/usr/share/man/man1/CA.pl.1ssl.gz", "/usr/share/man/man1/openssl-asn1parse.1ssl.gz", "/usr/share/man/man1/openssl-ca.1ssl.gz", "/usr/share/man/man1/openssl-ciphers.1ssl.gz", "/usr/share/man/man1/openssl-cmds.1ssl.gz", "/usr/share/man/man1/openssl-cmp.1ssl.gz", "/usr/share/man/man1/openssl-cms.1ssl.gz", "/usr/share/man/man1/openssl-crl.1ssl.gz", "/usr/share/man/man1/openssl-crl2pkcs7.1ssl.gz", "/usr/share/man/man1/openssl-dgst.1ssl.gz", "/usr/share/man/man1/openssl-dhparam.1ssl.gz", "/usr/share/man/man1/openssl-dsa.1ssl.gz", "/usr/share/man/man1/openssl-dsaparam.1ssl.gz", "/usr/share/man/man1/openssl-ec.1ssl.gz", "/usr/share/man/man1/openssl-ecparam.1ssl.gz", "/usr/share/man/man1/openssl-enc.1ssl.gz", "/usr/share/man/man1/openssl-engine.1ssl.gz", "/usr/share/man/man1/openssl-errstr.1ssl.gz", "/usr/share/man/man1/openssl-fipsinstall.1ssl.gz", "/usr/share/man/man1/openssl-format-options.1ssl.gz", "/usr/share/man/man1/openssl-gendsa.1ssl.gz", "/usr/share/man/man1/openssl-genpkey.1ssl.gz", "/usr/share/man/man1/openssl-genrsa.1ssl.gz", "/usr/share/man/man1/openssl-info.1ssl.gz", "/usr/share/man/man1/openssl-kdf.1ssl.gz", "/usr/share/man/man1/openssl-list.1ssl.gz", "/usr/share/man/man1/openssl-mac.1ssl.gz", "/usr/share/man/man1/openssl-namedisplay-options.1ssl.gz", "/usr/share/man/man1/openssl-nseq.1ssl.gz", "/usr/share/man/man1/openssl-ocsp.1ssl.gz", "/usr/share/man/man1/openssl-passphrase-options.1ssl.gz", "/usr/share/man/man1/openssl-passwd.1ssl.gz", "/usr/share/man/man1/openssl-pkcs12.1ssl.gz", "/usr/share/man/man1/openssl-pkcs7.1ssl.gz", "/usr/share/man/man1/openssl-pkcs8.1ssl.gz", "/usr/share/man/man1/openssl-pkey.1ssl.gz", "/usr/share/man/man1/openssl-pkeyparam.1ssl.gz", "/usr/share/man/man1/openssl-pkeyutl.1ssl.gz", "/usr/share/man/man1/openssl-prime.1ssl.gz", "/usr/share/man/man1/openssl-rand.1ssl.gz", "/usr/share/man/man1/openssl-rehash.1ssl.gz", "/usr/share/man/man1/openssl-req.1ssl.gz", "/usr/share/man/man1/openssl-rsa.1ssl.gz", "/usr/share/man/man1/openssl-rsautl.1ssl.gz", "/usr/share/man/man1/openssl-s_client.1ssl.gz", "/usr/share/man/man1/openssl-s_server.1ssl.gz", "/usr/share/man/man1/openssl-s_time.1ssl.gz", "/usr/share/man/man1/openssl-sess_id.1ssl.gz", "/usr/share/man/man1/openssl-skeyutl.1ssl.gz", "/usr/share/man/man1/openssl-smime.1ssl.gz", "/usr/share/man/man1/openssl-speed.1ssl.gz", "/usr/share/man/man1/openssl-spkac.1ssl.gz", "/usr/share/man/man1/openssl-srp.1ssl.gz", "/usr/share/man/man1/openssl-storeutl.1ssl.gz", "/usr/share/man/man1/openssl-ts.1ssl.gz", "/usr/share/man/man1/openssl-verification-options.1ssl.gz", "/usr/share/man/man1/openssl-verify.1ssl.gz", "/usr/share/man/man1/openssl-version.1ssl.gz", "/usr/share/man/man1/openssl-x509.1ssl.gz", "/usr/share/man/man1/openssl.1ssl.gz", "/usr/share/man/man1/tsget.1ssl.gz", "/usr/share/man/man5/config.5ssl.gz", "/usr/share/man/man5/fips_config.5ssl.gz", "/usr/share/man/man5/x509v3_config.5ssl.gz", "/usr/share/man/man7/EVP_ASYM_CIPHER-RSA.7ssl.gz", "/usr/share/man/man7/EVP_ASYM_CIPHER-SM2.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-AES.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-ARIA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-BLOWFISH.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CAMELLIA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CAST.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CHACHA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-DES.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-IDEA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-NULL.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC2.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC4.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC5.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-SEED.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-SM4.7ssl.gz", "/usr/share/man/man7/EVP_KDF-ARGON2.7ssl.gz", "/usr/share/man/man7/EVP_KDF-HKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-HMAC-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_KDF-KB.7ssl.gz", "/usr/share/man/man7/EVP_KDF-KRB5KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PBKDF1.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PBKDF2.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PKCS12KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PVKKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SCRYPT.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SS.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SSHKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-TLS13_KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-TLS1_PRF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X942-ASN1.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X942-CONCAT.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X963.7ssl.gz", "/usr/share/man/man7/EVP_KEM-EC.7ssl.gz", "/usr/share/man/man7/EVP_KEM-ML-KEM.7ssl.gz", "/usr/share/man/man7/EVP_KEM-RSA.7ssl.gz", "/usr/share/man/man7/EVP_KEM-X25519.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-DH.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-ECDH.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-X25519.7ssl.gz", "/usr/share/man/man7/EVP_MAC-BLAKE2.7ssl.gz", "/usr/share/man/man7/EVP_MAC-CMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-GMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-KMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-Poly1305.7ssl.gz", "/usr/share/man/man7/EVP_MAC-Siphash.7ssl.gz", "/usr/share/man/man7/EVP_MD-BLAKE2.7ssl.gz", "/usr/share/man/man7/EVP_MD-KECCAK.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD2.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD4.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD5-SHA1.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD5.7ssl.gz", "/usr/share/man/man7/EVP_MD-MDC2.7ssl.gz", "/usr/share/man/man7/EVP_MD-NULL.7ssl.gz", "/usr/share/man/man7/EVP_MD-RIPEMD160.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA1.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA2.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA3.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHAKE.7ssl.gz", "/usr/share/man/man7/EVP_MD-SM3.7ssl.gz", "/usr/share/man/man7/EVP_MD-WHIRLPOOL.7ssl.gz", "/usr/share/man/man7/EVP_MD-common.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-DH.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-EC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-FFC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-ML-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-ML-KEM.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-RSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-SLH-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-SM2.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-X25519.7ssl.gz", "/usr/share/man/man7/EVP_RAND-CRNG-TEST.7ssl.gz", "/usr/share/man/man7/EVP_RAND-CTR-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-HASH-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-HMAC-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-JITTER.7ssl.gz", "/usr/share/man/man7/EVP_RAND-SEED-SRC.7ssl.gz", "/usr/share/man/man7/EVP_RAND-TEST-RAND.7ssl.gz", "/usr/share/man/man7/EVP_RAND.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-DSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ECDSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ED25519.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ML-DSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-RSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-SLH-DSA.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-FIPS.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-base.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-default.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-legacy.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-null.7ssl.gz", "/usr/share/man/man7/OSSL_STORE-winstore.7ssl.gz", "/usr/share/man/man7/RAND.7ssl.gz", "/usr/share/man/man7/RSA-PSS.7ssl.gz", "/usr/share/man/man7/X25519.7ssl.gz", "/usr/share/man/man7/bio.7ssl.gz", "/usr/share/man/man7/ct.7ssl.gz", "/usr/share/man/man7/des_modes.7ssl.gz", "/usr/share/man/man7/evp.7ssl.gz", "/usr/share/man/man7/fips_module.7ssl.gz", "/usr/share/man/man7/life_cycle-cipher.7ssl.gz", "/usr/share/man/man7/life_cycle-digest.7ssl.gz", "/usr/share/man/man7/life_cycle-kdf.7ssl.gz", "/usr/share/man/man7/life_cycle-mac.7ssl.gz", "/usr/share/man/man7/life_cycle-pkey.7ssl.gz", "/usr/share/man/man7/life_cycle-rand.7ssl.gz", "/usr/share/man/man7/openssl-core.h.7ssl.gz", "/usr/share/man/man7/openssl-core_dispatch.h.7ssl.gz", "/usr/share/man/man7/openssl-core_names.h.7ssl.gz", "/usr/share/man/man7/openssl-env.7ssl.gz", "/usr/share/man/man7/openssl-glossary.7ssl.gz", "/usr/share/man/man7/openssl-qlog.7ssl.gz", "/usr/share/man/man7/openssl-quic-concurrency.7ssl.gz", "/usr/share/man/man7/openssl-quic.7ssl.gz", "/usr/share/man/man7/openssl-threads.7ssl.gz", "/usr/share/man/man7/openssl_user_macros.7ssl.gz", "/usr/share/man/man7/ossl-guide-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-libcrypto-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-libraries-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-libssl-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-migration.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-client-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-client-non-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-multi-stream.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-server-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-server-non-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-client-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-client-non-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-server-block.7ssl.gz", "/usr/share/man/man7/ossl_store-file.7ssl.gz", "/usr/share/man/man7/ossl_store.7ssl.gz", "/usr/share/man/man7/passphrase-encoding.7ssl.gz", "/usr/share/man/man7/property.7ssl.gz", "/usr/share/man/man7/provider-asym_cipher.7ssl.gz", "/usr/share/man/man7/provider-base.7ssl.gz", "/usr/share/man/man7/provider-cipher.7ssl.gz", "/usr/share/man/man7/provider-decoder.7ssl.gz", "/usr/share/man/man7/provider-digest.7ssl.gz", "/usr/share/man/man7/provider-encoder.7ssl.gz", "/usr/share/man/man7/provider-kdf.7ssl.gz", "/usr/share/man/man7/provider-kem.7ssl.gz", "/usr/share/man/man7/provider-keyexch.7ssl.gz", "/usr/share/man/man7/provider-keymgmt.7ssl.gz", "/usr/share/man/man7/provider-mac.7ssl.gz", "/usr/share/man/man7/provider-object.7ssl.gz", "/usr/share/man/man7/provider-rand.7ssl.gz", "/usr/share/man/man7/provider-signature.7ssl.gz", "/usr/share/man/man7/provider-skeymgmt.7ssl.gz", "/usr/share/man/man7/provider-storemgmt.7ssl.gz", "/usr/share/man/man7/provider.7ssl.gz", "/usr/share/man/man7/proxy-certificates.7ssl.gz", "/usr/share/man/man7/x509.7ssl.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "openssl-provider-legacy@3.5.6-1~deb13u1", "Name": "openssl-provider-legacy", "Identifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "c38741326d0e034f" }, "Version": "3.5.6", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.5.6", "SrcRelease": "1~deb13u1", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libssl3t64@3.5.6-1~deb13u1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so", "/usr/share/doc/openssl-provider-legacy/changelog.Debian.gz", "/usr/share/doc/openssl-provider-legacy/changelog.gz", "/usr/share/doc/openssl-provider-legacy/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "passwd@1:4.17.4-2", "Name": "passwd", "Identifier": { "PURL": "pkg:deb/debian/passwd@4.17.4-2?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "d93f813ae3092e32" }, "Version": "4.17.4", "Release": "2", "Epoch": 1, "Arch": "amd64", "SrcName": "shadow", "SrcVersion": "4.17.4", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-1.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "base-passwd@3.6.7", "libacl1@2.3.2-2+b1", "libattr1@1:2.5.2-3", "libaudit1@1:4.0.2-2+b2", "libbsd0@0.12.2-2", "libc6@2.41-12+deb13u3", "libcrypt1@1:4.4.38-1", "libpam-modules@1.7.0-5", "libpam0g@1.7.0-5", "libselinux1@3.8.1-1", "libsemanage2@3.8.1-1", "login.defs@1:4.17.4-2" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/chage", "/usr/bin/chfn", "/usr/bin/chsh", "/usr/bin/expiry", "/usr/bin/gpasswd", "/usr/bin/passwd", "/usr/lib/tmpfiles.d/passwd.conf", "/usr/sbin/chgpasswd", "/usr/sbin/chpasswd", "/usr/sbin/groupadd", "/usr/sbin/groupdel", "/usr/sbin/groupmod", "/usr/sbin/grpck", "/usr/sbin/grpconv", "/usr/sbin/grpunconv", "/usr/sbin/newusers", "/usr/sbin/pwck", "/usr/sbin/pwconv", "/usr/sbin/pwunconv", "/usr/sbin/shadowconfig", "/usr/sbin/useradd", "/usr/sbin/userdel", "/usr/sbin/usermod", "/usr/sbin/vipw", "/usr/share/doc/passwd/NEWS.Debian.gz", "/usr/share/doc/passwd/README.Debian", "/usr/share/doc/passwd/TODO.Debian", "/usr/share/doc/passwd/changelog.Debian.gz", "/usr/share/doc/passwd/changelog.gz", "/usr/share/doc/passwd/copyright", "/usr/share/doc/passwd/examples/passwd.expire.cron", "/usr/share/lintian/overrides/passwd", "/usr/share/locale/bs/LC_MESSAGES/shadow.mo", "/usr/share/locale/ca/LC_MESSAGES/shadow.mo", "/usr/share/locale/cs/LC_MESSAGES/shadow.mo", "/usr/share/locale/da/LC_MESSAGES/shadow.mo", "/usr/share/locale/de/LC_MESSAGES/shadow.mo", "/usr/share/locale/dz/LC_MESSAGES/shadow.mo", "/usr/share/locale/el/LC_MESSAGES/shadow.mo", "/usr/share/locale/es/LC_MESSAGES/shadow.mo", "/usr/share/locale/eu/LC_MESSAGES/shadow.mo", "/usr/share/locale/fi/LC_MESSAGES/shadow.mo", "/usr/share/locale/fr/LC_MESSAGES/shadow.mo", "/usr/share/locale/gl/LC_MESSAGES/shadow.mo", "/usr/share/locale/he/LC_MESSAGES/shadow.mo", "/usr/share/locale/hu/LC_MESSAGES/shadow.mo", "/usr/share/locale/id/LC_MESSAGES/shadow.mo", "/usr/share/locale/it/LC_MESSAGES/shadow.mo", "/usr/share/locale/ja/LC_MESSAGES/shadow.mo", "/usr/share/locale/ka/LC_MESSAGES/shadow.mo", "/usr/share/locale/kk/LC_MESSAGES/shadow.mo", "/usr/share/locale/km/LC_MESSAGES/shadow.mo", "/usr/share/locale/ko/LC_MESSAGES/shadow.mo", "/usr/share/locale/nb/LC_MESSAGES/shadow.mo", "/usr/share/locale/ne/LC_MESSAGES/shadow.mo", "/usr/share/locale/nl/LC_MESSAGES/shadow.mo", "/usr/share/locale/nn/LC_MESSAGES/shadow.mo", "/usr/share/locale/pl/LC_MESSAGES/shadow.mo", "/usr/share/locale/pt/LC_MESSAGES/shadow.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/shadow.mo", "/usr/share/locale/ro/LC_MESSAGES/shadow.mo", "/usr/share/locale/ru/LC_MESSAGES/shadow.mo", "/usr/share/locale/sk/LC_MESSAGES/shadow.mo", "/usr/share/locale/sq/LC_MESSAGES/shadow.mo", "/usr/share/locale/sv/LC_MESSAGES/shadow.mo", "/usr/share/locale/tl/LC_MESSAGES/shadow.mo", "/usr/share/locale/tr/LC_MESSAGES/shadow.mo", "/usr/share/locale/uk/LC_MESSAGES/shadow.mo", "/usr/share/locale/vi/LC_MESSAGES/shadow.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/shadow.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/shadow.mo", "/usr/share/man/cs/man1/expiry.1.gz", "/usr/share/man/cs/man1/gpasswd.1.gz", "/usr/share/man/cs/man5/gshadow.5.gz", "/usr/share/man/cs/man5/passwd.5.gz", "/usr/share/man/cs/man5/shadow.5.gz", "/usr/share/man/cs/man8/groupadd.8.gz", "/usr/share/man/cs/man8/groupdel.8.gz", "/usr/share/man/cs/man8/groupmod.8.gz", "/usr/share/man/cs/man8/grpck.8.gz", "/usr/share/man/cs/man8/vipw.8.gz", "/usr/share/man/da/man1/chfn.1.gz", "/usr/share/man/da/man5/gshadow.5.gz", "/usr/share/man/da/man8/groupdel.8.gz", "/usr/share/man/da/man8/vipw.8.gz", "/usr/share/man/de/man1/chage.1.gz", "/usr/share/man/de/man1/chfn.1.gz", "/usr/share/man/de/man1/chsh.1.gz", "/usr/share/man/de/man1/expiry.1.gz", "/usr/share/man/de/man1/gpasswd.1.gz", "/usr/share/man/de/man1/passwd.1.gz", "/usr/share/man/de/man5/gshadow.5.gz", "/usr/share/man/de/man5/passwd.5.gz", "/usr/share/man/de/man5/shadow.5.gz", "/usr/share/man/de/man8/chgpasswd.8.gz", "/usr/share/man/de/man8/chpasswd.8.gz", "/usr/share/man/de/man8/groupadd.8.gz", "/usr/share/man/de/man8/groupdel.8.gz", "/usr/share/man/de/man8/groupmod.8.gz", "/usr/share/man/de/man8/grpck.8.gz", "/usr/share/man/de/man8/newusers.8.gz", "/usr/share/man/de/man8/pwck.8.gz", "/usr/share/man/de/man8/pwconv.8.gz", "/usr/share/man/de/man8/useradd.8.gz", "/usr/share/man/de/man8/userdel.8.gz", "/usr/share/man/de/man8/usermod.8.gz", "/usr/share/man/de/man8/vipw.8.gz", "/usr/share/man/fi/man1/chfn.1.gz", "/usr/share/man/fi/man1/chsh.1.gz", "/usr/share/man/fr/man1/chage.1.gz", "/usr/share/man/fr/man1/chfn.1.gz", "/usr/share/man/fr/man1/chsh.1.gz", "/usr/share/man/fr/man1/expiry.1.gz", "/usr/share/man/fr/man1/gpasswd.1.gz", "/usr/share/man/fr/man1/passwd.1.gz", "/usr/share/man/fr/man5/gshadow.5.gz", "/usr/share/man/fr/man5/passwd.5.gz", "/usr/share/man/fr/man5/shadow.5.gz", "/usr/share/man/fr/man5/subgid.5.gz", "/usr/share/man/fr/man5/subuid.5.gz", "/usr/share/man/fr/man8/chgpasswd.8.gz", "/usr/share/man/fr/man8/chpasswd.8.gz", "/usr/share/man/fr/man8/groupadd.8.gz", "/usr/share/man/fr/man8/groupdel.8.gz", "/usr/share/man/fr/man8/groupmod.8.gz", "/usr/share/man/fr/man8/grpck.8.gz", "/usr/share/man/fr/man8/newusers.8.gz", "/usr/share/man/fr/man8/pwck.8.gz", "/usr/share/man/fr/man8/pwconv.8.gz", "/usr/share/man/fr/man8/useradd.8.gz", "/usr/share/man/fr/man8/userdel.8.gz", "/usr/share/man/fr/man8/usermod.8.gz", "/usr/share/man/fr/man8/vipw.8.gz", "/usr/share/man/hu/man1/chsh.1.gz", "/usr/share/man/hu/man1/gpasswd.1.gz", "/usr/share/man/hu/man1/passwd.1.gz", "/usr/share/man/hu/man5/passwd.5.gz", "/usr/share/man/id/man1/chsh.1.gz", "/usr/share/man/id/man8/useradd.8.gz", "/usr/share/man/it/man1/chage.1.gz", "/usr/share/man/it/man1/chfn.1.gz", "/usr/share/man/it/man1/chsh.1.gz", "/usr/share/man/it/man1/expiry.1.gz", "/usr/share/man/it/man1/gpasswd.1.gz", "/usr/share/man/it/man1/passwd.1.gz", "/usr/share/man/it/man5/gshadow.5.gz", "/usr/share/man/it/man5/passwd.5.gz", "/usr/share/man/it/man5/shadow.5.gz", "/usr/share/man/it/man8/chgpasswd.8.gz", "/usr/share/man/it/man8/chpasswd.8.gz", "/usr/share/man/it/man8/groupadd.8.gz", "/usr/share/man/it/man8/groupdel.8.gz", "/usr/share/man/it/man8/groupmod.8.gz", "/usr/share/man/it/man8/grpck.8.gz", "/usr/share/man/it/man8/newusers.8.gz", "/usr/share/man/it/man8/pwck.8.gz", "/usr/share/man/it/man8/pwconv.8.gz", "/usr/share/man/it/man8/useradd.8.gz", "/usr/share/man/it/man8/userdel.8.gz", "/usr/share/man/it/man8/usermod.8.gz", "/usr/share/man/it/man8/vipw.8.gz", "/usr/share/man/ja/man1/chage.1.gz", "/usr/share/man/ja/man1/chfn.1.gz", "/usr/share/man/ja/man1/chsh.1.gz", "/usr/share/man/ja/man1/expiry.1.gz", "/usr/share/man/ja/man1/gpasswd.1.gz", "/usr/share/man/ja/man1/passwd.1.gz", "/usr/share/man/ja/man5/passwd.5.gz", "/usr/share/man/ja/man5/shadow.5.gz", "/usr/share/man/ja/man8/chpasswd.8.gz", "/usr/share/man/ja/man8/groupadd.8.gz", "/usr/share/man/ja/man8/groupdel.8.gz", "/usr/share/man/ja/man8/groupmod.8.gz", "/usr/share/man/ja/man8/grpck.8.gz", "/usr/share/man/ja/man8/newusers.8.gz", "/usr/share/man/ja/man8/pwck.8.gz", "/usr/share/man/ja/man8/pwconv.8.gz", "/usr/share/man/ja/man8/useradd.8.gz", "/usr/share/man/ja/man8/userdel.8.gz", "/usr/share/man/ja/man8/usermod.8.gz", "/usr/share/man/ja/man8/vipw.8.gz", "/usr/share/man/ko/man1/chfn.1.gz", "/usr/share/man/ko/man1/chsh.1.gz", "/usr/share/man/ko/man5/passwd.5.gz", "/usr/share/man/ko/man8/vipw.8.gz", "/usr/share/man/man1/chage.1.gz", "/usr/share/man/man1/chfn.1.gz", "/usr/share/man/man1/chsh.1.gz", "/usr/share/man/man1/expiry.1.gz", "/usr/share/man/man1/gpasswd.1.gz", "/usr/share/man/man1/passwd.1.gz", "/usr/share/man/man5/gshadow.5.gz", "/usr/share/man/man5/passwd.5.gz", "/usr/share/man/man5/shadow.5.gz", "/usr/share/man/man5/subgid.5.gz", "/usr/share/man/man5/subuid.5.gz", "/usr/share/man/man8/chgpasswd.8.gz", "/usr/share/man/man8/chpasswd.8.gz", "/usr/share/man/man8/groupadd.8.gz", "/usr/share/man/man8/groupdel.8.gz", "/usr/share/man/man8/groupmod.8.gz", "/usr/share/man/man8/grpck.8.gz", "/usr/share/man/man8/newusers.8.gz", "/usr/share/man/man8/pwck.8.gz", "/usr/share/man/man8/pwconv.8.gz", "/usr/share/man/man8/shadowconfig.8.gz", "/usr/share/man/man8/useradd.8.gz", "/usr/share/man/man8/userdel.8.gz", "/usr/share/man/man8/usermod.8.gz", "/usr/share/man/man8/vipw.8.gz", "/usr/share/man/pl/man1/chage.1.gz", "/usr/share/man/pl/man1/chsh.1.gz", "/usr/share/man/pl/man1/expiry.1.gz", "/usr/share/man/pl/man8/groupadd.8.gz", "/usr/share/man/pl/man8/groupdel.8.gz", "/usr/share/man/pl/man8/groupmod.8.gz", "/usr/share/man/pl/man8/grpck.8.gz", "/usr/share/man/pl/man8/userdel.8.gz", "/usr/share/man/pl/man8/usermod.8.gz", "/usr/share/man/pl/man8/vipw.8.gz", "/usr/share/man/pt_BR/man1/gpasswd.1.gz", "/usr/share/man/pt_BR/man5/passwd.5.gz", "/usr/share/man/pt_BR/man5/shadow.5.gz", "/usr/share/man/pt_BR/man8/groupadd.8.gz", "/usr/share/man/pt_BR/man8/groupdel.8.gz", "/usr/share/man/pt_BR/man8/groupmod.8.gz", "/usr/share/man/ru/man1/chage.1.gz", "/usr/share/man/ru/man1/chfn.1.gz", "/usr/share/man/ru/man1/chsh.1.gz", "/usr/share/man/ru/man1/expiry.1.gz", "/usr/share/man/ru/man1/gpasswd.1.gz", "/usr/share/man/ru/man1/passwd.1.gz", "/usr/share/man/ru/man5/gshadow.5.gz", "/usr/share/man/ru/man5/passwd.5.gz", "/usr/share/man/ru/man5/shadow.5.gz", "/usr/share/man/ru/man8/chgpasswd.8.gz", "/usr/share/man/ru/man8/chpasswd.8.gz", "/usr/share/man/ru/man8/groupadd.8.gz", "/usr/share/man/ru/man8/groupdel.8.gz", "/usr/share/man/ru/man8/groupmod.8.gz", "/usr/share/man/ru/man8/grpck.8.gz", "/usr/share/man/ru/man8/newusers.8.gz", "/usr/share/man/ru/man8/pwck.8.gz", "/usr/share/man/ru/man8/pwconv.8.gz", "/usr/share/man/ru/man8/useradd.8.gz", "/usr/share/man/ru/man8/userdel.8.gz", "/usr/share/man/ru/man8/usermod.8.gz", "/usr/share/man/ru/man8/vipw.8.gz", "/usr/share/man/sv/man1/chage.1.gz", "/usr/share/man/sv/man1/chsh.1.gz", "/usr/share/man/sv/man1/expiry.1.gz", "/usr/share/man/sv/man1/passwd.1.gz", "/usr/share/man/sv/man5/gshadow.5.gz", "/usr/share/man/sv/man5/passwd.5.gz", "/usr/share/man/sv/man8/groupadd.8.gz", "/usr/share/man/sv/man8/groupdel.8.gz", "/usr/share/man/sv/man8/groupmod.8.gz", "/usr/share/man/sv/man8/grpck.8.gz", "/usr/share/man/sv/man8/pwck.8.gz", "/usr/share/man/sv/man8/userdel.8.gz", "/usr/share/man/sv/man8/vipw.8.gz", "/usr/share/man/tr/man1/chage.1.gz", "/usr/share/man/tr/man1/chfn.1.gz", "/usr/share/man/tr/man1/passwd.1.gz", "/usr/share/man/tr/man5/passwd.5.gz", "/usr/share/man/tr/man5/shadow.5.gz", "/usr/share/man/tr/man8/groupadd.8.gz", "/usr/share/man/tr/man8/groupdel.8.gz", "/usr/share/man/tr/man8/groupmod.8.gz", "/usr/share/man/tr/man8/useradd.8.gz", "/usr/share/man/tr/man8/userdel.8.gz", "/usr/share/man/tr/man8/usermod.8.gz", "/usr/share/man/uk/man1/chage.1.gz", "/usr/share/man/uk/man1/chfn.1.gz", "/usr/share/man/uk/man1/chsh.1.gz", "/usr/share/man/uk/man1/expiry.1.gz", "/usr/share/man/uk/man1/gpasswd.1.gz", "/usr/share/man/uk/man1/passwd.1.gz", "/usr/share/man/uk/man5/gshadow.5.gz", "/usr/share/man/uk/man5/passwd.5.gz", "/usr/share/man/uk/man5/shadow.5.gz", "/usr/share/man/uk/man8/chgpasswd.8.gz", "/usr/share/man/uk/man8/chpasswd.8.gz", "/usr/share/man/uk/man8/groupadd.8.gz", "/usr/share/man/uk/man8/groupdel.8.gz", "/usr/share/man/uk/man8/groupmod.8.gz", "/usr/share/man/uk/man8/grpck.8.gz", "/usr/share/man/uk/man8/newusers.8.gz", "/usr/share/man/uk/man8/pwck.8.gz", "/usr/share/man/uk/man8/pwconv.8.gz", "/usr/share/man/uk/man8/useradd.8.gz", "/usr/share/man/uk/man8/userdel.8.gz", "/usr/share/man/uk/man8/usermod.8.gz", "/usr/share/man/uk/man8/vipw.8.gz", "/usr/share/man/zh_CN/man1/chage.1.gz", "/usr/share/man/zh_CN/man1/chfn.1.gz", "/usr/share/man/zh_CN/man1/chsh.1.gz", "/usr/share/man/zh_CN/man1/expiry.1.gz", "/usr/share/man/zh_CN/man1/gpasswd.1.gz", "/usr/share/man/zh_CN/man1/passwd.1.gz", "/usr/share/man/zh_CN/man5/gshadow.5.gz", "/usr/share/man/zh_CN/man5/passwd.5.gz", "/usr/share/man/zh_CN/man5/shadow.5.gz", "/usr/share/man/zh_CN/man8/chgpasswd.8.gz", "/usr/share/man/zh_CN/man8/chpasswd.8.gz", "/usr/share/man/zh_CN/man8/groupadd.8.gz", "/usr/share/man/zh_CN/man8/groupdel.8.gz", "/usr/share/man/zh_CN/man8/groupmod.8.gz", "/usr/share/man/zh_CN/man8/grpck.8.gz", "/usr/share/man/zh_CN/man8/newusers.8.gz", "/usr/share/man/zh_CN/man8/pwck.8.gz", "/usr/share/man/zh_CN/man8/pwconv.8.gz", "/usr/share/man/zh_CN/man8/useradd.8.gz", "/usr/share/man/zh_CN/man8/userdel.8.gz", "/usr/share/man/zh_CN/man8/usermod.8.gz", "/usr/share/man/zh_CN/man8/vipw.8.gz", "/usr/share/man/zh_TW/man1/chfn.1.gz", "/usr/share/man/zh_TW/man1/chsh.1.gz", "/usr/share/man/zh_TW/man5/passwd.5.gz", "/usr/share/man/zh_TW/man8/chpasswd.8.gz", "/usr/share/man/zh_TW/man8/groupadd.8.gz", "/usr/share/man/zh_TW/man8/groupdel.8.gz", "/usr/share/man/zh_TW/man8/groupmod.8.gz", "/usr/share/man/zh_TW/man8/useradd.8.gz", "/usr/share/man/zh_TW/man8/userdel.8.gz", "/usr/share/man/zh_TW/man8/usermod.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "perl-base@5.40.1-6", "Name": "perl-base", "Identifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.5", "UID": "546ba1bdcd66d61" }, "Version": "5.40.1", "Release": "6", "Arch": "amd64", "SrcName": "perl", "SrcVersion": "5.40.1", "SrcRelease": "6", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "FSFAP", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/perl", "/usr/bin/perl5.40.1", "/usr/lib/x86_64-linux-gnu/perl-base/AutoLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Carp.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Carp/Heavy.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Config.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Config_git.pl", "/usr/lib/x86_64-linux-gnu/perl-base/Config_heavy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/Cwd.pm", "/usr/lib/x86_64-linux-gnu/perl-base/DynaLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Errno.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Exporter.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Exporter/Heavy.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Fcntl.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Basename.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Glob.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Path.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Spec.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Spec/Unix.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Temp.pm", "/usr/lib/x86_64-linux-gnu/perl-base/FileHandle.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Getopt/Long.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Getopt/Long/Parser.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Hash/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/File.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Handle.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Pipe.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Seekable.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Select.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/INET.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/IP.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/UNIX.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open2.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm", "/usr/lib/x86_64-linux-gnu/perl-base/List/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/POSIX.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Scalar/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/SelectSaver.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Symbol.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/ParseWords.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/Tabs.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/Wrap.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Tie/Hash.pm", "/usr/lib/x86_64-linux-gnu/perl-base/XSLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/attributes.pm", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Cwd/Cwd.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Fcntl/Fcntl.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/File/Glob/Glob.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Hash/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/IO/IO.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/List/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/POSIX/POSIX.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Socket/Socket.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/attributes/attributes.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/re/re.so", "/usr/lib/x86_64-linux-gnu/perl-base/base.pm", "/usr/lib/x86_64-linux-gnu/perl-base/builtin.pm", "/usr/lib/x86_64-linux-gnu/perl-base/bytes.pm", "/usr/lib/x86_64-linux-gnu/perl-base/constant.pm", "/usr/lib/x86_64-linux-gnu/perl-base/feature.pm", "/usr/lib/x86_64-linux-gnu/perl-base/fields.pm", "/usr/lib/x86_64-linux-gnu/perl-base/integer.pm", "/usr/lib/x86_64-linux-gnu/perl-base/lib.pm", "/usr/lib/x86_64-linux-gnu/perl-base/locale.pm", "/usr/lib/x86_64-linux-gnu/perl-base/overload.pm", "/usr/lib/x86_64-linux-gnu/perl-base/overloading.pm", "/usr/lib/x86_64-linux-gnu/perl-base/parent.pm", "/usr/lib/x86_64-linux-gnu/perl-base/re.pm", "/usr/lib/x86_64-linux-gnu/perl-base/strict.pm", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Age.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bmg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bpb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bpt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Cf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Ea.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/EqUIdeo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/GCB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Gc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Hst.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Identif2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Identifi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/InPC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/InSC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Isc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Jg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Jt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Lb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Lc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFCQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFDQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKCCF.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKCQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKDQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Na1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NameAlia.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Nt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Nv.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/PerlDeci.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/SB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Sc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Scx.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Tc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Uc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Vo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/WB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/_PerlLB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/_PerlSCX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V100.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V11.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V110.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V120.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V130.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V140.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V150.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V20.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V30.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V31.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V32.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V40.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V41.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V50.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V51.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V52.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V60.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V61.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V70.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V80.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V90.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Alpha/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/AN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/B.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/BN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/CS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/EN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ES.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ET.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/NSM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ON.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/WS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/BidiC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/BidiM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Blk/NB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/O.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CE/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CI/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWCF/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWCM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWKCF/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWL/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWT/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWU/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Cased/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/A.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/AR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/ATAR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/B.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/BR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/DB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/NK.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/NR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/OV.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/VR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CompEx/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/DI/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dash/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dep/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dia/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Com.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Enc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Fin.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Font.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Init.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Iso.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Med.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Nar.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Nb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/NonCanon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sqr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sub.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sup.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Vert.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EBase/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EComp/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EPres/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/A.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/H.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/Na.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/W.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Emoji/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ext/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/ExtPict/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/CN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/LV.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/LVT.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/PP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/SM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Cf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Cn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/LC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Ll.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/M.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Mc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Me.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Mn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Nd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Nl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/No.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/P.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pe.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Po.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Ps.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/S.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sk.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/So.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Z.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Zs.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GrBase/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GrExt/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hex/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hst/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hyphen/T.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IDC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IDS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdStatus/Allowed.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdStatus/Restrict.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/DefaultI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Exclusio.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Inclusio.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/LimitedU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotChara.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotNFKC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotXID.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Obsolete.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Recommen.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Technica.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Uncommon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ideo/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/10_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/11_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/12_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/12_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/13_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/14_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/15_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/2_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/2_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/4_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/4_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/7_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/8_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/9_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Bottom.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/BottomAn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Left.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/LeftAndR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Overstru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Right.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Top.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndBo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndL2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndLe.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndRi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/VisualOr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Avagraha.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Bindu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Cantilla.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona5.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona7.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona9.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consonan.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Geminati.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Invisibl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Nukta.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Number.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Other.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/PureKill.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Syllable.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/ToneMark.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Virama.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Visarga.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Vowel.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/VowelDep.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/VowelInd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Ain.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Alef.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Beh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Dal.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/FarsiYeh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Feh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Gaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Hah.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/HanifiRo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Kaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Lam.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/NoJoinin.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Noon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Qaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Reh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Sad.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Seen.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Tah.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Waw.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Yeh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/D.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/T.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/U.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/AI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/BA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/BB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CJ.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/GL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/ID.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/IN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/IS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/NS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/OP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/PO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/PR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/QU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/SA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lower/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Math/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFCQC/M.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFCQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFDQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFDQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKCQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKCQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKDQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKDQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/Di.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/None.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/Nu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/10.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/100.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/10000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/100000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/11.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/12.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/13.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/14.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/15.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/17.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/18.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/19.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/20.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/200.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/20000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/30.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/300.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/30000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3_16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3_4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/40.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/400.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/4000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/40000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/5.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/50.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/500.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/5000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/50000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/60.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/600.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/6000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/60000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/7.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/70.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/700.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/7000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/70000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/80.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/800.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/8000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/80000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/9.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/90.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/900.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/9000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/90000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/PCM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/PatSyn/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Alnum.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Assigned.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Blank.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Graph.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/PerlWord.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/PosixPun.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Print.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/SpacePer.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Title.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Word.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/XPosixPu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlAny.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlCh2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlCha.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlFol.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIDC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIDS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIsI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlNch.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPat.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPr2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPro.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlQuo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/QMark/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/AT.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/CL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/FO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/LE.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/LO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/SC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/ST.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/Sp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/UP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SD/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/STerm/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Arab.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Beng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Cprt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Cyrl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Deva.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Dupl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Geor.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Glag.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gonm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gran.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Grek.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gujr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Guru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Han.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Hang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Hira.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Kana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Knda.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Latn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Limb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Linb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mlym.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mult.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Orya.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Sinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Syrc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Taml.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Telu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Zinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Zyyy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Adlm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Arab.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Armn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Beng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Bhks.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Bopo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cakm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cham.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Copt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cprt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cyrl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Deva.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Diak.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Dupl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Ethi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Geor.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Glag.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gonm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gran.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Grek.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gujr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Guru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Han.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hebr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hira.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hmng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hmnp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Kana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khar.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khmr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khoj.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Knda.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Kthi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lao.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Latn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Limb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lina.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Linb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mlym.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mult.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mymr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Nand.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Nko.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Orya.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Phlp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Rohg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Shrd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Sind.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Sinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Syrc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tagb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Takr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Talu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Taml.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Telu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Thaa.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tibt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tirh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Vith.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Xsux.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Yezi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Yi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zyyy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zzzz.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Term/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/UIdeo/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Upper/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/VS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/Tr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/Tu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/U.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/Extend.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/FO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/HL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/KA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/LE.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/MB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/ML.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/MN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/WSegSpac.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/XIDC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/XIDS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/utf8.pm", "/usr/lib/x86_64-linux-gnu/perl-base/vars.pm", "/usr/lib/x86_64-linux-gnu/perl-base/warnings.pm", "/usr/lib/x86_64-linux-gnu/perl-base/warnings/register.pm", "/usr/share/doc/perl-base/changelog.Debian.gz", "/usr/share/doc/perl-base/changelog.gz", "/usr/share/doc/perl-base/copyright", "/usr/share/doc/perl/AUTHORS.gz", "/usr/share/doc/perl/Documentation", "/usr/share/lintian/overrides/perl-base", "/usr/share/man/man1/perl.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "readline-common@8.2-6", "Name": "readline-common", "Identifier": { "PURL": "pkg:deb/debian/readline-common@8.2-6?arch=all\u0026distro=debian-13.5", "UID": "c4beab42d2a9a634" }, "Version": "8.2", "Release": "6", "Arch": "all", "SrcName": "readline", "SrcVersion": "8.2", "SrcRelease": "6", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-or-later", "ISC-no-attribution" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:c529e1b2553946dcc9afa2d77e33a75f23d3702e0b4a7911b67e2f1fe45a4939" }, "InstalledFiles": [ "/usr/share/doc/readline-common/changelog.Debian.gz", "/usr/share/doc/readline-common/changelog.gz", "/usr/share/doc/readline-common/copyright", "/usr/share/doc/readline-common/inputrc.arrows", "/usr/share/info/rluserman.info.gz", "/usr/share/lintian/overrides/readline-common", "/usr/share/man/man3/history.3readline.gz", "/usr/share/man/man3/readline.3readline.gz", "/usr/share/readline/inputrc" ], "AnalyzedBy": "dpkg" }, { "ID": "sed@4.9-2+deb13u1", "Name": "sed", "Identifier": { "PURL": "pkg:deb/debian/sed@4.9-2%2Bdeb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "a041ea16982bb927" }, "Version": "4.9", "Release": "2+deb13u1", "Arch": "amd64", "SrcName": "sed", "SrcVersion": "4.9", "SrcRelease": "2+deb13u1", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "X11", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-only", "ISC", "BSD-4-Clause-UC", "BSL-1", "pcre" ], "Maintainer": "Clint Adams \u003cclint@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/sed", "/usr/share/doc/sed/AUTHORS", "/usr/share/doc/sed/BUGS.gz", "/usr/share/doc/sed/NEWS.gz", "/usr/share/doc/sed/README", "/usr/share/doc/sed/THANKS.gz", "/usr/share/doc/sed/changelog.Debian.gz", "/usr/share/doc/sed/changelog.gz", "/usr/share/doc/sed/copyright", "/usr/share/doc/sed/examples/dc.sed", "/usr/share/doc/sed/sedfaq.txt.gz", "/usr/share/info/sed.info.gz", "/usr/share/locale/af/LC_MESSAGES/sed.mo", "/usr/share/locale/ast/LC_MESSAGES/sed.mo", "/usr/share/locale/bg/LC_MESSAGES/sed.mo", "/usr/share/locale/ca/LC_MESSAGES/sed.mo", "/usr/share/locale/cs/LC_MESSAGES/sed.mo", "/usr/share/locale/da/LC_MESSAGES/sed.mo", "/usr/share/locale/de/LC_MESSAGES/sed.mo", "/usr/share/locale/el/LC_MESSAGES/sed.mo", "/usr/share/locale/eo/LC_MESSAGES/sed.mo", "/usr/share/locale/es/LC_MESSAGES/sed.mo", "/usr/share/locale/et/LC_MESSAGES/sed.mo", "/usr/share/locale/eu/LC_MESSAGES/sed.mo", "/usr/share/locale/fi/LC_MESSAGES/sed.mo", "/usr/share/locale/fr/LC_MESSAGES/sed.mo", "/usr/share/locale/ga/LC_MESSAGES/sed.mo", "/usr/share/locale/gl/LC_MESSAGES/sed.mo", "/usr/share/locale/he/LC_MESSAGES/sed.mo", "/usr/share/locale/hr/LC_MESSAGES/sed.mo", "/usr/share/locale/hu/LC_MESSAGES/sed.mo", "/usr/share/locale/id/LC_MESSAGES/sed.mo", "/usr/share/locale/it/LC_MESSAGES/sed.mo", "/usr/share/locale/ja/LC_MESSAGES/sed.mo", "/usr/share/locale/ka/LC_MESSAGES/sed.mo", "/usr/share/locale/ko/LC_MESSAGES/sed.mo", "/usr/share/locale/nb/LC_MESSAGES/sed.mo", "/usr/share/locale/nl/LC_MESSAGES/sed.mo", "/usr/share/locale/pl/LC_MESSAGES/sed.mo", "/usr/share/locale/pt/LC_MESSAGES/sed.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/sed.mo", "/usr/share/locale/ro/LC_MESSAGES/sed.mo", "/usr/share/locale/ru/LC_MESSAGES/sed.mo", "/usr/share/locale/sk/LC_MESSAGES/sed.mo", "/usr/share/locale/sl/LC_MESSAGES/sed.mo", "/usr/share/locale/sr/LC_MESSAGES/sed.mo", "/usr/share/locale/sv/LC_MESSAGES/sed.mo", "/usr/share/locale/tr/LC_MESSAGES/sed.mo", "/usr/share/locale/uk/LC_MESSAGES/sed.mo", "/usr/share/locale/vi/LC_MESSAGES/sed.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/sed.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/sed.mo", "/usr/share/man/man1/sed.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "sqv@1.3.0-3+b2", "Name": "sqv", "Identifier": { "PURL": "pkg:deb/debian/sqv@1.3.0-3%2Bb2?arch=amd64\u0026distro=debian-13.5", "UID": "2bf11ffe79190750" }, "Version": "1.3.0", "Release": "3+b2", "Arch": "amd64", "SrcName": "rust-sequoia-sqv", "SrcVersion": "1.3.0", "SrcRelease": "3", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.0-only" ], "Maintainer": "Debian Rust Maintainers \u003cpkg-rust-maintainers@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libgmp10@2:6.3.0+dfsg-3", "libhogweed6t64@3.10.1-1", "libnettle8t64@3.10.1-1" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/sqv", "/usr/share/bash-completion/completions/sqv.bash", "/usr/share/doc/sqv/NEWS.gz", "/usr/share/doc/sqv/changelog.Debian.amd64.gz", "/usr/share/doc/sqv/changelog.Debian.gz", "/usr/share/doc/sqv/copyright", "/usr/share/fish/completions/sqv.fish", "/usr/share/man/man1/sqv.1.gz", "/usr/share/zsh/vendor-completions/_sqv" ], "AnalyzedBy": "dpkg" }, { "ID": "sysvinit-utils@3.14-4", "Name": "sysvinit-utils", "Identifier": { "PURL": "pkg:deb/debian/sysvinit-utils@3.14-4?arch=amd64\u0026distro=debian-13.5", "UID": "f7fb888c58ca826e" }, "Version": "3.14", "Release": "4", "Arch": "amd64", "SrcName": "sysvinit", "SrcVersion": "3.14", "SrcRelease": "4", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "GPL-3.0-only", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian sysvinit maintainers \u003cdebian-init-diversity@chiark.greenend.org.uk\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/init/init-d-script", "/usr/lib/init/vars.sh", "/usr/lib/lsb/init-functions", "/usr/lib/lsb/init-functions.d/00-verbose", "/usr/sbin/fstab-decode", "/usr/sbin/killall5", "/usr/share/doc/sysvinit-utils/changelog.Debian.gz", "/usr/share/doc/sysvinit-utils/copyright", "/usr/share/man/man5/init-d-script.5.gz", "/usr/share/man/man8/fstab-decode.8.gz", "/usr/share/man/man8/killall5.8.gz", "/usr/share/man/man8/pidof.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "tar@1.35+dfsg-3.1", "Name": "tar", "Identifier": { "PURL": "pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=amd64\u0026distro=debian-13.5", "UID": "4f69996c49afbaca" }, "Version": "1.35+dfsg", "Release": "3.1", "Arch": "amd64", "SrcName": "tar", "SrcVersion": "1.35+dfsg", "SrcRelease": "3.1", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-3+ with Bison exception", "LGPL-2.1-or-later", "LGPL-2.1-only", "LGPL-3.0-or-later", "LGPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Janos Lenart \u003cocsi@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/tar", "/usr/lib/mime/packages/tar", "/usr/sbin/rmt-tar", "/usr/sbin/tarcat", "/usr/share/doc/tar/AUTHORS", "/usr/share/doc/tar/NEWS.gz", "/usr/share/doc/tar/README.Debian", "/usr/share/doc/tar/THANKS.gz", "/usr/share/doc/tar/changelog.1.gz", "/usr/share/doc/tar/changelog.Debian.gz", "/usr/share/doc/tar/changelog.gz", "/usr/share/doc/tar/copyright", "/usr/share/locale/bg/LC_MESSAGES/tar.mo", "/usr/share/locale/ca/LC_MESSAGES/tar.mo", "/usr/share/locale/cs/LC_MESSAGES/tar.mo", "/usr/share/locale/da/LC_MESSAGES/tar.mo", "/usr/share/locale/de/LC_MESSAGES/tar.mo", "/usr/share/locale/el/LC_MESSAGES/tar.mo", "/usr/share/locale/eo/LC_MESSAGES/tar.mo", "/usr/share/locale/es/LC_MESSAGES/tar.mo", "/usr/share/locale/et/LC_MESSAGES/tar.mo", "/usr/share/locale/eu/LC_MESSAGES/tar.mo", "/usr/share/locale/fi/LC_MESSAGES/tar.mo", "/usr/share/locale/fr/LC_MESSAGES/tar.mo", "/usr/share/locale/ga/LC_MESSAGES/tar.mo", "/usr/share/locale/gl/LC_MESSAGES/tar.mo", "/usr/share/locale/hr/LC_MESSAGES/tar.mo", "/usr/share/locale/hu/LC_MESSAGES/tar.mo", "/usr/share/locale/id/LC_MESSAGES/tar.mo", "/usr/share/locale/it/LC_MESSAGES/tar.mo", "/usr/share/locale/ja/LC_MESSAGES/tar.mo", "/usr/share/locale/ka/LC_MESSAGES/tar.mo", "/usr/share/locale/ko/LC_MESSAGES/tar.mo", "/usr/share/locale/ky/LC_MESSAGES/tar.mo", "/usr/share/locale/ms/LC_MESSAGES/tar.mo", "/usr/share/locale/nb/LC_MESSAGES/tar.mo", "/usr/share/locale/nl/LC_MESSAGES/tar.mo", "/usr/share/locale/pl/LC_MESSAGES/tar.mo", "/usr/share/locale/pt/LC_MESSAGES/tar.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/tar.mo", "/usr/share/locale/ro/LC_MESSAGES/tar.mo", "/usr/share/locale/ru/LC_MESSAGES/tar.mo", "/usr/share/locale/sk/LC_MESSAGES/tar.mo", "/usr/share/locale/sl/LC_MESSAGES/tar.mo", "/usr/share/locale/sr/LC_MESSAGES/tar.mo", "/usr/share/locale/sv/LC_MESSAGES/tar.mo", "/usr/share/locale/tr/LC_MESSAGES/tar.mo", "/usr/share/locale/uk/LC_MESSAGES/tar.mo", "/usr/share/locale/vi/LC_MESSAGES/tar.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/tar.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/tar.mo", "/usr/share/man/man1/tar.1.gz", "/usr/share/man/man1/tarcat.1.gz", "/usr/share/man/man8/rmt-tar.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "tzdata@2026b-0+deb13u1", "Name": "tzdata", "Identifier": { "PURL": "pkg:deb/debian/tzdata@2026b-0%2Bdeb13u1?arch=all\u0026distro=debian-13.5", "UID": "9e352e373d8245f0" }, "Version": "2026b", "Release": "0+deb13u1", "Arch": "all", "SrcName": "tzdata", "SrcVersion": "2026b", "SrcRelease": "0+deb13u1", "Licenses": [ "public-domain" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/share/doc/tzdata/NEWS.Debian.gz", "/usr/share/doc/tzdata/README.Debian", "/usr/share/doc/tzdata/changelog.Debian.gz", "/usr/share/doc/tzdata/changelog.gz", "/usr/share/doc/tzdata/copyright", "/usr/share/lintian/overrides/tzdata", "/usr/share/zoneinfo/Africa/Abidjan", "/usr/share/zoneinfo/Africa/Accra", "/usr/share/zoneinfo/Africa/Addis_Ababa", "/usr/share/zoneinfo/Africa/Algiers", "/usr/share/zoneinfo/Africa/Asmara", "/usr/share/zoneinfo/Africa/Bamako", "/usr/share/zoneinfo/Africa/Bangui", "/usr/share/zoneinfo/Africa/Banjul", "/usr/share/zoneinfo/Africa/Bissau", "/usr/share/zoneinfo/Africa/Blantyre", "/usr/share/zoneinfo/Africa/Brazzaville", "/usr/share/zoneinfo/Africa/Bujumbura", "/usr/share/zoneinfo/Africa/Cairo", "/usr/share/zoneinfo/Africa/Casablanca", "/usr/share/zoneinfo/Africa/Ceuta", "/usr/share/zoneinfo/Africa/Conakry", "/usr/share/zoneinfo/Africa/Dakar", "/usr/share/zoneinfo/Africa/Dar_es_Salaam", "/usr/share/zoneinfo/Africa/Djibouti", "/usr/share/zoneinfo/Africa/Douala", "/usr/share/zoneinfo/Africa/El_Aaiun", "/usr/share/zoneinfo/Africa/Freetown", "/usr/share/zoneinfo/Africa/Gaborone", "/usr/share/zoneinfo/Africa/Harare", "/usr/share/zoneinfo/Africa/Johannesburg", "/usr/share/zoneinfo/Africa/Juba", "/usr/share/zoneinfo/Africa/Kampala", "/usr/share/zoneinfo/Africa/Khartoum", "/usr/share/zoneinfo/Africa/Kigali", "/usr/share/zoneinfo/Africa/Kinshasa", "/usr/share/zoneinfo/Africa/Lagos", "/usr/share/zoneinfo/Africa/Libreville", "/usr/share/zoneinfo/Africa/Lome", "/usr/share/zoneinfo/Africa/Luanda", "/usr/share/zoneinfo/Africa/Lubumbashi", "/usr/share/zoneinfo/Africa/Lusaka", "/usr/share/zoneinfo/Africa/Malabo", "/usr/share/zoneinfo/Africa/Maputo", "/usr/share/zoneinfo/Africa/Maseru", "/usr/share/zoneinfo/Africa/Mbabane", "/usr/share/zoneinfo/Africa/Mogadishu", "/usr/share/zoneinfo/Africa/Monrovia", "/usr/share/zoneinfo/Africa/Nairobi", "/usr/share/zoneinfo/Africa/Ndjamena", "/usr/share/zoneinfo/Africa/Niamey", "/usr/share/zoneinfo/Africa/Nouakchott", "/usr/share/zoneinfo/Africa/Ouagadougou", "/usr/share/zoneinfo/Africa/Porto-Novo", "/usr/share/zoneinfo/Africa/Sao_Tome", "/usr/share/zoneinfo/Africa/Tripoli", "/usr/share/zoneinfo/Africa/Tunis", "/usr/share/zoneinfo/Africa/Windhoek", "/usr/share/zoneinfo/America/Adak", "/usr/share/zoneinfo/America/Anchorage", "/usr/share/zoneinfo/America/Anguilla", "/usr/share/zoneinfo/America/Antigua", "/usr/share/zoneinfo/America/Araguaina", "/usr/share/zoneinfo/America/Argentina/Buenos_Aires", "/usr/share/zoneinfo/America/Argentina/Catamarca", "/usr/share/zoneinfo/America/Argentina/Cordoba", "/usr/share/zoneinfo/America/Argentina/Jujuy", "/usr/share/zoneinfo/America/Argentina/La_Rioja", "/usr/share/zoneinfo/America/Argentina/Mendoza", "/usr/share/zoneinfo/America/Argentina/Rio_Gallegos", "/usr/share/zoneinfo/America/Argentina/Salta", "/usr/share/zoneinfo/America/Argentina/San_Juan", "/usr/share/zoneinfo/America/Argentina/San_Luis", "/usr/share/zoneinfo/America/Argentina/Tucuman", "/usr/share/zoneinfo/America/Argentina/Ushuaia", "/usr/share/zoneinfo/America/Aruba", "/usr/share/zoneinfo/America/Asuncion", "/usr/share/zoneinfo/America/Atikokan", "/usr/share/zoneinfo/America/Bahia", "/usr/share/zoneinfo/America/Bahia_Banderas", "/usr/share/zoneinfo/America/Barbados", "/usr/share/zoneinfo/America/Belem", "/usr/share/zoneinfo/America/Belize", "/usr/share/zoneinfo/America/Blanc-Sablon", "/usr/share/zoneinfo/America/Boa_Vista", "/usr/share/zoneinfo/America/Bogota", "/usr/share/zoneinfo/America/Boise", "/usr/share/zoneinfo/America/Cambridge_Bay", "/usr/share/zoneinfo/America/Campo_Grande", "/usr/share/zoneinfo/America/Cancun", "/usr/share/zoneinfo/America/Caracas", "/usr/share/zoneinfo/America/Cayenne", "/usr/share/zoneinfo/America/Cayman", "/usr/share/zoneinfo/America/Chicago", "/usr/share/zoneinfo/America/Chihuahua", "/usr/share/zoneinfo/America/Ciudad_Juarez", "/usr/share/zoneinfo/America/Costa_Rica", "/usr/share/zoneinfo/America/Coyhaique", "/usr/share/zoneinfo/America/Creston", "/usr/share/zoneinfo/America/Cuiaba", "/usr/share/zoneinfo/America/Curacao", "/usr/share/zoneinfo/America/Danmarkshavn", "/usr/share/zoneinfo/America/Dawson", "/usr/share/zoneinfo/America/Dawson_Creek", "/usr/share/zoneinfo/America/Denver", "/usr/share/zoneinfo/America/Detroit", "/usr/share/zoneinfo/America/Dominica", "/usr/share/zoneinfo/America/Edmonton", "/usr/share/zoneinfo/America/Eirunepe", "/usr/share/zoneinfo/America/El_Salvador", "/usr/share/zoneinfo/America/Fort_Nelson", "/usr/share/zoneinfo/America/Fortaleza", "/usr/share/zoneinfo/America/Glace_Bay", "/usr/share/zoneinfo/America/Goose_Bay", "/usr/share/zoneinfo/America/Grand_Turk", "/usr/share/zoneinfo/America/Grenada", "/usr/share/zoneinfo/America/Guadeloupe", "/usr/share/zoneinfo/America/Guatemala", "/usr/share/zoneinfo/America/Guayaquil", "/usr/share/zoneinfo/America/Guyana", "/usr/share/zoneinfo/America/Halifax", "/usr/share/zoneinfo/America/Havana", "/usr/share/zoneinfo/America/Hermosillo", "/usr/share/zoneinfo/America/Indiana/Indianapolis", "/usr/share/zoneinfo/America/Indiana/Knox", "/usr/share/zoneinfo/America/Indiana/Marengo", "/usr/share/zoneinfo/America/Indiana/Petersburg", "/usr/share/zoneinfo/America/Indiana/Tell_City", "/usr/share/zoneinfo/America/Indiana/Vevay", "/usr/share/zoneinfo/America/Indiana/Vincennes", "/usr/share/zoneinfo/America/Indiana/Winamac", "/usr/share/zoneinfo/America/Inuvik", "/usr/share/zoneinfo/America/Iqaluit", "/usr/share/zoneinfo/America/Jamaica", "/usr/share/zoneinfo/America/Juneau", "/usr/share/zoneinfo/America/Kentucky/Louisville", "/usr/share/zoneinfo/America/Kentucky/Monticello", "/usr/share/zoneinfo/America/La_Paz", "/usr/share/zoneinfo/America/Lima", "/usr/share/zoneinfo/America/Los_Angeles", "/usr/share/zoneinfo/America/Maceio", "/usr/share/zoneinfo/America/Managua", "/usr/share/zoneinfo/America/Manaus", "/usr/share/zoneinfo/America/Martinique", "/usr/share/zoneinfo/America/Matamoros", "/usr/share/zoneinfo/America/Mazatlan", "/usr/share/zoneinfo/America/Menominee", "/usr/share/zoneinfo/America/Merida", "/usr/share/zoneinfo/America/Metlakatla", "/usr/share/zoneinfo/America/Mexico_City", "/usr/share/zoneinfo/America/Miquelon", "/usr/share/zoneinfo/America/Moncton", "/usr/share/zoneinfo/America/Monterrey", "/usr/share/zoneinfo/America/Montevideo", "/usr/share/zoneinfo/America/Montserrat", "/usr/share/zoneinfo/America/Nassau", "/usr/share/zoneinfo/America/New_York", "/usr/share/zoneinfo/America/Nome", "/usr/share/zoneinfo/America/Noronha", "/usr/share/zoneinfo/America/North_Dakota/Beulah", "/usr/share/zoneinfo/America/North_Dakota/Center", "/usr/share/zoneinfo/America/North_Dakota/New_Salem", "/usr/share/zoneinfo/America/Nuuk", "/usr/share/zoneinfo/America/Ojinaga", "/usr/share/zoneinfo/America/Panama", "/usr/share/zoneinfo/America/Paramaribo", "/usr/share/zoneinfo/America/Phoenix", "/usr/share/zoneinfo/America/Port-au-Prince", "/usr/share/zoneinfo/America/Port_of_Spain", "/usr/share/zoneinfo/America/Porto_Velho", "/usr/share/zoneinfo/America/Puerto_Rico", "/usr/share/zoneinfo/America/Punta_Arenas", "/usr/share/zoneinfo/America/Rankin_Inlet", "/usr/share/zoneinfo/America/Recife", "/usr/share/zoneinfo/America/Regina", "/usr/share/zoneinfo/America/Resolute", "/usr/share/zoneinfo/America/Rio_Branco", "/usr/share/zoneinfo/America/Santarem", "/usr/share/zoneinfo/America/Santiago", "/usr/share/zoneinfo/America/Santo_Domingo", "/usr/share/zoneinfo/America/Sao_Paulo", "/usr/share/zoneinfo/America/Scoresbysund", "/usr/share/zoneinfo/America/Sitka", "/usr/share/zoneinfo/America/St_Johns", "/usr/share/zoneinfo/America/St_Kitts", "/usr/share/zoneinfo/America/St_Lucia", "/usr/share/zoneinfo/America/St_Thomas", "/usr/share/zoneinfo/America/St_Vincent", "/usr/share/zoneinfo/America/Swift_Current", "/usr/share/zoneinfo/America/Tegucigalpa", "/usr/share/zoneinfo/America/Thule", "/usr/share/zoneinfo/America/Tijuana", "/usr/share/zoneinfo/America/Toronto", "/usr/share/zoneinfo/America/Tortola", "/usr/share/zoneinfo/America/Vancouver", "/usr/share/zoneinfo/America/Whitehorse", "/usr/share/zoneinfo/America/Winnipeg", "/usr/share/zoneinfo/America/Yakutat", "/usr/share/zoneinfo/Antarctica/Casey", "/usr/share/zoneinfo/Antarctica/Davis", "/usr/share/zoneinfo/Antarctica/DumontDUrville", "/usr/share/zoneinfo/Antarctica/Macquarie", "/usr/share/zoneinfo/Antarctica/Mawson", "/usr/share/zoneinfo/Antarctica/McMurdo", "/usr/share/zoneinfo/Antarctica/Palmer", "/usr/share/zoneinfo/Antarctica/Rothera", "/usr/share/zoneinfo/Antarctica/Syowa", "/usr/share/zoneinfo/Antarctica/Troll", "/usr/share/zoneinfo/Antarctica/Vostok", "/usr/share/zoneinfo/Asia/Aden", "/usr/share/zoneinfo/Asia/Almaty", "/usr/share/zoneinfo/Asia/Amman", "/usr/share/zoneinfo/Asia/Anadyr", "/usr/share/zoneinfo/Asia/Aqtau", "/usr/share/zoneinfo/Asia/Aqtobe", "/usr/share/zoneinfo/Asia/Ashgabat", "/usr/share/zoneinfo/Asia/Atyrau", "/usr/share/zoneinfo/Asia/Baghdad", "/usr/share/zoneinfo/Asia/Bahrain", "/usr/share/zoneinfo/Asia/Baku", "/usr/share/zoneinfo/Asia/Bangkok", "/usr/share/zoneinfo/Asia/Barnaul", "/usr/share/zoneinfo/Asia/Beirut", "/usr/share/zoneinfo/Asia/Bishkek", "/usr/share/zoneinfo/Asia/Brunei", "/usr/share/zoneinfo/Asia/Chita", "/usr/share/zoneinfo/Asia/Colombo", "/usr/share/zoneinfo/Asia/Damascus", "/usr/share/zoneinfo/Asia/Dhaka", "/usr/share/zoneinfo/Asia/Dili", "/usr/share/zoneinfo/Asia/Dubai", "/usr/share/zoneinfo/Asia/Dushanbe", "/usr/share/zoneinfo/Asia/Famagusta", "/usr/share/zoneinfo/Asia/Gaza", "/usr/share/zoneinfo/Asia/Hebron", "/usr/share/zoneinfo/Asia/Ho_Chi_Minh", "/usr/share/zoneinfo/Asia/Hong_Kong", "/usr/share/zoneinfo/Asia/Hovd", "/usr/share/zoneinfo/Asia/Irkutsk", "/usr/share/zoneinfo/Asia/Jakarta", "/usr/share/zoneinfo/Asia/Jayapura", "/usr/share/zoneinfo/Asia/Jerusalem", "/usr/share/zoneinfo/Asia/Kabul", "/usr/share/zoneinfo/Asia/Kamchatka", "/usr/share/zoneinfo/Asia/Karachi", "/usr/share/zoneinfo/Asia/Kathmandu", "/usr/share/zoneinfo/Asia/Khandyga", "/usr/share/zoneinfo/Asia/Kolkata", "/usr/share/zoneinfo/Asia/Krasnoyarsk", "/usr/share/zoneinfo/Asia/Kuala_Lumpur", "/usr/share/zoneinfo/Asia/Kuching", "/usr/share/zoneinfo/Asia/Kuwait", "/usr/share/zoneinfo/Asia/Macau", "/usr/share/zoneinfo/Asia/Magadan", "/usr/share/zoneinfo/Asia/Makassar", "/usr/share/zoneinfo/Asia/Manila", "/usr/share/zoneinfo/Asia/Muscat", "/usr/share/zoneinfo/Asia/Nicosia", "/usr/share/zoneinfo/Asia/Novokuznetsk", "/usr/share/zoneinfo/Asia/Novosibirsk", "/usr/share/zoneinfo/Asia/Omsk", "/usr/share/zoneinfo/Asia/Oral", "/usr/share/zoneinfo/Asia/Phnom_Penh", "/usr/share/zoneinfo/Asia/Pontianak", "/usr/share/zoneinfo/Asia/Pyongyang", "/usr/share/zoneinfo/Asia/Qatar", "/usr/share/zoneinfo/Asia/Qostanay", "/usr/share/zoneinfo/Asia/Qyzylorda", "/usr/share/zoneinfo/Asia/Riyadh", "/usr/share/zoneinfo/Asia/Sakhalin", "/usr/share/zoneinfo/Asia/Samarkand", "/usr/share/zoneinfo/Asia/Seoul", "/usr/share/zoneinfo/Asia/Shanghai", "/usr/share/zoneinfo/Asia/Singapore", "/usr/share/zoneinfo/Asia/Srednekolymsk", "/usr/share/zoneinfo/Asia/Taipei", "/usr/share/zoneinfo/Asia/Tashkent", "/usr/share/zoneinfo/Asia/Tbilisi", "/usr/share/zoneinfo/Asia/Tehran", "/usr/share/zoneinfo/Asia/Thimphu", "/usr/share/zoneinfo/Asia/Tokyo", "/usr/share/zoneinfo/Asia/Tomsk", "/usr/share/zoneinfo/Asia/Ulaanbaatar", "/usr/share/zoneinfo/Asia/Urumqi", "/usr/share/zoneinfo/Asia/Ust-Nera", "/usr/share/zoneinfo/Asia/Vientiane", "/usr/share/zoneinfo/Asia/Vladivostok", "/usr/share/zoneinfo/Asia/Yakutsk", "/usr/share/zoneinfo/Asia/Yangon", "/usr/share/zoneinfo/Asia/Yekaterinburg", "/usr/share/zoneinfo/Asia/Yerevan", "/usr/share/zoneinfo/Atlantic/Azores", "/usr/share/zoneinfo/Atlantic/Bermuda", "/usr/share/zoneinfo/Atlantic/Canary", "/usr/share/zoneinfo/Atlantic/Cape_Verde", "/usr/share/zoneinfo/Atlantic/Faroe", "/usr/share/zoneinfo/Atlantic/Madeira", "/usr/share/zoneinfo/Atlantic/Reykjavik", "/usr/share/zoneinfo/Atlantic/South_Georgia", "/usr/share/zoneinfo/Atlantic/St_Helena", "/usr/share/zoneinfo/Atlantic/Stanley", "/usr/share/zoneinfo/Australia/Adelaide", "/usr/share/zoneinfo/Australia/Brisbane", "/usr/share/zoneinfo/Australia/Broken_Hill", "/usr/share/zoneinfo/Australia/Darwin", "/usr/share/zoneinfo/Australia/Eucla", "/usr/share/zoneinfo/Australia/Hobart", "/usr/share/zoneinfo/Australia/Lindeman", "/usr/share/zoneinfo/Australia/Lord_Howe", "/usr/share/zoneinfo/Australia/Melbourne", "/usr/share/zoneinfo/Australia/Perth", "/usr/share/zoneinfo/Australia/Sydney", "/usr/share/zoneinfo/Etc/GMT", "/usr/share/zoneinfo/Etc/GMT+1", "/usr/share/zoneinfo/Etc/GMT+10", "/usr/share/zoneinfo/Etc/GMT+11", "/usr/share/zoneinfo/Etc/GMT+12", "/usr/share/zoneinfo/Etc/GMT+2", "/usr/share/zoneinfo/Etc/GMT+3", "/usr/share/zoneinfo/Etc/GMT+4", "/usr/share/zoneinfo/Etc/GMT+5", "/usr/share/zoneinfo/Etc/GMT+6", "/usr/share/zoneinfo/Etc/GMT+7", "/usr/share/zoneinfo/Etc/GMT+8", "/usr/share/zoneinfo/Etc/GMT+9", "/usr/share/zoneinfo/Etc/GMT-1", "/usr/share/zoneinfo/Etc/GMT-10", "/usr/share/zoneinfo/Etc/GMT-11", "/usr/share/zoneinfo/Etc/GMT-12", "/usr/share/zoneinfo/Etc/GMT-13", "/usr/share/zoneinfo/Etc/GMT-14", "/usr/share/zoneinfo/Etc/GMT-2", "/usr/share/zoneinfo/Etc/GMT-3", "/usr/share/zoneinfo/Etc/GMT-4", "/usr/share/zoneinfo/Etc/GMT-5", "/usr/share/zoneinfo/Etc/GMT-6", "/usr/share/zoneinfo/Etc/GMT-7", "/usr/share/zoneinfo/Etc/GMT-8", "/usr/share/zoneinfo/Etc/GMT-9", "/usr/share/zoneinfo/Etc/UTC", "/usr/share/zoneinfo/Europe/Amsterdam", "/usr/share/zoneinfo/Europe/Andorra", "/usr/share/zoneinfo/Europe/Astrakhan", "/usr/share/zoneinfo/Europe/Athens", "/usr/share/zoneinfo/Europe/Belgrade", "/usr/share/zoneinfo/Europe/Berlin", "/usr/share/zoneinfo/Europe/Brussels", "/usr/share/zoneinfo/Europe/Bucharest", "/usr/share/zoneinfo/Europe/Budapest", "/usr/share/zoneinfo/Europe/Chisinau", "/usr/share/zoneinfo/Europe/Copenhagen", "/usr/share/zoneinfo/Europe/Dublin", "/usr/share/zoneinfo/Europe/Gibraltar", "/usr/share/zoneinfo/Europe/Guernsey", "/usr/share/zoneinfo/Europe/Helsinki", "/usr/share/zoneinfo/Europe/Isle_of_Man", "/usr/share/zoneinfo/Europe/Istanbul", "/usr/share/zoneinfo/Europe/Jersey", "/usr/share/zoneinfo/Europe/Kaliningrad", "/usr/share/zoneinfo/Europe/Kirov", "/usr/share/zoneinfo/Europe/Kyiv", "/usr/share/zoneinfo/Europe/Lisbon", "/usr/share/zoneinfo/Europe/Ljubljana", "/usr/share/zoneinfo/Europe/London", "/usr/share/zoneinfo/Europe/Luxembourg", "/usr/share/zoneinfo/Europe/Madrid", "/usr/share/zoneinfo/Europe/Malta", "/usr/share/zoneinfo/Europe/Minsk", "/usr/share/zoneinfo/Europe/Monaco", "/usr/share/zoneinfo/Europe/Moscow", "/usr/share/zoneinfo/Europe/Oslo", "/usr/share/zoneinfo/Europe/Paris", "/usr/share/zoneinfo/Europe/Prague", "/usr/share/zoneinfo/Europe/Riga", "/usr/share/zoneinfo/Europe/Rome", "/usr/share/zoneinfo/Europe/Samara", "/usr/share/zoneinfo/Europe/Sarajevo", "/usr/share/zoneinfo/Europe/Saratov", "/usr/share/zoneinfo/Europe/Simferopol", "/usr/share/zoneinfo/Europe/Skopje", "/usr/share/zoneinfo/Europe/Sofia", "/usr/share/zoneinfo/Europe/Stockholm", "/usr/share/zoneinfo/Europe/Tallinn", "/usr/share/zoneinfo/Europe/Tirane", "/usr/share/zoneinfo/Europe/Ulyanovsk", "/usr/share/zoneinfo/Europe/Vaduz", "/usr/share/zoneinfo/Europe/Vienna", "/usr/share/zoneinfo/Europe/Vilnius", "/usr/share/zoneinfo/Europe/Volgograd", "/usr/share/zoneinfo/Europe/Warsaw", "/usr/share/zoneinfo/Europe/Zagreb", "/usr/share/zoneinfo/Europe/Zurich", "/usr/share/zoneinfo/Factory", "/usr/share/zoneinfo/Indian/Antananarivo", "/usr/share/zoneinfo/Indian/Chagos", "/usr/share/zoneinfo/Indian/Christmas", "/usr/share/zoneinfo/Indian/Cocos", "/usr/share/zoneinfo/Indian/Comoro", "/usr/share/zoneinfo/Indian/Kerguelen", "/usr/share/zoneinfo/Indian/Mahe", "/usr/share/zoneinfo/Indian/Maldives", "/usr/share/zoneinfo/Indian/Mauritius", "/usr/share/zoneinfo/Indian/Mayotte", "/usr/share/zoneinfo/Indian/Reunion", "/usr/share/zoneinfo/Pacific/Apia", "/usr/share/zoneinfo/Pacific/Auckland", "/usr/share/zoneinfo/Pacific/Bougainville", "/usr/share/zoneinfo/Pacific/Chatham", "/usr/share/zoneinfo/Pacific/Chuuk", "/usr/share/zoneinfo/Pacific/Easter", "/usr/share/zoneinfo/Pacific/Efate", "/usr/share/zoneinfo/Pacific/Fakaofo", "/usr/share/zoneinfo/Pacific/Fiji", "/usr/share/zoneinfo/Pacific/Funafuti", "/usr/share/zoneinfo/Pacific/Galapagos", "/usr/share/zoneinfo/Pacific/Gambier", "/usr/share/zoneinfo/Pacific/Guadalcanal", "/usr/share/zoneinfo/Pacific/Guam", "/usr/share/zoneinfo/Pacific/Honolulu", "/usr/share/zoneinfo/Pacific/Kanton", "/usr/share/zoneinfo/Pacific/Kiritimati", "/usr/share/zoneinfo/Pacific/Kosrae", "/usr/share/zoneinfo/Pacific/Kwajalein", "/usr/share/zoneinfo/Pacific/Majuro", "/usr/share/zoneinfo/Pacific/Marquesas", "/usr/share/zoneinfo/Pacific/Midway", "/usr/share/zoneinfo/Pacific/Nauru", "/usr/share/zoneinfo/Pacific/Niue", "/usr/share/zoneinfo/Pacific/Norfolk", "/usr/share/zoneinfo/Pacific/Noumea", "/usr/share/zoneinfo/Pacific/Pago_Pago", "/usr/share/zoneinfo/Pacific/Palau", "/usr/share/zoneinfo/Pacific/Pitcairn", "/usr/share/zoneinfo/Pacific/Pohnpei", "/usr/share/zoneinfo/Pacific/Port_Moresby", "/usr/share/zoneinfo/Pacific/Rarotonga", "/usr/share/zoneinfo/Pacific/Saipan", "/usr/share/zoneinfo/Pacific/Tahiti", "/usr/share/zoneinfo/Pacific/Tarawa", "/usr/share/zoneinfo/Pacific/Tongatapu", "/usr/share/zoneinfo/Pacific/Wake", "/usr/share/zoneinfo/Pacific/Wallis", "/usr/share/zoneinfo/iso3166.tab", "/usr/share/zoneinfo/leap-seconds.list", "/usr/share/zoneinfo/leapseconds", "/usr/share/zoneinfo/tzdata.zi", "/usr/share/zoneinfo/zone.tab", "/usr/share/zoneinfo/zone1970.tab", "/usr/share/zoneinfo/zonenow.tab" ], "AnalyzedBy": "dpkg" }, { "ID": "util-linux@2.41-5", "Name": "util-linux", "Identifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "972fb85b9c9e83e7" }, "Version": "2.41", "Release": "5", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/bin/choom", "/usr/bin/chrt", "/usr/bin/dmesg", "/usr/bin/fallocate", "/usr/bin/findmnt", "/usr/bin/flock", "/usr/bin/getopt", "/usr/bin/hardlink", "/usr/bin/ionice", "/usr/bin/ipcmk", "/usr/bin/ipcrm", "/usr/bin/ipcs", "/usr/bin/lsblk", "/usr/bin/lscpu", "/usr/bin/lsipc", "/usr/bin/lslocks", "/usr/bin/lslogins", "/usr/bin/lsmem", "/usr/bin/lsns", "/usr/bin/mcookie", "/usr/bin/more", "/usr/bin/mountpoint", "/usr/bin/namei", "/usr/bin/nsenter", "/usr/bin/partx", "/usr/bin/prlimit", "/usr/bin/rename.ul", "/usr/bin/rev", "/usr/bin/setarch", "/usr/bin/setpriv", "/usr/bin/setsid", "/usr/bin/setterm", "/usr/bin/su", "/usr/bin/taskset", "/usr/bin/uclampset", "/usr/bin/unshare", "/usr/bin/wdctl", "/usr/bin/whereis", "/usr/lib/mime/packages/util-linux", "/usr/lib/systemd/system/fstrim.service", "/usr/lib/systemd/system/fstrim.timer", "/usr/sbin/agetty", "/usr/sbin/blkdiscard", "/usr/sbin/blkid", "/usr/sbin/blkzone", "/usr/sbin/blockdev", "/usr/sbin/chcpu", "/usr/sbin/chmem", "/usr/sbin/findfs", "/usr/sbin/fsck", "/usr/sbin/fsfreeze", "/usr/sbin/fstrim", "/usr/sbin/isosize", "/usr/sbin/ldattach", "/usr/sbin/mkfs", "/usr/sbin/mkswap", "/usr/sbin/pivot_root", "/usr/sbin/readprofile", "/usr/sbin/rtcwake", "/usr/sbin/runuser", "/usr/sbin/sulogin", "/usr/sbin/swaplabel", "/usr/sbin/switch_root", "/usr/sbin/wipefs", "/usr/sbin/zramctl", "/usr/share/bash-completion/completions/blkdiscard", "/usr/share/bash-completion/completions/blkid", "/usr/share/bash-completion/completions/blkzone", "/usr/share/bash-completion/completions/blockdev", "/usr/share/bash-completion/completions/chcpu", "/usr/share/bash-completion/completions/chmem", "/usr/share/bash-completion/completions/chrt", "/usr/share/bash-completion/completions/dmesg", "/usr/share/bash-completion/completions/fallocate", "/usr/share/bash-completion/completions/findfs", "/usr/share/bash-completion/completions/findmnt", "/usr/share/bash-completion/completions/flock", "/usr/share/bash-completion/completions/fsck", "/usr/share/bash-completion/completions/fsfreeze", "/usr/share/bash-completion/completions/fstrim", "/usr/share/bash-completion/completions/getopt", "/usr/share/bash-completion/completions/hardlink", "/usr/share/bash-completion/completions/ionice", "/usr/share/bash-completion/completions/ipcmk", "/usr/share/bash-completion/completions/ipcrm", "/usr/share/bash-completion/completions/ipcs", "/usr/share/bash-completion/completions/isosize", "/usr/share/bash-completion/completions/ldattach", "/usr/share/bash-completion/completions/lsblk", "/usr/share/bash-completion/completions/lscpu", "/usr/share/bash-completion/completions/lsipc", "/usr/share/bash-completion/completions/lslocks", "/usr/share/bash-completion/completions/lslogins", "/usr/share/bash-completion/completions/lsmem", "/usr/share/bash-completion/completions/lsns", "/usr/share/bash-completion/completions/mcookie", "/usr/share/bash-completion/completions/mkfs", "/usr/share/bash-completion/completions/mkswap", "/usr/share/bash-completion/completions/more", "/usr/share/bash-completion/completions/mountpoint", "/usr/share/bash-completion/completions/namei", "/usr/share/bash-completion/completions/nsenter", "/usr/share/bash-completion/completions/partx", "/usr/share/bash-completion/completions/pivot_root", "/usr/share/bash-completion/completions/prlimit", "/usr/share/bash-completion/completions/readprofile", "/usr/share/bash-completion/completions/rename.ul", "/usr/share/bash-completion/completions/rev", "/usr/share/bash-completion/completions/rtcwake", "/usr/share/bash-completion/completions/setarch", "/usr/share/bash-completion/completions/setpriv", "/usr/share/bash-completion/completions/setsid", "/usr/share/bash-completion/completions/setterm", "/usr/share/bash-completion/completions/su", "/usr/share/bash-completion/completions/swaplabel", "/usr/share/bash-completion/completions/taskset", "/usr/share/bash-completion/completions/uclampset", "/usr/share/bash-completion/completions/unshare", "/usr/share/bash-completion/completions/wdctl", "/usr/share/bash-completion/completions/whereis", "/usr/share/bash-completion/completions/wipefs", "/usr/share/bash-completion/completions/zramctl", "/usr/share/doc/util-linux/00-about-docs.txt", "/usr/share/doc/util-linux/AUTHORS.gz", "/usr/share/doc/util-linux/NEWS.Debian.gz", "/usr/share/doc/util-linux/PAM-configuration.txt", "/usr/share/doc/util-linux/README.Debian", "/usr/share/doc/util-linux/blkid.txt", "/usr/share/doc/util-linux/cal.txt", "/usr/share/doc/util-linux/changelog.Debian.gz", "/usr/share/doc/util-linux/changelog.gz", "/usr/share/doc/util-linux/col.txt", "/usr/share/doc/util-linux/copyright", "/usr/share/doc/util-linux/deprecated.txt", "/usr/share/doc/util-linux/examples/getopt-example.bash", "/usr/share/doc/util-linux/getopt.txt", "/usr/share/doc/util-linux/getopt_changelog.txt", "/usr/share/doc/util-linux/howto-build-sys.txt", "/usr/share/doc/util-linux/howto-compilation.txt", "/usr/share/doc/util-linux/howto-contribute.txt.gz", "/usr/share/doc/util-linux/howto-debug.txt", "/usr/share/doc/util-linux/howto-man-page.txt", "/usr/share/doc/util-linux/howto-pull-request.txt.gz", "/usr/share/doc/util-linux/howto-tests.txt", "/usr/share/doc/util-linux/howto-usage-function.txt.gz", "/usr/share/doc/util-linux/hwclock.txt", "/usr/share/doc/util-linux/modems-with-agetty.txt", "/usr/share/doc/util-linux/mount.txt", "/usr/share/doc/util-linux/parse-date.txt.gz", "/usr/share/doc/util-linux/pg.txt", "/usr/share/doc/util-linux/poeigl.txt.gz", "/usr/share/doc/util-linux/release-schedule.txt", "/usr/share/doc/util-linux/releases/v2.13-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.14-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.15-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.16-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.17-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.18-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.19-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.20-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.21-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.22-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.23-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.24-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.25-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.26-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.27-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.28-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.29-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.30-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.31-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.32-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.33-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.34-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.35-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.36-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.37-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.38-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.39-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.40-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.41-ReleaseNotes.gz", "/usr/share/lintian/overrides/util-linux", "/usr/share/man/man1/choom.1.gz", "/usr/share/man/man1/chrt.1.gz", "/usr/share/man/man1/dmesg.1.gz", "/usr/share/man/man1/fallocate.1.gz", "/usr/share/man/man1/flock.1.gz", "/usr/share/man/man1/getopt.1.gz", "/usr/share/man/man1/hardlink.1.gz", "/usr/share/man/man1/ionice.1.gz", "/usr/share/man/man1/ipcmk.1.gz", "/usr/share/man/man1/ipcrm.1.gz", "/usr/share/man/man1/ipcs.1.gz", "/usr/share/man/man1/lscpu.1.gz", "/usr/share/man/man1/lsipc.1.gz", "/usr/share/man/man1/lslogins.1.gz", "/usr/share/man/man1/lsmem.1.gz", "/usr/share/man/man1/mcookie.1.gz", "/usr/share/man/man1/more.1.gz", "/usr/share/man/man1/mountpoint.1.gz", "/usr/share/man/man1/namei.1.gz", "/usr/share/man/man1/nsenter.1.gz", "/usr/share/man/man1/prlimit.1.gz", "/usr/share/man/man1/rename.ul.1.gz", "/usr/share/man/man1/rev.1.gz", "/usr/share/man/man1/runuser.1.gz", "/usr/share/man/man1/setpriv.1.gz", "/usr/share/man/man1/setsid.1.gz", "/usr/share/man/man1/setterm.1.gz", "/usr/share/man/man1/su.1.gz", "/usr/share/man/man1/taskset.1.gz", "/usr/share/man/man1/uclampset.1.gz", "/usr/share/man/man1/unshare.1.gz", "/usr/share/man/man1/whereis.1.gz", "/usr/share/man/man5/adjtime_config.5.gz", "/usr/share/man/man5/scols-filter.5.gz", "/usr/share/man/man5/terminal-colors.d.5.gz", "/usr/share/man/man8/agetty.8.gz", "/usr/share/man/man8/blkdiscard.8.gz", "/usr/share/man/man8/blkid.8.gz", "/usr/share/man/man8/blkzone.8.gz", "/usr/share/man/man8/blockdev.8.gz", "/usr/share/man/man8/chcpu.8.gz", "/usr/share/man/man8/chmem.8.gz", "/usr/share/man/man8/findfs.8.gz", "/usr/share/man/man8/findmnt.8.gz", "/usr/share/man/man8/fsck.8.gz", "/usr/share/man/man8/fsfreeze.8.gz", "/usr/share/man/man8/fstrim.8.gz", "/usr/share/man/man8/isosize.8.gz", "/usr/share/man/man8/ldattach.8.gz", "/usr/share/man/man8/lsblk.8.gz", "/usr/share/man/man8/lslocks.8.gz", "/usr/share/man/man8/lsns.8.gz", "/usr/share/man/man8/mkfs.8.gz", "/usr/share/man/man8/mkswap.8.gz", "/usr/share/man/man8/partx.8.gz", "/usr/share/man/man8/pivot_root.8.gz", "/usr/share/man/man8/readprofile.8.gz", "/usr/share/man/man8/rtcwake.8.gz", "/usr/share/man/man8/setarch.8.gz", "/usr/share/man/man8/sulogin.8.gz", "/usr/share/man/man8/swaplabel.8.gz", "/usr/share/man/man8/switch_root.8.gz", "/usr/share/man/man8/wdctl.8.gz", "/usr/share/man/man8/wipefs.8.gz", "/usr/share/man/man8/zramctl.8.gz", "/usr/share/util-linux/logcheck/ignore.d.server/util-linux" ], "AnalyzedBy": "dpkg" }, { "ID": "zlib1g@1:1.3.dfsg+really1.3.1-1+b1", "Name": "zlib1g", "Identifier": { "PURL": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "ff182eb2a26a8142" }, "Version": "1.3.dfsg+really1.3.1", "Release": "1+b1", "Epoch": 1, "Arch": "amd64", "SrcName": "zlib", "SrcVersion": "1.3.dfsg+really1.3.1", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "Zlib" ], "Maintainer": "Mark Brown \u003cbroonie@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libz.so.1.3.1", "/usr/share/doc/zlib1g/changelog.Debian.amd64.gz", "/usr/share/doc/zlib1g/changelog.Debian.gz", "/usr/share/doc/zlib1g/changelog.gz", "/usr/share/doc/zlib1g/copyright" ], "AnalyzedBy": "dpkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-109518", "VendorIDs": [ "DSA-6607-1" ], "PkgID": "apt@3.0.3", "PkgName": "apt", "PkgIdentifier": { "PURL": "pkg:deb/debian/apt@3.0.3?arch=amd64\u0026distro=debian-13.5", "UID": "2e5d8c8032700559" }, "InstalledVersion": "3.0.3", "FixedVersion": "3.0.4", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109518", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:da7d792d36280b2326499ea56b657b5084a8df584685275be6ad72e7ee882b1e", "Title": "apt: apt: Remote code execution via hard link reuse during package download retries", "Description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration", "Severity": "HIGH", "CweIDs": [ "CWE-62", "CWE-367" ], "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/11/04/12", "https://access.redhat.com/security/cve/CVE-2026-109518", "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html", "https://lists.debian.org/debian-security-announce/2026/msg00526.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109518", "https://ubuntu.com/blog/apt-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8996-1", "https://www.cve.org/CVERecord?id=CVE-2026-109518" ], "PublishedDate": "2026-11-04T16:17:33.01Z", "LastModifiedDate": "2026-11-05T05:18:19.033Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c52f5e8f0d75469aafe21baaa81a7c571fa28d299043cf56f2152794887b5e07", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:54e97847374752c86822112835789c2a08fca00d54f4e9b976d5332e037c5f7b", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3dc586f51f8a93db64ba5cfff147c01d32de226dfdc01815ee8a60cde68c85b8", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:52c925d43576fa99cd25916a7d4c2a14cb1624c8c8f3dc0c75a1d86a67645884", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:066633cb1921b478612d20f6d863c954cac71ed11bfb1acf932d03fc1e64a14f", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b5ca21a766a2feb5c1d4db1706944c0225b1fb6e94208c161741fb2c1a66812d", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f93a1ece3e01ef0098e8f91dedc3426a2c9e464bb4635ad314fac66d8b58ecbf", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "bsdutils@1:2.41-5", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "5843733a461e6ce1" }, "InstalledVersion": "1:2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b5126987b8149975ce27fe867545cc22b77ced25fa2531b5427fbad5a6b0a05f", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "curl@8.14.1-2+deb13u3", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "19710875c10d58d0" }, "InstalledVersion": "8.14.1-2+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c5e1ad62ed5929953332bd8f1add3d21def701ad7eeaab4aef5fadece44bd315", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-5773", "PkgID": "curl@8.14.1-2+deb13u3", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "19710875c10d58d0" }, "InstalledVersion": "8.14.1-2+deb13u3", "FixedVersion": "8.14.1-2+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5773", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:92daf0088c7afedb7aa5e1c7a1aa41d4e2f7b07c83109622cbae2f30a4458ba1", "Title": "curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse", "Description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "Severity": "HIGH", "CweIDs": [ "CWE-488", "CWE-918" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/9", "https://access.redhat.com/security/cve/CVE-2026-5773", "https://curl.se/docs/CVE-2026-5773.html", "https://curl.se/docs/CVE-2026-5773.json", "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "https://hackerone.com/reports/3650689", "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "https://ubuntu.com/security/notices/USN-8227-1", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-5773" ], "PublishedDate": "2026-05-13T13:01:56.307Z", "LastModifiedDate": "2026-09-15T07:16:28.82Z" }, { "VulnerabilityID": "CVE-2026-6276", "PkgID": "curl@8.14.1-2+deb13u3", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "19710875c10d58d0" }, "InstalledVersion": "8.14.1-2+deb13u3", "FixedVersion": "8.14.1-2+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6276", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a5011e943324806a9ac9ea86dc544a9907d0da7a6ccc4d9188bf24cfad7730f9", "Title": "curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers", "Description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-319" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/13", "https://access.redhat.com/security/cve/CVE-2026-6276", "https://curl.se/docs/CVE-2026-6276.html", "https://curl.se/docs/CVE-2026-6276.json", "https://github.com/advisories/GHSA-2jc6-hc33-hv48", "https://hackerone.com/reports/3671818", "https://nvd.nist.gov/vuln/detail/CVE-2026-6276", "https://ubuntu.com/security/notices/USN-8227-1", "https://www.cve.org/CVERecord?id=CVE-2026-6276" ], "PublishedDate": "2026-05-13T13:01:56.8Z", "LastModifiedDate": "2026-09-15T07:16:29.343Z" }, { "VulnerabilityID": "CVE-2026-8286", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "curl@8.14.1-2+deb13u3", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "19710875c10d58d0" }, "InstalledVersion": "8.14.1-2+deb13u3", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0c86b93b3fc86bbaff11bb187c5283625f828892d31e61687d1157151588b38e", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "curl@8.14.1-2+deb13u3", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "19710875c10d58d0" }, "InstalledVersion": "8.14.1-2+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9100c2481b98859c59c2453af60fc1cb77e24893daa9f62834150060154c3af5", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8927", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "curl@8.14.1-2+deb13u3", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "19710875c10d58d0" }, "InstalledVersion": "8.14.1-2+deb13u3", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c8280c1225233b7f32339e3827ab1c0e766d1c2d584ca55407d42f90c601cb3", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "curl@8.14.1-2+deb13u3", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "19710875c10d58d0" }, "InstalledVersion": "8.14.1-2+deb13u3", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:27a4aef15d78664e0f0fac7d5bf81d1e8785a8962eace4879a249c3ae2273723", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-41992", "PkgID": "gzip@1.13-1", "PkgName": "gzip", "PkgIdentifier": { "PURL": "pkg:deb/debian/gzip@1.13-1?arch=amd64\u0026distro=debian-13.5", "UID": "954545ce99bc687e" }, "InstalledVersion": "1.13-1", "FixedVersion": "1.13-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41992", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a0a4351a94c432446f28f8a2f4eefc83de5634332c93feb635f46945cd361552", "Title": "gzip: gzip: Information disclosure via global buffer overflow in LZH decompression", "Description": "GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "alma": 2, "azure": 2, "julia": 2, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 1, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 6.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "V3Score": 3.6 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/23/1", "http://www.openwall.com/lists/oss-security/2026/08/25/1", "http://www.openwall.com/lists/oss-security/2026/08/27/2", "https://access.redhat.com/errata/RHSA-2026:61623", "https://access.redhat.com/security/cve/CVE-2026-41992", "https://bugzilla.redhat.com/2494158", "https://bugzilla.redhat.com/show_bug.cgi?id=2494158", "https://bugzilla.redhat.com/show_bug.cgi?id=2494159", "https://cert.pl/en/posts/2026/04/CVE-2026-41991", "https://cert.pl/en/posts/2026/04/CVE-2026-41991/", "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681", "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41992", "https://errata.almalinux.org/9/ALSA-2026-61623.html", "https://errata.rockylinux.org/RLSA-2026:61623", "https://github.com/advisories/GHSA-qxh4-rprf-2mmj", "https://linux.oracle.com/cve/CVE-2026-41992.html", "https://linux.oracle.com/errata/ELSA-2026-65998-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-41992", "https://ubuntu.com/security/notices/USN-8512-1", "https://ubuntu.com/security/notices/USN-8733-1", "https://ubuntu.com/security/notices/USN-8733-2", "https://www.cve.org/CVERecord?id=CVE-2026-41992", "https://www.gnu.org/software/gzip", "https://www.gnu.org/software/gzip/" ], "PublishedDate": "2026-06-29T12:16:29.94Z", "LastModifiedDate": "2026-10-25T21:10:00.77Z" }, { "VulnerabilityID": "CVE-2026-54369", "PkgID": "libacl1@2.3.2-2+b1", "PkgName": "libacl1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64\u0026distro=debian-13.5", "UID": "f9f7789d147b9636" }, "InstalledVersion": "2.3.2-2+b1", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5d51077762c7a61a0855354665d0cf468330e9bc7bcf6b099deac6003b48eed7", "Title": "acl: Symlink traversal privilege escalation via libacl functions", "Description": "acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34351", "https://access.redhat.com/errata/RHSA-2026:42736", "https://access.redhat.com/errata/RHSA-2026:42739", "https://access.redhat.com/errata/RHSA-2026:43420", "https://access.redhat.com/errata/RHSA-2026:44481", "https://access.redhat.com/errata/RHSA-2026:46836", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:53371", "https://access.redhat.com/errata/RHSA-2026:54769", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:64805", "https://access.redhat.com/errata/RHSA-2026:67140", "https://access.redhat.com/errata/RHSA-2026:67142", "https://access.redhat.com/errata/RHSA-2026:67144", "https://access.redhat.com/security/cve/CVE-2026-54369", "https://bugzilla.redhat.com/2490277", "https://bugzilla.redhat.com/2490279", "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "https://bugzilla.redhat.com/show_bug.cgi?id=2490279", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54370", "https://errata.almalinux.org/9/ALSA-2026-42736.html", "https://errata.rockylinux.org/RLSA-2026:42736", "https://linux.oracle.com/cve/CVE-2026-54369.html", "https://linux.oracle.com/errata/ELSA-2026-43420.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54369", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "https://www.cve.org/CVERecord?id=CVE-2026-54369", "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" ], "PublishedDate": "2026-06-29T14:16:57.487Z", "LastModifiedDate": "2026-10-25T21:10:00.77Z" }, { "VulnerabilityID": "CVE-2026-109518", "VendorIDs": [ "DSA-6607-1" ], "PkgID": "libapt-pkg7.0@3.0.3", "PkgName": "libapt-pkg7.0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libapt-pkg7.0@3.0.3?arch=amd64\u0026distro=debian-13.5", "UID": "5549812c55d79bea" }, "InstalledVersion": "3.0.3", "FixedVersion": "3.0.4", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109518", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:71ab4d7fa6e5e8f82988be6b3cf2fc2f1695c5d938c75fd9ee17207c1d1cc91b", "Title": "apt: apt: Remote code execution via hard link reuse during package download retries", "Description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration", "Severity": "HIGH", "CweIDs": [ "CWE-62", "CWE-367" ], "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/11/04/12", "https://access.redhat.com/security/cve/CVE-2026-109518", "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html", "https://lists.debian.org/debian-security-announce/2026/msg00526.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109518", "https://ubuntu.com/blog/apt-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8996-1", "https://www.cve.org/CVERecord?id=CVE-2026-109518" ], "PublishedDate": "2026-11-04T16:17:33.01Z", "LastModifiedDate": "2026-11-05T05:18:19.033Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "51bf0af8d40f4a01" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:31f5cd9066c0b565e9c65e745f8e7f4359380a4e8b143a63c600f70b0a9cdce0", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "51bf0af8d40f4a01" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0301124a5dab92951eeebac2d8f018e18aea257fad46ad3ed2b37de37e9ff196", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "51bf0af8d40f4a01" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:49c72606a116f4376e5610a19a785f5df9014e2718035b627aad01dac5c8d16b", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "51bf0af8d40f4a01" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b164773224dcc98691c61ac1affdadbdae90933164509e753ad45647f985f698", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "51bf0af8d40f4a01" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7e44919676ae1168b23e008bc0f20ef8f3f3677d6e82f34ed2f20f30b33dc0a5", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "51bf0af8d40f4a01" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ddf428f0eb6640b07155a6158ef13bf9fd8262bd337dd9db7b632f1e4cbe732b", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "51bf0af8d40f4a01" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7550d51f52fdbbe7f22b5dc85f0ea88319db5efc6ff348487eeeb80aa17d3a72", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libblkid1@2.41-5", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "51bf0af8d40f4a01" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:018ab8276eca189035081f6c04e18f4a2ad978daac6845e7706e388d6afd8e13", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-111497", "VendorIDs": [ "DSA-6582-1" ], "PkgID": "libbrotli1@1.1.0-2+b7", "PkgName": "libbrotli1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libbrotli1@1.1.0-2%2Bb7?arch=amd64\u0026distro=debian-13.5", "UID": "3f78e505ac03922b" }, "InstalledVersion": "1.1.0-2+b7", "FixedVersion": "1.1.0-2+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8c1a3e2a73a7237fa701b5fbf473d820979bdb824436faac5314eaf2a466e0c5", "Title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "Description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "Severity": "CRITICAL", "CweIDs": [ "CWE-252", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 9.8, "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/23/25", "http://www.openwall.com/lists/oss-security/2026/10/24/6", "http://www.openwall.com/lists/oss-security/2026/10/26/12", "http://www.openwall.com/lists/oss-security/2026/10/26/13", "http://www.openwall.com/lists/oss-security/2026/10/26/16", "http://www.openwall.com/lists/oss-security/2026/11/03/2", "https://access.redhat.com/errata/RHSA-2026:90495", "https://access.redhat.com/errata/RHSA-2026:92492", "https://access.redhat.com/security/cve/CVE-2026-111497", "https://advisory.echohq.com/cve/CVE-2026-111497", "https://broccoli2shell.com", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2562054", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://cert-portal.siemens.com/productcert/html/ssa-045512.html", "https://cert-portal.siemens.com/productcert/html/ssa-443410.html", "https://cert-portal.siemens.com/productcert/html/ssa-898633.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/", "https://errata.almalinux.org/9/ALSA-2026-92492.html", "https://errata.rockylinux.org/RLSA-2026:90495", "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "https://github.com/andybalholm/brotli/releases/tag/v1.2.7", "https://github.com/dotnet/announcements/issues/494", "https://github.com/google/brotli", "https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b", "https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0", "https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6", "https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12", "https://github.com/google/brotli/releases/tag/v1.0.10", "https://github.com/google/brotli/releases/tag/v1.1.1", "https://github.com/google/brotli/releases/tag/v1.2.1", "https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml", "https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml", "https://linux.oracle.com/cve/CVE-2026-111497.html", "https://linux.oracle.com/errata/ELSA-2026-92492.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high", "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "https://opensourcemalware.com/blog/node2shell-affects-python", "https://patchtheplanet.org/brotli", "https://pypi.org/project/Brotli", "https://pypi.org/project/brotlicffi", "https://ubuntu.com/security/notices/USN-8956-1", "https://ubuntu.com/security/notices/USN-8956-2", "https://ubuntu.com/security/notices/USN-8958-1", "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497", "https://www.cve.org/CVERecord?id=CVE-2026-111497" ], "PublishedDate": "2026-10-22T14:17:37.19Z", "LastModifiedDate": "2026-11-06T16:17:37.393Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "libcurl4t64@8.14.1-2+deb13u3", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "b5b704983d824ef5" }, "InstalledVersion": "8.14.1-2+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:53b61d991750a832812eb8339d3104024e2d46eef7e9a69b6d7cedbd9484baf8", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-5773", "PkgID": "libcurl4t64@8.14.1-2+deb13u3", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "b5b704983d824ef5" }, "InstalledVersion": "8.14.1-2+deb13u3", "FixedVersion": "8.14.1-2+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5773", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3bc68690da2d0bdcd36009f2e480c5e03a2b844a8ad7dcf693132e8283af3e4b", "Title": "curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse", "Description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "Severity": "HIGH", "CweIDs": [ "CWE-488", "CWE-918" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/9", "https://access.redhat.com/security/cve/CVE-2026-5773", "https://curl.se/docs/CVE-2026-5773.html", "https://curl.se/docs/CVE-2026-5773.json", "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "https://hackerone.com/reports/3650689", "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "https://ubuntu.com/security/notices/USN-8227-1", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-5773" ], "PublishedDate": "2026-05-13T13:01:56.307Z", "LastModifiedDate": "2026-09-15T07:16:28.82Z" }, { "VulnerabilityID": "CVE-2026-6276", "PkgID": "libcurl4t64@8.14.1-2+deb13u3", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "b5b704983d824ef5" }, "InstalledVersion": "8.14.1-2+deb13u3", "FixedVersion": "8.14.1-2+deb13u4", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6276", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:31b9533339cb3131110c6aaf44f68fbd0b43d810f50dedcecd685409d5b79386", "Title": "curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers", "Description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-319" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/13", "https://access.redhat.com/security/cve/CVE-2026-6276", "https://curl.se/docs/CVE-2026-6276.html", "https://curl.se/docs/CVE-2026-6276.json", "https://github.com/advisories/GHSA-2jc6-hc33-hv48", "https://hackerone.com/reports/3671818", "https://nvd.nist.gov/vuln/detail/CVE-2026-6276", "https://ubuntu.com/security/notices/USN-8227-1", "https://www.cve.org/CVERecord?id=CVE-2026-6276" ], "PublishedDate": "2026-05-13T13:01:56.8Z", "LastModifiedDate": "2026-09-15T07:16:29.343Z" }, { "VulnerabilityID": "CVE-2026-8286", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "libcurl4t64@8.14.1-2+deb13u3", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "b5b704983d824ef5" }, "InstalledVersion": "8.14.1-2+deb13u3", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0162edd279daf26690aa8c52062f13b1d66a8a9351c329422e97f863e16fae2b", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "libcurl4t64@8.14.1-2+deb13u3", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "b5b704983d824ef5" }, "InstalledVersion": "8.14.1-2+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9a8519ecf471f5c3c9bd5d4bb40aeb3176ee46d0f376522a9a5f62e346ed30c8", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8927", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "libcurl4t64@8.14.1-2+deb13u3", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "b5b704983d824ef5" }, "InstalledVersion": "8.14.1-2+deb13u3", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:48113eb0d04315077360d18c03ac8f130e44e98f3fa2003ea2a81e70bd77344b", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "libcurl4t64@8.14.1-2+deb13u3", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u3?arch=amd64\u0026distro=debian-13.5", "UID": "b5b704983d824ef5" }, "InstalledVersion": "8.14.1-2+deb13u3", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6d7254bffa46b7aae6ca857a16459a5e00138bb4279f0943fb4cd28e34042d80", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "eb4f5430aea34a10" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4a3ec1cd101fd245ab7fac8fb5057518c63696ddc526b3d54c0b71f2e7270f5c", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "eb4f5430aea34a10" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ceb62809c073db272d877d92453101e0708ce4f7dc06b66a2bf475e897c4b614", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "eb4f5430aea34a10" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:177430fe7b540b2fa70478c9af352082e30bb49e012f719dd955723215a567b9", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "eb4f5430aea34a10" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4827acecf2dcf305b13eb4423d62bf2f101b20495a4043d705b9b193ac919193", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "eb4f5430aea34a10" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6f99530548c47a50420fdb2b7d5e363a61129cbec910ae8f30c717af742bfb6e", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "eb4f5430aea34a10" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f94ab88241406bb945b39122f1dc928fb202b9b99a4ec097d7030cc041089495", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "eb4f5430aea34a10" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:12cf2fc38084bf30f411df5b778320d5e10ef814c495f5f977dbd07a0783c305", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "liblastlog2-2@2.41-5", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "eb4f5430aea34a10" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9f91ccfc8551868a54a614d78c8457435a03401063148fe5ed582e69e0ac3410", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "84ccd0371833b76" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9cb006081320fcefc6bb3162310a14db5f7948af14732e51984b91015e41ff6f", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "84ccd0371833b76" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8288cce97111b277530fd6d41b571bb3e550cd18baeb15e7ad8a863e68a95649", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "84ccd0371833b76" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:805fe8dc40a1a87d5656fd6c61cdeb780a9722a21521225eeeee9fa47f6e4390", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "84ccd0371833b76" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e5308331de1a4074a882ba0c1f158ac4ec3abbce0ef6836aeb83db476c92aac9", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "84ccd0371833b76" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c3e68dd0adeec5a0082549f5b4f0e6ae9b1703170b48ae7919e5910cec960714", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "84ccd0371833b76" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dedcb87b67476f8f362d2b17e0110312627bf0ceda45d893717a9e14f374eb9e", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "84ccd0371833b76" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1fe6b9017298c12a777af8d976b0ba5e9571df9214072a247efc351c220029d9", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libmount1@2.41-5", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "84ccd0371833b76" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:24700dae2138475f3a33165f0ebba27bfb467c87cb9e3589a6622bb73bdcbccd", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "libncursesw6@6.5+20250216-2", "PkgName": "libncursesw6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.5", "UID": "c7a5d333a8ad931e" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:c529e1b2553946dcc9afa2d77e33a75f23d3702e0b4a7911b67e2f1fe45a4939" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:44eac7c6ccc10d11e96e144962b1a5454e83ae14b02b054f51c1a8a2a2a4d094", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-103111", "VendorIDs": [ "DSA-6530-1" ], "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "aa7e3a6ab471d889" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-103111", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5102a84423ae98b401131a2016f6391a9a0d055e685b3e708b5903d6ebd24331", "Title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "Description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-103111", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m", "https://linux.oracle.com/cve/CVE-2026-103111.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-103111" ], "PublishedDate": "2026-09-30T05:16:45.863Z", "LastModifiedDate": "2026-10-04T00:16:35.563Z" }, { "VulnerabilityID": "CVE-2026-86145", "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "aa7e3a6ab471d889" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86145", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ce7909a8f450276ad100d2eb69eefbd3d340cb9bcf4c29c2bba5fdb301252d4d", "Title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "Description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "Severity": "HIGH", "CweIDs": [ "CWE-424" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "http://www.openwall.com/lists/oss-security/2026/09/05/3", "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-86145", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/17.1.0/BRSA-xqvt0yt0g9rb.toml", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://linux.oracle.com/cve/CVE-2026-86145.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-86145" ], "PublishedDate": "2026-09-05T06:17:10.37Z", "LastModifiedDate": "2026-09-09T16:04:24.933Z" }, { "VulnerabilityID": "CVE-2026-89157", "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "aa7e3a6ab471d889" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89157", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0817f820c76a360e2037b20f64b814c32d2b787ef651b30115c037f447af7e16", "Title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "Description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 5.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89157", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "https://linux.oracle.com/cve/CVE-2026-89157.html", "https://linux.oracle.com/errata/ELSA-2026-81613.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89157", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89157" ], "PublishedDate": "2026-09-11T04:18:03.753Z", "LastModifiedDate": "2026-09-16T19:25:08.88Z" }, { "VulnerabilityID": "CVE-2026-89161", "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "aa7e3a6ab471d889" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89161", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22444ec40ffb4a511d009b511a2f3d5aa40e55e341b7138136ea4a34a9e0ad95", "Title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "Description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "Severity": "HIGH", "CweIDs": [ "CWE-590" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89161", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/commit/1dcd0cf42a6a7cb62cc9a7c024196733abcfda95%20%28pcre2-10.48-RC1%29", "https://github.com/PCRE2Project/pcre2/pull/937", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://linux.oracle.com/cve/CVE-2026-89161.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89161" ], "PublishedDate": "2026-09-11T04:18:04.47Z", "LastModifiedDate": "2026-09-16T19:10:47.78Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "780dbec0869ab8e" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b5ae9e807c9df316a198223359203e8aa5ea119aa038cc9e80762a24e2fb270", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "780dbec0869ab8e" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f2b86156074b716a30d9ebee8d55eff89e04e4ca9ffc2cc52b7e1f5272423e8e", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "780dbec0869ab8e" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd3196662778e9a6d0b772a4d00d9d7778faa087f88aed6eeeb9e1afa65ded77", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "780dbec0869ab8e" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9b5e8546cde7a9687c4db89d0f047a182dc3d4ac2ac7cb31ed9d22e273bda6ed", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "780dbec0869ab8e" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f1de7fe537bca62ed48e5341fac6eea89d5c31c2c7e61ef77c6a745f2dcf1834", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "780dbec0869ab8e" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:832dfefde7f6ac63cd465113e8fadd226c2af4c529cad64652a6061753d4859e", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "780dbec0869ab8e" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4956369df3a29c41009422e9fc431bda2ec02117abdbbceaa88d0638a985a5c1", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libsmartcols1@2.41-5", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "780dbec0869ab8e" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b210282e9bcffa89a8fd9b0005651b362a3456c6f9eba65fda1a111fcd1d0f31", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-11822", "PkgID": "libsqlite3-0@3.46.1-7+deb13u1", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "c7da287e696e8198" }, "InstalledVersion": "3.46.1-7+deb13u1", "FixedVersion": "3.46.1-7+deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11822", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6a0141a85d69a0f081d145c319ca245cac0cd62c5398efda12826e0995957bb2", "Title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "Description": "SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:58936", "https://access.redhat.com/security/cve/CVE-2026-11822", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://errata.almalinux.org/9/ALSA-2026-58936.html", "https://errata.rockylinux.org/RLSA-2026:58936", "https://linux.oracle.com/cve/CVE-2026-11822.html", "https://linux.oracle.com/errata/ELSA-2026-61242-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-11822", "https://sqlite.org/releaselog/3_53_2.html", "https://sqlite.org/src/info/061febcf41ca", "https://sqlite.org/src/info/4a5ad516ea93", "https://sqlite.org/src/info/87b653731171", "https://sqlite.org/src/info/fad98805b7d7", "https://ubuntu.com/security/notices/USN-8480-1", "https://www.cve.org/CVERecord?id=CVE-2026-11822", "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension" ], "PublishedDate": "2026-06-09T20:16:32.15Z", "LastModifiedDate": "2026-10-30T02:17:08.76Z" }, { "VulnerabilityID": "CVE-2026-11824", "PkgID": "libsqlite3-0@3.46.1-7+deb13u1", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "c7da287e696e8198" }, "InstalledVersion": "3.46.1-7+deb13u1", "FixedVersion": "3.46.1-7+deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11824", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:695d8e417997d9be64a0f33edd3040f0f906dc2d70ac0b8d9b85252acc39fbb8", "Title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "Description": "SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:58936", "https://access.redhat.com/security/cve/CVE-2026-11824", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://errata.almalinux.org/9/ALSA-2026-58936.html", "https://errata.rockylinux.org/RLSA-2026:58936", "https://linux.oracle.com/cve/CVE-2026-11824.html", "https://linux.oracle.com/errata/ELSA-2026-58938.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-11824", "https://sqlite.org/releaselog/3_53_2.html", "https://sqlite.org/src/info/061febcf41ca", "https://sqlite.org/src/info/4a5ad516ea93", "https://ubuntu.com/security/notices/USN-8480-1", "https://www.cve.org/CVERecord?id=CVE-2026-11824", "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate" ], "PublishedDate": "2026-06-09T20:16:32.3Z", "LastModifiedDate": "2026-10-15T02:18:37.653Z" }, { "VulnerabilityID": "CVE-2026-119373", "PkgID": "libsqlite3-0@3.46.1-7+deb13u1", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "c7da287e696e8198" }, "InstalledVersion": "3.46.1-7+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119373", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fae6786c8bb6afcd90dcd86a4c6cc8034d2f9c2bb3b3ff5a43f4593725ddaf34", "Title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5", "Description": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge", "https://access.redhat.com/security/cve/CVE-2026-119373", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107", "https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80", "https://nvd.nist.gov/vuln/detail/CVE-2026-119373", "https://sqlite.org/bugs/info/2026-08-04T08:49:27Z", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/a7f8c92f62", "https://www.cve.org/CVERecord?id=CVE-2026-119373", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists" ], "PublishedDate": "2026-10-30T12:16:36.027Z", "LastModifiedDate": "2026-11-05T21:18:41.047Z" }, { "VulnerabilityID": "CVE-2026-119374", "PkgID": "libsqlite3-0@3.46.1-7+deb13u1", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "c7da287e696e8198" }, "InstalledVersion": "3.46.1-7+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119374", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e7dc10e8a074093edf3cf31cee3db4bb1d504ded3cd410d9e13c3702e49bb885", "Title": "sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index", "Description": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-fts5-securedel", "https://access.redhat.com/security/cve/CVE-2026-119374", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525", "https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9", "https://nvd.nist.gov/vuln/detail/CVE-2026-119374", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/9cd4f9e920", "https://www.cve.org/CVERecord?id=CVE-2026-119374", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete" ], "PublishedDate": "2026-10-30T12:16:36.187Z", "LastModifiedDate": "2026-11-03T16:09:06.143Z" }, { "VulnerabilityID": "CVE-2026-119379", "PkgID": "libsqlite3-0@3.46.1-7+deb13u1", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "c7da287e696e8198" }, "InstalledVersion": "3.46.1-7+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119379", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6100ce0d828a2a989ed411bc3c07083c922700f129885fdc0af4c170dafe87f5", "Title": "sqlite: sqlite: Arbitrary code execution via crafted session changesets", "Description": "SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-session-ncol", "https://access.redhat.com/security/cve/CVE-2026-119379", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619", "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52", "https://nvd.nist.gov/vuln/detail/CVE-2026-119379", "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/3f57024aecea0f3b", "https://www.cve.org/CVERecord?id=CVE-2026-119379", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind" ], "PublishedDate": "2026-10-30T12:16:36.967Z", "LastModifiedDate": "2026-11-03T15:38:24.827Z" }, { "VulnerabilityID": "CVE-2026-55199", "VendorIDs": [ "DSA-6365-1" ], "PkgID": "libssh2-1t64@1.11.1-1", "PkgName": "libssh2-1t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh2-1t64@1.11.1-1?arch=amd64\u0026distro=debian-13.5", "UID": "e580ac70f64ee5cb" }, "InstalledVersion": "1.11.1-1", "FixedVersion": "1.11.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55199", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c697ff605fdf05c18494ce453e67956de3b56be5b9995b328ffd1af7826ed83c", "Title": "libssh2: libssh2: Denial of Service via crafted SSH_MSG_EXT_INFO message", "Description": "libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-55199", "https://github.com/advisories/GHSA-3cfq-4xx4-rmpg", "https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4", "https://github.com/libssh2/libssh2/pull/1864", "https://nvd.nist.gov/vuln/detail/CVE-2026-55199", "https://ubuntu.com/security/notices/USN-8486-1", "https://www.cve.org/CVERecord?id=CVE-2026-55199", "https://www.vulncheck.com/advisories/libssh2-pre-authentication-dos-via-ssh-msg-ext-info-handler" ], "PublishedDate": "2026-06-17T20:17:28.52Z", "LastModifiedDate": "2026-07-14T22:17:17.043Z" }, { "VulnerabilityID": "CVE-2026-55200", "VendorIDs": [ "DSA-6365-1" ], "PkgID": "libssh2-1t64@1.11.1-1", "PkgName": "libssh2-1t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh2-1t64@1.11.1-1?arch=amd64\u0026distro=debian-13.5", "UID": "e580ac70f64ee5cb" }, "InstalledVersion": "1.11.1-1", "FixedVersion": "1.11.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55200", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cbe8de165fda868bf8f5cfdb638c71414b4ddf42d9481b93c744d19e13fa5841", "Title": "libssh2: libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c", "Description": "libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "azure": 3, "julia": 4, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.3, "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "V3Score": 8.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-55200", "https://github.com/advisories/GHSA-r8mh-x5qv-7gg2", "https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc", "https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8", "https://github.com/libssh2/libssh2/pull/2052", "https://nvd.nist.gov/vuln/detail/CVE-2026-55200", "https://ubuntu.com/security/notices/USN-8486-1", "https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc", "https://www.cve.org/CVERecord?id=CVE-2026-55200", "https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c" ], "PublishedDate": "2026-06-17T20:17:28.667Z", "LastModifiedDate": "2026-10-22T19:17:55.937Z" }, { "VulnerabilityID": "CVE-2026-58050", "PkgID": "libssh2-1t64@1.11.1-1", "PkgName": "libssh2-1t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh2-1t64@1.11.1-1?arch=amd64\u0026distro=debian-13.5", "UID": "e580ac70f64ee5cb" }, "InstalledVersion": "1.11.1-1", "FixedVersion": "1.11.1-1+deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58050", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:09a736957f67a9d20c2455a201e752176c52dcb13e3911100693b1c4e4a9a742", "Title": "libssh2: libssh2: Heap buffer overflow via integer overflow in publickey attribute allocation", "Description": "libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 3, "azure": 3, "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-58050", "https://github.com/advisories/GHSA-mf77-5hj2-98w9", "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc", "https://github.com/libssh2/libssh2/blob/master/src/publickey.c", "https://github.com/libssh2/libssh2/pull/2205#discussion_r3523193089", "https://nvd.nist.gov/vuln/detail/CVE-2026-58050", "https://ubuntu.com/security/notices/USN-8532-1", "https://ubuntu.com/security/notices/USN-8799-1", "https://www.cve.org/CVERecord?id=CVE-2026-58050", "https://www.vulncheck.com/advisories/libssh2-integer-overflow-in-publickey-subsystem-attribute-allocation" ], "PublishedDate": "2026-06-28T02:16:32.017Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-7598", "VendorIDs": [ "DSA-6365-1" ], "PkgID": "libssh2-1t64@1.11.1-1", "PkgName": "libssh2-1t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh2-1t64@1.11.1-1?arch=amd64\u0026distro=debian-13.5", "UID": "e580ac70f64ee5cb" }, "InstalledVersion": "1.11.1-1", "FixedVersion": "1.11.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:e3c08eb75b777dfd009f1e4e852b46369469d5861beb50dcec59601d8afeb45d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-7598", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e8bffe6fa97c6a1532a7ed1a0e48e733260341cdc4e1872d6f05be26aea5ec52", "Title": "libssh2: integer overflow via large username or password arguments", "Description": "A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-189", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 2, "julia": 2, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "V3Score": 7.3, "V40Score": 6.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:16736", "https://access.redhat.com/errata/RHSA-2026:61752", "https://access.redhat.com/errata/RHSA-2026:7021", "https://access.redhat.com/security/cve/CVE-2026-7598", "https://bugzilla.redhat.com/show_bug.cgi?id=2464597", "https://github.com/libssh2/libssh2/", "https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1", "https://github.com/libssh2/libssh2/pull/1858", "https://nvd.nist.gov/vuln/detail/CVE-2026-7598", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7598.json", "https://ubuntu.com/security/notices/USN-8309-1", "https://vuldb.com/submit/805564", "https://vuldb.com/vuln/360555", "https://vuldb.com/vuln/360555/cti", "https://www.cve.org/CVERecord?id=CVE-2026-7598" ], "PublishedDate": "2026-05-01T22:16:16.947Z", "LastModifiedDate": "2026-09-01T13:19:59.617Z" }, { "VulnerabilityID": "CVE-2026-14456", "VendorIDs": [ "DSA-6465-1" ], "PkgID": "libssl3t64@3.5.6-1~deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.6-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "19bca5c02c5a9632" }, "InstalledVersion": "3.5.6-1~deb13u1", "FixedVersion": "3.5.7-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:25d8804c82f885d7ee2bcabe2df64dd9473fd1d2d7b90e19bff7b2c915a73d2f", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-45447", "VendorIDs": [ "DSA-6335-1" ], "PkgID": "libssl3t64@3.5.6-1~deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.6-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "19bca5c02c5a9632" }, "InstalledVersion": "3.5.6-1~deb13u1", "FixedVersion": "3.5.6-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5112775a5a99e1942a0302bdfe0fa8d1073a9cbfe2048b7bae890ab5ee7d9484", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DSA-6531-1" ], "PkgID": "libssl3t64@3.5.6-1~deb13u1", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.6-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "19bca5c02c5a9632" }, "InstalledVersion": "3.5.6-1~deb13u1", "FixedVersion": "3.5.7-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:511b6d07068d2909f09136dd41e9107bb4cf586ed750ab112020e7ed436bb62a", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-16742", "PkgID": "libsystemd0@257.13-1~deb13u1", "PkgName": "libsystemd0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsystemd0@257.13-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "a2b4ba47389f858e" }, "InstalledVersion": "257.13-1~deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16742", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:53292c3c63da17e01d2e89d759cb8cf2f45df14d1fec86acc6c7c4192e116594", "Title": "systemd: systemd-homed: Local privilege escalation via missing home-record signature verification", "Description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16742", "https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv", "https://nvd.nist.gov/vuln/detail/CVE-2026-16742", "https://ubuntu.com/security/notices/USN-8626-1", "https://www.cve.org/CVERecord?id=CVE-2026-16742" ], "PublishedDate": "2026-08-10T14:17:21.277Z", "LastModifiedDate": "2026-10-23T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "libtinfo6@6.5+20250216-2", "PkgName": "libtinfo6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.5", "UID": "ba2c2b464f07108a" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3aa061699f442450bd4683b062e1ba3071fdd4d3bf1d30f13937fcadb6b214cd", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-16742", "PkgID": "libudev1@257.13-1~deb13u1", "PkgName": "libudev1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libudev1@257.13-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "3b7a2f1a9ab169b" }, "InstalledVersion": "257.13-1~deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16742", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8215162e5f49ff11325d5a05d0ecbeb71a49cfbe0cd309d3ef86c65fb05a6448", "Title": "systemd: systemd-homed: Local privilege escalation via missing home-record signature verification", "Description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16742", "https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv", "https://nvd.nist.gov/vuln/detail/CVE-2026-16742", "https://ubuntu.com/security/notices/USN-8626-1", "https://www.cve.org/CVERecord?id=CVE-2026-16742" ], "PublishedDate": "2026-08-10T14:17:21.277Z", "LastModifiedDate": "2026-10-23T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "1afbb50818377478" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:31d4d6cbb12e832ec2c2f08c320abce415b1a63fbd521e615a38bcb25f8b4b60", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "1afbb50818377478" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fff0926ac5ea3ed0727956d0819380316ce9bf2217a1e39a537ced96491a399d", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "1afbb50818377478" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e74641cd9fee43c7db80a42c8003d3cf826b78c82158ac09ae5cdf1715b68101", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "1afbb50818377478" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d5ea3af31fd0f9c8346d98e13ac424f83c648772b22eb228d8aac00b7b9f25ed", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "1afbb50818377478" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5c5834c2c81f30e20bf2fa079a78be7bb196526e235c152274dddef2083310ea", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "1afbb50818377478" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:051a3b6f0f33c58805530532fb4c9c4d3444725b2693a359bb2b1a97c23865a9", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "1afbb50818377478" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd6f7b15a8a95e7fabefd1031a017a9c171018b6ea835cfa9c9b62dcfb9d6c84", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libuuid1@2.41-5", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "1afbb50818377478" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1a4e99b186a1cfd79a8695b5b2a06b1bdef15af71627bf6fd9d8aa5cd32a828f", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "c0ab0b857644733b" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cab7e9daa84f3c36954528394334686aecf3341c3fefc2c79fe07337868750c0", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "c0ab0b857644733b" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ef1ad0a664a699b2a2f4329eda16c329633e049ac9d2ecee9f02027623c7bbcb", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "c0ab0b857644733b" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ddc1bfa9f9d5287478825227f3a99faf1c6b067e234109bd8ab209ac8ae1015d", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "c0ab0b857644733b" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f056310340e8628c16c5c271c9c072fbab9f1b38174933eb13f20cd9a0d72356", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "c0ab0b857644733b" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:45df902b1cb1ac5bf7517543fdc5caf70fba8225ebcfe6fd99934242203be6af", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "c0ab0b857644733b" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d8ffb9fab2b42643efca38fe4fcfe1ce576609e15b965b1fb618e92d6743c7ac", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "c0ab0b857644733b" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d8690bf52c1b280d3bd2f92b32727d8e771e1620900d879a35c3135fdc732d76", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "login@1:4.16.0-2+really2.41-5", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "c0ab0b857644733b" }, "InstalledVersion": "1:4.16.0-2+really2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:14fb83a12e767883e30ef6fc1ce7dc549439c772b5453682db4ee393426293b6", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e0377ec9be69d8427206a3bf0d49fa9ce2099ac053556a19efd240a86c9bb810", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b33c464e49cd51fe094d2737df12eb75aff20275325a16d50169ec59dce4c73", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1968b7d799f65bb72fbe05c5355b511704e182922d2717a0a39c9193d2bf0ee2", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6defd48f587544eecea026eb0d8df2c66bfef88a0b9bb3a734cd748cae53278f", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5e47a0a9719da351a3b3c8aef5869fc4c1755228d7e9ebbfd1d81c0c5f9497ae", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b91690e4c3b6bd6c243ef7536b2b682051efa2ab6de79e9b77d1c240f0af5a8a", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:05a16c0e29306f4185a894ddacb7b360a96bd29c156c95d1f37fd775e42de1cf", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "mount@2.41-5", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "55c835c674d0a0e5" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dbd9dcdfe5882c3005b2c8df3d890768146ece8bd936c1dd911faa0955579069", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "ncurses-base@6.5+20250216-2", "PkgName": "ncurses-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all\u0026distro=debian-13.5", "UID": "767a0231348a5cb5" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d488c575e6b15a5492182351507239c45603d212664264c29c8e96aa13d066ac", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "ncurses-bin@6.5+20250216-2", "PkgName": "ncurses-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.5", "UID": "5b541563cf6587e5" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:595d2b2cb158a64c5440dd5aa13286a338eaa2b12ccd60a8ef20243abd408516", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-14456", "VendorIDs": [ "DSA-6465-1" ], "PkgID": "openssl@3.5.6-1~deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.6-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "ee88be94d89898bf" }, "InstalledVersion": "3.5.6-1~deb13u1", "FixedVersion": "3.5.7-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:ae0096d57d7f18e7861848f1103983488102f78517c11444120d8a938884de54" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b81048808a48ce246886f0b79a8a3042e8f0f61b4fee5636865c852c42df83c", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-45447", "VendorIDs": [ "DSA-6335-1" ], "PkgID": "openssl@3.5.6-1~deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.6-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "ee88be94d89898bf" }, "InstalledVersion": "3.5.6-1~deb13u1", "FixedVersion": "3.5.6-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:ae0096d57d7f18e7861848f1103983488102f78517c11444120d8a938884de54" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:346c0f482d072dd51b386072279dd5ba337058b011c411d11dc8fa63093d43b9", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DSA-6531-1" ], "PkgID": "openssl@3.5.6-1~deb13u1", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.6-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "ee88be94d89898bf" }, "InstalledVersion": "3.5.6-1~deb13u1", "FixedVersion": "3.5.7-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:ae0096d57d7f18e7861848f1103983488102f78517c11444120d8a938884de54" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:80b28a3bb5a8c92535d20f5c798a9aa75315abf6e6d45813baa51180ecfec631", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-14456", "VendorIDs": [ "DSA-6465-1" ], "PkgID": "openssl-provider-legacy@3.5.6-1~deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "c38741326d0e034f" }, "InstalledVersion": "3.5.6-1~deb13u1", "FixedVersion": "3.5.7-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9a9be054931a8616ea009f1c3ca8c8438041acb18bcb4d9a5fb4e613a23d117c", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-45447", "VendorIDs": [ "DSA-6335-1" ], "PkgID": "openssl-provider-legacy@3.5.6-1~deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "c38741326d0e034f" }, "InstalledVersion": "3.5.6-1~deb13u1", "FixedVersion": "3.5.6-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:49a11c9baee79d26321c890e4165350b0102e534424d63c28c71508974c948c9", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DSA-6531-1" ], "PkgID": "openssl-provider-legacy@3.5.6-1~deb13u1", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u1?arch=amd64\u0026distro=debian-13.5", "UID": "c38741326d0e034f" }, "InstalledVersion": "3.5.6-1~deb13u1", "FixedVersion": "3.5.7-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:81ed76089f70fb876e95b7d34445d92b26c0f7ba63bef3db1111300507523d8f", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-13221", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.5", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ac04ee73899afa7d359631c7cf93a33453e8ec51481b31f85269459d68b406ae", "Title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://access.redhat.com/errata/RHSA-2026:67155", "https://access.redhat.com/security/cve/CVE-2026-13221", "https://bugzilla.redhat.com/2499727", "https://bugzilla.redhat.com/show_bug.cgi?id=2499727", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13221", "https://errata.almalinux.org/9/ALSA-2026-67155.html", "https://errata.rockylinux.org/RLSA-2026:67155", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://linux.oracle.com/cve/CVE-2026-13221.html", "https://linux.oracle.com/errata/ELSA-2026-67278-0.html", "https://lists.security.metacpan.org/cve-announce/msg/41780104/", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-42496", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.5", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:75542770e3bb4d91eb291c7aeb9b0055acdb4b77bbd47490649c625018544639", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-8376", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.5", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ad456e4073004d5fe3a9cabcf10330a4189dc01343dd0afa30c885d48a86d5b7", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-09-08T22:19:18.373Z" }, { "VulnerabilityID": "CVE-2026-42497", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.5", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b768dbf4cd1b41eac8e19b9bad5f090f6fa5ce8ad135d2647b9179b12ff464ca", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://lists.security.metacpan.org/cve-announce/msg/40396457/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.5", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bacec1104e30edef57d0b6a587243014b9d14ed67c7c2cfee9b62cffd359c9d5", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/errata/RHSA-2026:50262", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://lists.security.metacpan.org/cve-announce/msg/40434385/", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-08-05T13:23:22.46Z" }, { "VulnerabilityID": "CVE-2026-57432", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.5", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bbb70202d436c0506db55d23671a822bb43f645fd3e9e9f9aed0816147d62aea", "Title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://access.redhat.com/security/cve/CVE-2026-57432", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780102/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57433", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.5", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d7f2bb230a3fc0f96d36681c3cd5ae3fd7ba79fbf9e4b02bf9bdea94e2630d3d", "Title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://access.redhat.com/security/cve/CVE-2026-57433", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780100/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.5", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:89fb1d77a13392d1bff003ef18d92f7a525cecc5c9f0288744b519e5ea5a0e61", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/errata/RHSA-2026:49525", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://bugzilla.redhat.com/2481315", "https://bugzilla.redhat.com/show_bug.cgi?id=2481315", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9538", "https://errata.almalinux.org/9/ALSA-2026-49525.html", "https://errata.rockylinux.org/RLSA-2026:49525", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://linux.oracle.com/cve/CVE-2026-9538.html", "https://linux.oracle.com/errata/ELSA-2026-49525.html", "https://lists.security.metacpan.org/cve-announce/msg/40396448/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-53612", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bed43e70307a3369304d9ae92374e1e0aa20b8312b6706c0bc2cf14b61e57df3", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:736a124ff5a4afdf2642e8bc9d1758f6beafdaf3f01090b0448a35c33bc54d42", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "VendorIDs": [ "DSA-6442-1" ], "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5e0612d7d228a5ba62a77c964951d56d16a5d9079815899306b5425ac9e4136b", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "FixedVersion": "2.41.5-0+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8801532a85577c90f57b3993389a09346d96614da154c879bc5643a76dd99be8", "Title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "Description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "V3Score": 8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53615", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31", "https://github.com/util-linux/util-linux/commit/e9d544d013267ea86b70ee8ff78abd280e6641af", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://linux.oracle.com/cve/CVE-2026-53615.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53615", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53615" ], "PublishedDate": "2026-10-14T16:17:46.07Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:016faafbd4e04bbba2cca457e8e2b09e74f4f18ada242a57ccd41283c177094c", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6fb18e38e4630bfd8b3ede9ac1f887a889654bd4e5ce09c6d5d5757e884198e9", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3f05716338df2a7a6798f768c47019cbeead5b6ace1632e426b66141f07e51ba", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "util-linux@2.41-5", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41-5?arch=amd64\u0026distro=debian-13.5", "UID": "972fb85b9c9e83e7" }, "InstalledVersion": "2.41-5", "Status": "affected", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cc69287533eb447ce2792999e1bb4fac1b5667a949b1e8a3876b3c02a78ba8c0", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-76844", "VendorIDs": [ "DSA-6613-1" ], "PkgID": "zlib1g@1:1.3.dfsg+really1.3.1-1+b1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "ff182eb2a26a8142" }, "InstalledVersion": "1:1.3.dfsg+really1.3.1-1+b1", "FixedVersion": "1:1.3.dfsg+really1.3.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76844", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:26968c93d2d27d7f39f84bef138aebd695d1324c1a61f73d39247660a1ec1c04", "Title": "webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal", "Description": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76844", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148", "https://github.com/webpack/webpack-dev-middleware", "https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js", "https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b", "https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b", "https://github.com/webpack/webpack-dev-middleware/pull/2404", "https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6", "https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0", "https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c", "https://nvd.nist.gov/vuln/detail/CVE-2026-76844", "https://www.cve.org/CVERecord?id=CVE-2026-76844", "https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-08-24T14:17:02.25Z", "LastModifiedDate": "2026-10-12T17:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-85091", "VendorIDs": [ "DSA-6613-1" ], "PkgID": "zlib1g@1:1.3.dfsg+really1.3.1-1+b1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64\u0026distro=debian-13.5\u0026epoch=1", "UID": "ff182eb2a26a8142" }, "InstalledVersion": "1:1.3.dfsg+really1.3.1-1+b1", "FixedVersion": "1:1.3.dfsg+really1.3.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:219a998c60509502b47b97f1158067d5dd62640d2d689560d32cfd5594f6bc40" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cb6b345a6fc9199a6363a712502912ce8a59aa9f26595a15ce9628af8183dabd", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" } ] }, { "Target": "Python", "Class": "lang-pkgs", "Type": "python-pkg", "Packages": [ { "Name": "APScheduler", "Identifier": { "PURL": "pkg:pypi/apscheduler@3.10.4", "UID": "9c2060f53bdda6c6" }, "Version": "3.10.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/APScheduler-3.10.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "certifi", "Identifier": { "PURL": "pkg:pypi/certifi@2026.5.20", "UID": "16d8eb6dffd63889" }, "Version": "2026.5.20", "Licenses": [ "MPL-2.0" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/certifi-2026.5.20.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "charset-normalizer", "Identifier": { "PURL": "pkg:pypi/charset-normalizer@3.4.7", "UID": "e45430447a93924c" }, "Version": "3.4.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/charset_normalizer-3.4.7.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "idna", "Identifier": { "PURL": "pkg:pypi/idna@3.18", "UID": "e16d74589af54cf9" }, "Version": "3.18", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/idna-3.18.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pip", "Identifier": { "PURL": "pkg:pypi/pip@25.0.1", "UID": "7d864d9a4bf3bfe8" }, "Version": "25.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:c529e1b2553946dcc9afa2d77e33a75f23d3702e0b4a7911b67e2f1fe45a4939" }, "FilePath": "usr/local/lib/python3.12/site-packages/pip-25.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "psycopg", "Identifier": { "PURL": "pkg:pypi/psycopg@3.2.3", "UID": "64e6502022c38dfe" }, "Version": "3.2.3", "Licenses": [ "LGPL-3.0-only" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/psycopg-3.2.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "psycopg-binary", "Identifier": { "PURL": "pkg:pypi/psycopg-binary@3.2.3", "UID": "bb88923224d3a6c9" }, "Version": "3.2.3", "Licenses": [ "LGPL-3.0-only" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/psycopg_binary-3.2.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "psycopg-pool", "Identifier": { "PURL": "pkg:pypi/psycopg-pool@3.2.3", "UID": "7360ad8f4916f48b" }, "Version": "3.2.3", "Licenses": [ "LGPL-3.0-only" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/psycopg_pool-3.2.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "python-dateutil", "Identifier": { "PURL": "pkg:pypi/python-dateutil@2.9.0", "UID": "5716feb624f689f4" }, "Version": "2.9.0", "Licenses": [ "BSD-3-Clause", "Apache-2.0" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/python_dateutil-2.9.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pytz", "Identifier": { "PURL": "pkg:pypi/pytz@2026.2", "UID": "575aa78a5e7b2b96" }, "Version": "2026.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/pytz-2026.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "requests", "Identifier": { "PURL": "pkg:pypi/requests@2.32.3", "UID": "4c72c18e2bac234f" }, "Version": "2.32.3", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/requests-2.32.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "six", "Identifier": { "PURL": "pkg:pypi/six@1.17.0", "UID": "3c749e9680577add" }, "Version": "1.17.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/six-1.17.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tenacity", "Identifier": { "PURL": "pkg:pypi/tenacity@9.0.0", "UID": "b5b4ccce57023d5c" }, "Version": "9.0.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/tenacity-9.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typing_extensions", "Identifier": { "PURL": "pkg:pypi/typing-extensions@4.15.0", "UID": "277d553b4964b1ba" }, "Version": "4.15.0", "Licenses": [ "PSF-2.0" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/typing_extensions-4.15.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tzlocal", "Identifier": { "PURL": "pkg:pypi/tzlocal@5.3.1", "UID": "3a7c089988e3dfc2" }, "Version": "5.3.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/tzlocal-5.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "urllib3", "Identifier": { "PURL": "pkg:pypi/urllib3@2.7.0", "UID": "fd0c49cd6c1fd2de" }, "Version": "2.7.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "FilePath": "usr/local/lib/python3.12/site-packages/urllib3-2.7.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "GHSA-6q48-6c7w-9gw2", "PkgName": "certifi", "PkgPath": "usr/local/lib/python3.12/site-packages/certifi-2026.5.20.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/certifi@2026.5.20", "UID": "16d8eb6dffd63889" }, "InstalledVersion": "2026.5.20", "FixedVersion": "2026.10.18", "Status": "fixed", "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:52fbc34c84ff97b063b4ffd4a246517ad183d84a10ade590820dc8c62a26fa8f", "Title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "Description": "Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. \n\nAn attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer.\n\nCertifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.", "Severity": "CRITICAL", "VendorSeverity": { "ghsa": 4 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 9.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-6q48-6c7w-9gw2", "https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576", "https://emudhra.we-have-a-problem.com", "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "https://github.com/certifi/python-certifi", "https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2" ], "PublishedDate": "2026-10-20T19:35:05Z", "LastModifiedDate": "2026-10-26T16:02:12Z" }, { "VulnerabilityID": "CVE-2026-97687", "VendorIDs": [ "GHSA-8988-9cw3-xx77" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.12/site-packages/urllib3-2.7.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.7.0", "UID": "fd0c49cd6c1fd2de" }, "InstalledVersion": "2.7.0", "FixedVersion": "2.8.0", "Status": "fixed", "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97687", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:b82ad8f9611962d8bd7e301233d4c56a68cf3c6c57de21502d24eb7181a73e96", "Title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override", "Description": "urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-440" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 7.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90494", "https://access.redhat.com/security/cve/CVE-2026-97687", "https://advisory.echohq.com/cve/CVE-2026-97687", "https://bugzilla.redhat.com/2543245", "https://bugzilla.redhat.com/2543255", "https://bugzilla.redhat.com/show_bug.cgi?id=2543245", "https://bugzilla.redhat.com/show_bug.cgi?id=2543255", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97687", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97689", "https://errata.almalinux.org/9/ALSA-2026-90494.html", "https://errata.rockylinux.org/RLSA-2026:90494", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465", "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3", "https://github.com/urllib3/urllib3/pull/5093", "https://github.com/urllib3/urllib3/releases/tag/2.8.0", "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77", "https://linux.oracle.com/cve/CVE-2026-97687.html", "https://linux.oracle.com/errata/ELSA-2026-92474.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97687", "https://ubuntu.com/security/notices/USN-8926-1", "https://www.cve.org/CVERecord?id=CVE-2026-97687" ], "PublishedDate": "2026-09-29T16:17:18.517Z", "LastModifiedDate": "2026-10-13T20:27:23.13Z" }, { "VulnerabilityID": "CVE-2026-97689", "VendorIDs": [ "GHSA-vxq7-64xx-v4gw" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.12/site-packages/urllib3-2.7.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.7.0", "UID": "fd0c49cd6c1fd2de" }, "InstalledVersion": "2.7.0", "FixedVersion": "2.8.0", "Status": "fixed", "Layer": { "DiffID": "sha256:1af194c5e4222af276302d0ce6d8c8d44f23ab4c0741b45095bf76d2b1cb111b" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97689", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:e0c3c05706ba123d8f3d276ca22d46d0c20cba369a0b78d71393f58ba9290600", "Title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser", "Description": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "V40Score": 8.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90494", "https://access.redhat.com/security/cve/CVE-2026-97689", "https://advisory.echohq.com/cve/CVE-2026-97689", "https://bugzilla.redhat.com/2543245", "https://bugzilla.redhat.com/2543255", "https://bugzilla.redhat.com/show_bug.cgi?id=2543245", "https://bugzilla.redhat.com/show_bug.cgi?id=2543255", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97687", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97689", "https://errata.almalinux.org/9/ALSA-2026-90494.html", "https://errata.rockylinux.org/RLSA-2026:90494", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed", "https://github.com/urllib3/urllib3/releases/tag/2.8.0", "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw", "https://linux.oracle.com/cve/CVE-2026-97689.html", "https://linux.oracle.com/errata/ELSA-2026-92474.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97689", "https://ubuntu.com/security/notices/USN-8926-1", "https://www.cve.org/CVERecord?id=CVE-2026-97689" ], "PublishedDate": "2026-09-29T16:17:18.837Z", "LastModifiedDate": "2026-10-13T20:20:06.95Z" } ] } ] }