{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b91c-75f7-75de-b6d6-f20c8f8c28ba", "CreatedAt": "2026-11-08T04:03:32.599386141+01:00", "ArtifactID": "sha256:a1061d6bfc3d54a35e33528d6dc8ed3857034aaf3d00fe4dd2b412d699a6d5c6", "ArtifactName": "traefik-stack-suno-webhook", "ArtifactType": "container_image", "Metadata": { "Size": 6972054528, "OS": { "Family": "debian", "Name": "13.6" }, "ImageID": "sha256:877b14ace708024a5fa9a92564a0d5b4db9ebd576f779780e5533498f4001e04", "DiffIDs": [ "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3", "sha256:4d43b7f98e4c38fd2d37f37f1bf9965d2c4018b01453d3b29d924653c3275f4b", "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e", "sha256:164ea7718b2462d163b7bd95ece7ebd8b669f0cdb1b094b66009aecec2f1195b", "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef", "sha256:0dd4113e996a0bd15ace37d7813531a0498b4b9785d8348e50d4accb851084cc", "sha256:259a26d35a1c04c3396b9b873d62494dae5f650573f85cfb627bec719f5b4679", "sha256:19cffa7bcbc29e0fb2f377b1394f33d96d4337254eff87d1910e4f4789c9689d", "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e", "sha256:914a98e29d898a556a510394f2d731f8189398b8d4fede12ac18e1fa74fd7350", "sha256:b05a252fcea07f3d72352df0a83b012b62f9ad35a6336205dd8b69ad7e6300af", "sha256:bcb37d49667257bf0c0bee1a88efe39dab6d0fe4dbdeee5c54a077e528936d12", "sha256:c44b7dc33e12d664102792e1082827b3da6bf635087536e847dd9df8fe8f818b", "sha256:0235c044fb56b3c7334c2054c4df66b8b55dfbdb754359fae3e1e74c809a25fb", "sha256:28f47e180e53aa127380d2611bb6ed6b200d29bb91cbaacb6c2ef6e3d8f66e02", "sha256:6d6d5918b6513b9d1cd614ce6831c100ebdc5732e79927f0bd818ef9964e4708" ], "RepoTags": [ "traefik-stack-suno-webhook:latest" ], "Reference": "traefik-stack-suno-webhook:latest", "ImageConfig": { "architecture": "amd64", "created": "2026-09-18T21:36:44.134109947Z", "history": [ { "created": "2026-08-24T00:00:00Z", "created_by": "# debian.sh --arch 'amd64' out/ 'trixie' '@1787529600'", "comment": "debuerreotype 0.17" }, { "created": "2026-09-01T00:07:16Z", "created_by": "ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-09-01T00:07:16Z", "created_by": "ENV LANG=C.UTF-8", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-09-01T00:07:16Z", "created_by": "RUN /bin/sh -c set -eux; \tapt-get update; \tapt-get install -y --no-install-recommends \t\tca-certificates \t\tnetbase \t\ttzdata \t; \tapt-get dist-clean # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-01T00:07:16Z", "created_by": "ENV GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-09-01T00:07:16Z", "created_by": "ENV PYTHON_VERSION=3.11.16", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-09-01T00:07:16Z", "created_by": "ENV PYTHON_SHA256=91bcdebfdde239a003ae93738a7fce0f9230fee5c4bc2b86f6e6e8c6f98aabe8", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-09-01T00:14:30Z", "created_by": "RUN /bin/sh -c set -eux; \t\tsavedAptMark=\"$(apt-mark showmanual)\"; \tapt-get update; \tapt-get install -y --no-install-recommends \t\tdpkg-dev \t\tg++ \t\tgcc \t\tgnupg \t\tlibbluetooth-dev \t\tlibbz2-dev \t\tlibc6-dev \t\tlibdb-dev \t\tlibffi-dev \t\tlibgdbm-dev \t\tliblzma-dev \t\tlibncursesw5-dev \t\tlibreadline-dev \t\tlibsqlite3-dev \t\tlibssl-dev \t\tmake \t\ttk-dev \t\tuuid-dev \t\twget \t\txz-utils \t\tzlib1g-dev \t; \t\twget -O python.tar.xz \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz\"; \techo \"$PYTHON_SHA256 *python.tar.xz\" | sha256sum -c -; \twget -O python.tar.xz.asc \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc\"; \tGNUPGHOME=\"$(mktemp -d)\"; export GNUPGHOME; \tgpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$GPG_KEY\"; \tgpg --batch --verify python.tar.xz.asc python.tar.xz; \tgpgconf --kill all; \trm -rf \"$GNUPGHOME\" python.tar.xz.asc; \tmkdir -p /usr/src/python; \ttar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; \trm python.tar.xz; \t\tcd /usr/src/python; \tgnuArch=\"$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)\"; \t./configure \t\t--build=\"$gnuArch\" \t\t--enable-loadable-sqlite-extensions \t\t--enable-optimizations \t\t--enable-option-checking=fatal \t\t--enable-shared \t\t$(test \"${gnuArch%%-*}\" != 'riscv64' \u0026\u0026 echo '--with-lto') \t\t--with-ensurepip \t; \tnproc=\"$(nproc)\"; \tEXTRA_CFLAGS=\"$(dpkg-buildflags --get CFLAGS)\"; \tLDFLAGS=\"$(dpkg-buildflags --get LDFLAGS)\"; \tLDFLAGS=\"${LDFLAGS:-} -Wl,--strip-all\"; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-}\" \t; \trm python; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\\$\\$ORIGIN/../lib'\" \t\tpython \t; \tmake install; \t\tcd /; \trm -rf /usr/src/python; \t\tfind /usr/local -depth \t\t\\( \t\t\t\\( -type d -a \\( -name test -o -name tests -o -name idle_test \\) \\) \t\t\t-o \\( -type f -a \\( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \\) \\) \t\t\\) -exec rm -rf '{}' + \t; \t\tldconfig; \t\tapt-mark auto '.*' \u003e /dev/null; \tapt-mark manual $savedAptMark; \tfind /usr/local -type f -executable -not \\( -name '*tkinter*' \\) -exec ldd '{}' ';' \t\t| awk '/=\u003e/ { so = $(NF-1); if (index(so, \"/usr/local/\") == 1) { next }; gsub(\"^/(usr/)?\", \"\", so); printf \"*%s\\n\", so }' \t\t| sort -u \t\t| xargs -rt dpkg-query --search \t\t| awk 'sub(\":$\", \"\", $1) { print $1 }' \t\t| sort -u \t\t| xargs -r apt-mark manual \t; \tapt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \tapt-get dist-clean; \t\texport PYTHONDONTWRITEBYTECODE=1; \tpython3 --version; \t\tpip3 install \t\t--disable-pip-version-check \t\t--no-cache-dir \t\t--no-compile \t\t'setuptools==79.0.1' \t\t'wheel==0.46.3' \t; \tpip3 --version # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-01T00:14:30Z", "created_by": "RUN /bin/sh -c set -eux; \tfor src in idle3 pip3 pydoc3 python3 python3-config; do \t\tdst=\"$(echo \"$src\" | tr -d 3)\"; \t\t[ -s \"/usr/local/bin/$src\" ]; \t\t[ ! -e \"/usr/local/bin/$dst\" ]; \t\tln -svT \"$src\" \"/usr/local/bin/$dst\"; \tdone # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-01T00:14:30Z", "created_by": "CMD [\"python3\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-09-18T12:54:11Z", "created_by": "LABEL maintainer=suno-darujpesnicku", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-09-18T12:54:11Z", "created_by": "LABEL description=Suno karaoke video pipeline (multi-image Ken Burns, remote Whisper)", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-09-18T12:54:11Z", "created_by": "RUN /bin/sh -c apt-get update \u0026\u0026 apt-get install -y --no-install-recommends curl ffmpeg bash fontconfig \u0026\u0026 rm -rf /var/lib/apt/lists/* # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-18T12:54:14Z", "created_by": "RUN /bin/sh -c mkdir -p /usr/share/fonts/truetype/lexenddeca \u0026\u0026 curl -fsSL \"https://raw.githubusercontent.com/google/fonts/main/ofl/lexenddeca/LexendDeca%5Bwght%5D.ttf\" -o /usr/share/fonts/truetype/lexenddeca/LexendDeca.ttf \u0026\u0026 fc-cache -fv \u003e /dev/null # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-18T12:54:14Z", "created_by": "WORKDIR /app", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-18T12:54:14Z", "created_by": "COPY requirements.txt . # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-18T13:01:02Z", "created_by": "RUN /bin/sh -c pip install --no-cache-dir -r requirements.txt # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-18T13:01:02Z", "created_by": "RUN /bin/sh -c mkdir -p /app/output # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-18T19:15:29Z", "created_by": "COPY modules/ /app/modules/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-18T19:15:29Z", "created_by": "COPY templates/ /app/templates/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-18T21:36:43Z", "created_by": "COPY webhook_server_v2.py /app/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-18T21:36:43Z", "created_by": "COPY process_pipeline.py /app/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-18T21:36:43Z", "created_by": "COPY poll_worker.py /app/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-18T21:36:44Z", "created_by": "RUN /bin/sh -c chmod +x /app/webhook_server_v2.py /app/process_pipeline.py # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-09-18T21:36:44Z", "created_by": "HEALTHCHECK {Test:[CMD-SHELL curl -fsS http://localhost:9001/api/health || exit 1] Interval:1m0s Timeout:10s StartPeriod:30s StartInterval:0s Retries:3}", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-09-18T21:36:44Z", "created_by": "EXPOSE [9001/tcp]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-09-18T21:36:44Z", "created_by": "CMD [\"python3\" \"-u\" \"webhook_server_v2.py\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3", "sha256:4d43b7f98e4c38fd2d37f37f1bf9965d2c4018b01453d3b29d924653c3275f4b", "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e", "sha256:164ea7718b2462d163b7bd95ece7ebd8b669f0cdb1b094b66009aecec2f1195b", "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef", "sha256:0dd4113e996a0bd15ace37d7813531a0498b4b9785d8348e50d4accb851084cc", "sha256:259a26d35a1c04c3396b9b873d62494dae5f650573f85cfb627bec719f5b4679", "sha256:19cffa7bcbc29e0fb2f377b1394f33d96d4337254eff87d1910e4f4789c9689d", "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e", "sha256:914a98e29d898a556a510394f2d731f8189398b8d4fede12ac18e1fa74fd7350", "sha256:b05a252fcea07f3d72352df0a83b012b62f9ad35a6336205dd8b69ad7e6300af", "sha256:bcb37d49667257bf0c0bee1a88efe39dab6d0fe4dbdeee5c54a077e528936d12", "sha256:c44b7dc33e12d664102792e1082827b3da6bf635087536e847dd9df8fe8f818b", "sha256:0235c044fb56b3c7334c2054c4df66b8b55dfbdb754359fae3e1e74c809a25fb", "sha256:28f47e180e53aa127380d2611bb6ed6b200d29bb91cbaacb6c2ef6e3d8f66e02", "sha256:6d6d5918b6513b9d1cd614ce6831c100ebdc5732e79927f0bd818ef9964e4708" ] }, "config": { "Cmd": [ "python3", "-u", "webhook_server_v2.py" ], "Healthcheck": { "Test": [ "CMD-SHELL", "curl -fsS http://localhost:9001/api/health || exit 1" ], "Interval": 60000000000, "Timeout": 10000000000, "StartPeriod": 30000000000, "Retries": 3 }, "Env": [ "PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "LANG=C.UTF-8", "GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D", "PYTHON_VERSION=3.11.16", "PYTHON_SHA256=91bcdebfdde239a003ae93738a7fce0f9230fee5c4bc2b86f6e6e8c6f98aabe8" ], "Labels": { "com.docker.compose.project": "traefik-stack", "com.docker.compose.service": "suno-webhook", "com.docker.compose.version": "5.5.1", "description": "Suno karaoke video pipeline (multi-image Ken Burns, remote Whisper)", "maintainer": "suno-darujpesnicku" }, "WorkingDir": "/app", "ExposedPorts": { "9001/tcp": {} }, "ArgsEscaped": true } }, "Layers": [ { "Size": 81070080, "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, { "Size": 12298752, "DiffID": "sha256:4d43b7f98e4c38fd2d37f37f1bf9965d2c4018b01453d3b29d924653c3275f4b" }, { "Size": 44244480, "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, { "Size": 5120, "DiffID": "sha256:164ea7718b2462d163b7bd95ece7ebd8b669f0cdb1b094b66009aecec2f1195b" }, { "Size": 455308288, "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, { "Size": 225792, "DiffID": "sha256:0dd4113e996a0bd15ace37d7813531a0498b4b9785d8348e50d4accb851084cc" }, { "Size": 1536, "DiffID": "sha256:259a26d35a1c04c3396b9b873d62494dae5f650573f85cfb627bec719f5b4679" }, { "Size": 3584, "DiffID": "sha256:19cffa7bcbc29e0fb2f377b1394f33d96d4337254eff87d1910e4f4789c9689d" }, { "Size": 6378349056, "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, { "Size": 2560, "DiffID": "sha256:914a98e29d898a556a510394f2d731f8189398b8d4fede12ac18e1fa74fd7350" }, { "Size": 242688, "DiffID": "sha256:b05a252fcea07f3d72352df0a83b012b62f9ad35a6336205dd8b69ad7e6300af" }, { "Size": 105984, "DiffID": "sha256:bcb37d49667257bf0c0bee1a88efe39dab6d0fe4dbdeee5c54a077e528936d12" }, { "Size": 75264, "DiffID": "sha256:c44b7dc33e12d664102792e1082827b3da6bf635087536e847dd9df8fe8f818b" }, { "Size": 18944, "DiffID": "sha256:0235c044fb56b3c7334c2054c4df66b8b55dfbdb754359fae3e1e74c809a25fb" }, { "Size": 9216, "DiffID": "sha256:28f47e180e53aa127380d2611bb6ed6b200d29bb91cbaacb6c2ef6e3d8f66e02" }, { "Size": 93184, "DiffID": "sha256:6d6d5918b6513b9d1cd614ce6831c100ebdc5732e79927f0bd818ef9964e4708" } ] }, "Results": [ { "Target": "traefik-stack-suno-webhook (debian 13.6)", "Class": "os-pkgs", "Type": "debian", "Packages": [ { "ID": "adduser@3.152", "Name": "adduser", "Identifier": { "PURL": "pkg:deb/debian/adduser@3.152?arch=all\u0026distro=debian-13.6", "UID": "17a3839c9950603e" }, "Version": "3.152", "Arch": "all", "SrcName": "adduser", "SrcVersion": "3.152", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Adduser Developers \u003cadduser@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "passwd@1:4.17.4-2" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "InstalledFiles": [ "/usr/sbin/adduser", "/usr/sbin/deluser", "/usr/share/doc/adduser/NEWS.Debian.gz", "/usr/share/doc/adduser/README.gz", "/usr/share/doc/adduser/TODO", "/usr/share/doc/adduser/changelog.gz", "/usr/share/doc/adduser/copyright", "/usr/share/doc/adduser/examples/INSTALL", "/usr/share/doc/adduser/examples/README", "/usr/share/doc/adduser/examples/adduser.conf", "/usr/share/doc/adduser/examples/adduser.local", "/usr/share/doc/adduser/examples/adduser.local.conf", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/bash.bashrc", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/profile", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel.other/index.html", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bash_logout", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bash_profile", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bashrc", "/usr/share/doc/adduser/examples/deluser.conf", "/usr/share/man/da/man5/deluser.conf.5.gz", "/usr/share/man/de/man5/adduser.conf.5.gz", "/usr/share/man/de/man5/deluser.conf.5.gz", "/usr/share/man/de/man8/adduser.8.gz", "/usr/share/man/de/man8/adduser.local.8.gz", "/usr/share/man/de/man8/deluser.8.gz", "/usr/share/man/es/man5/deluser.conf.5.gz", "/usr/share/man/fr/man5/adduser.conf.5.gz", "/usr/share/man/fr/man5/deluser.conf.5.gz", "/usr/share/man/fr/man8/adduser.8.gz", "/usr/share/man/fr/man8/deluser.8.gz", "/usr/share/man/it/man5/deluser.conf.5.gz", "/usr/share/man/man5/adduser.conf.5.gz", "/usr/share/man/man5/deluser.conf.5.gz", "/usr/share/man/man8/adduser.8.gz", "/usr/share/man/man8/adduser.local.8.gz", "/usr/share/man/man8/deluser.8.gz", "/usr/share/man/nl/man5/adduser.conf.5.gz", "/usr/share/man/nl/man5/deluser.conf.5.gz", "/usr/share/man/nl/man8/adduser.8.gz", "/usr/share/man/nl/man8/adduser.local.8.gz", "/usr/share/man/nl/man8/deluser.8.gz", "/usr/share/man/pl/man5/deluser.conf.5.gz", "/usr/share/man/pt/man5/adduser.conf.5.gz", "/usr/share/man/pt/man5/deluser.conf.5.gz", "/usr/share/man/pt/man8/adduser.8.gz", "/usr/share/man/pt/man8/adduser.local.8.gz", "/usr/share/man/pt/man8/deluser.8.gz", "/usr/share/man/ro/man5/adduser.conf.5.gz", "/usr/share/man/ro/man5/deluser.conf.5.gz", "/usr/share/man/ro/man8/adduser.8.gz", "/usr/share/man/ro/man8/adduser.local.8.gz", "/usr/share/man/ro/man8/deluser.8.gz", "/usr/share/man/ru/man5/deluser.conf.5.gz", "/usr/share/man/sv/man5/deluser.conf.5.gz", "/usr/share/perl5/Debian/AdduserCommon.pm", "/usr/share/perl5/Debian/AdduserLogging.pm", "/usr/share/perl5/Debian/AdduserRetvalues.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "apt@3.0.3", "Name": "apt", "Identifier": { "PURL": "pkg:deb/debian/apt@3.0.3?arch=amd64\u0026distro=debian-13.6", "UID": "1c5db4816123219d" }, "Version": "3.0.3", "Arch": "amd64", "SrcName": "apt", "SrcVersion": "3.0.3", "Licenses": [ "GPL-2.0-or-later", "curl", "BSD-3-Clause", "MIT", "GPL-2.0-only" ], "Maintainer": "APT Development Team \u003cdeity@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "adduser@3.152", "base-passwd@3.6.7", "debian-archive-keyring@2025.1", "libapt-pkg7.0@3.0.3", "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libseccomp2@2.6.0-2", "libssl3t64@3.5.7-1~deb13u2", "libstdc++6@14.2.0-19", "libsystemd0@257.13-1~deb13u1", "sqv@1.3.0-3+b2" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/apt", "/usr/bin/apt-cache", "/usr/bin/apt-cdrom", "/usr/bin/apt-config", "/usr/bin/apt-get", "/usr/bin/apt-mark", "/usr/lib/apt/apt-extracttemplates", "/usr/lib/apt/apt-helper", "/usr/lib/apt/apt.systemd.daily", "/usr/lib/apt/methods/cdrom", "/usr/lib/apt/methods/copy", "/usr/lib/apt/methods/file", "/usr/lib/apt/methods/gpgv", "/usr/lib/apt/methods/http", "/usr/lib/apt/methods/mirror", "/usr/lib/apt/methods/rred", "/usr/lib/apt/methods/sqv", "/usr/lib/apt/methods/store", "/usr/lib/apt/solvers/dump", "/usr/lib/dpkg/methods/apt/desc.apt", "/usr/lib/dpkg/methods/apt/install", "/usr/lib/dpkg/methods/apt/names", "/usr/lib/dpkg/methods/apt/setup", "/usr/lib/dpkg/methods/apt/update", "/usr/lib/systemd/system/apt-daily-upgrade.service", "/usr/lib/systemd/system/apt-daily-upgrade.timer", "/usr/lib/systemd/system/apt-daily.service", "/usr/lib/systemd/system/apt-daily.timer", "/usr/lib/x86_64-linux-gnu/libapt-private.so.0.0.0", "/usr/share/apt/default-sequoia.config", "/usr/share/bash-completion/completions/apt", "/usr/share/bug/apt/script", "/usr/share/doc/apt/NEWS.Debian.gz", "/usr/share/doc/apt/README.md.gz", "/usr/share/doc/apt/changelog.gz", "/usr/share/doc/apt/copyright", "/usr/share/doc/apt/examples/apt.conf", "/usr/share/doc/apt/examples/configure-index", "/usr/share/doc/apt/examples/debian.sources", "/usr/share/doc/apt/examples/preferences", "/usr/share/lintian/overrides/apt", "/usr/share/locale/ar/LC_MESSAGES/apt.mo", "/usr/share/locale/ast/LC_MESSAGES/apt.mo", "/usr/share/locale/bg/LC_MESSAGES/apt.mo", "/usr/share/locale/bs/LC_MESSAGES/apt.mo", "/usr/share/locale/ca/LC_MESSAGES/apt.mo", "/usr/share/locale/cs/LC_MESSAGES/apt.mo", "/usr/share/locale/cy/LC_MESSAGES/apt.mo", "/usr/share/locale/da/LC_MESSAGES/apt.mo", "/usr/share/locale/de/LC_MESSAGES/apt.mo", "/usr/share/locale/dz/LC_MESSAGES/apt.mo", "/usr/share/locale/el/LC_MESSAGES/apt.mo", "/usr/share/locale/es/LC_MESSAGES/apt.mo", "/usr/share/locale/eu/LC_MESSAGES/apt.mo", "/usr/share/locale/fi/LC_MESSAGES/apt.mo", "/usr/share/locale/fr/LC_MESSAGES/apt.mo", "/usr/share/locale/gl/LC_MESSAGES/apt.mo", "/usr/share/locale/hu/LC_MESSAGES/apt.mo", "/usr/share/locale/it/LC_MESSAGES/apt.mo", "/usr/share/locale/ja/LC_MESSAGES/apt.mo", "/usr/share/locale/km/LC_MESSAGES/apt.mo", "/usr/share/locale/ko/LC_MESSAGES/apt.mo", "/usr/share/locale/ku/LC_MESSAGES/apt.mo", "/usr/share/locale/lt/LC_MESSAGES/apt.mo", "/usr/share/locale/mr/LC_MESSAGES/apt.mo", "/usr/share/locale/nb/LC_MESSAGES/apt.mo", "/usr/share/locale/ne/LC_MESSAGES/apt.mo", "/usr/share/locale/nl/LC_MESSAGES/apt.mo", "/usr/share/locale/nn/LC_MESSAGES/apt.mo", "/usr/share/locale/pl/LC_MESSAGES/apt.mo", "/usr/share/locale/pt/LC_MESSAGES/apt.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/apt.mo", "/usr/share/locale/ro/LC_MESSAGES/apt.mo", "/usr/share/locale/ru/LC_MESSAGES/apt.mo", "/usr/share/locale/sk/LC_MESSAGES/apt.mo", "/usr/share/locale/sl/LC_MESSAGES/apt.mo", "/usr/share/locale/sv/LC_MESSAGES/apt.mo", "/usr/share/locale/th/LC_MESSAGES/apt.mo", "/usr/share/locale/tl/LC_MESSAGES/apt.mo", "/usr/share/locale/tr/LC_MESSAGES/apt.mo", "/usr/share/locale/uk/LC_MESSAGES/apt.mo", "/usr/share/locale/vi/LC_MESSAGES/apt.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/apt.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/apt.mo", "/usr/share/man/de/man1/apt-transport-http.1.gz", "/usr/share/man/de/man1/apt-transport-https.1.gz", "/usr/share/man/de/man1/apt-transport-mirror.1.gz", "/usr/share/man/de/man5/apt.conf.5.gz", "/usr/share/man/de/man5/apt_auth.conf.5.gz", "/usr/share/man/de/man5/apt_preferences.5.gz", "/usr/share/man/de/man5/sources.list.5.gz", "/usr/share/man/de/man7/apt-patterns.7.gz", "/usr/share/man/de/man8/apt-cache.8.gz", "/usr/share/man/de/man8/apt-cdrom.8.gz", "/usr/share/man/de/man8/apt-config.8.gz", "/usr/share/man/de/man8/apt-get.8.gz", "/usr/share/man/de/man8/apt-mark.8.gz", "/usr/share/man/de/man8/apt-secure.8.gz", "/usr/share/man/de/man8/apt.8.gz", "/usr/share/man/es/man5/apt_preferences.5.gz", "/usr/share/man/es/man8/apt-cache.8.gz", "/usr/share/man/es/man8/apt-cdrom.8.gz", "/usr/share/man/es/man8/apt-config.8.gz", "/usr/share/man/fr/man1/apt-transport-http.1.gz", "/usr/share/man/fr/man1/apt-transport-https.1.gz", "/usr/share/man/fr/man1/apt-transport-mirror.1.gz", "/usr/share/man/fr/man5/apt.conf.5.gz", "/usr/share/man/fr/man5/apt_auth.conf.5.gz", "/usr/share/man/fr/man5/apt_preferences.5.gz", "/usr/share/man/fr/man5/sources.list.5.gz", "/usr/share/man/fr/man7/apt-patterns.7.gz", "/usr/share/man/fr/man8/apt-cache.8.gz", "/usr/share/man/fr/man8/apt-cdrom.8.gz", "/usr/share/man/fr/man8/apt-config.8.gz", "/usr/share/man/fr/man8/apt-get.8.gz", "/usr/share/man/fr/man8/apt-mark.8.gz", "/usr/share/man/fr/man8/apt-secure.8.gz", "/usr/share/man/fr/man8/apt.8.gz", "/usr/share/man/it/man5/apt.conf.5.gz", "/usr/share/man/it/man5/apt_preferences.5.gz", "/usr/share/man/it/man8/apt-cache.8.gz", "/usr/share/man/it/man8/apt-cdrom.8.gz", "/usr/share/man/it/man8/apt-config.8.gz", "/usr/share/man/it/man8/apt-mark.8.gz", "/usr/share/man/it/man8/apt.8.gz", "/usr/share/man/ja/man5/apt.conf.5.gz", "/usr/share/man/ja/man5/apt_preferences.5.gz", "/usr/share/man/ja/man8/apt-cache.8.gz", "/usr/share/man/ja/man8/apt-cdrom.8.gz", "/usr/share/man/ja/man8/apt-config.8.gz", "/usr/share/man/ja/man8/apt-mark.8.gz", "/usr/share/man/ja/man8/apt.8.gz", "/usr/share/man/man1/apt-transport-http.1.gz", "/usr/share/man/man1/apt-transport-https.1.gz", "/usr/share/man/man1/apt-transport-mirror.1.gz", "/usr/share/man/man5/apt.conf.5.gz", "/usr/share/man/man5/apt_auth.conf.5.gz", "/usr/share/man/man5/apt_preferences.5.gz", "/usr/share/man/man5/sources.list.5.gz", "/usr/share/man/man7/apt-patterns.7.gz", "/usr/share/man/man8/apt-cache.8.gz", "/usr/share/man/man8/apt-cdrom.8.gz", "/usr/share/man/man8/apt-config.8.gz", "/usr/share/man/man8/apt-get.8.gz", "/usr/share/man/man8/apt-mark.8.gz", "/usr/share/man/man8/apt-secure.8.gz", "/usr/share/man/man8/apt.8.gz", "/usr/share/man/nl/man1/apt-transport-http.1.gz", "/usr/share/man/nl/man1/apt-transport-https.1.gz", "/usr/share/man/nl/man1/apt-transport-mirror.1.gz", "/usr/share/man/nl/man5/apt.conf.5.gz", "/usr/share/man/nl/man5/apt_auth.conf.5.gz", "/usr/share/man/nl/man5/apt_preferences.5.gz", "/usr/share/man/nl/man5/sources.list.5.gz", "/usr/share/man/nl/man7/apt-patterns.7.gz", "/usr/share/man/nl/man8/apt-cache.8.gz", "/usr/share/man/nl/man8/apt-cdrom.8.gz", "/usr/share/man/nl/man8/apt-config.8.gz", "/usr/share/man/nl/man8/apt-get.8.gz", "/usr/share/man/nl/man8/apt-mark.8.gz", "/usr/share/man/nl/man8/apt-secure.8.gz", "/usr/share/man/nl/man8/apt.8.gz", "/usr/share/man/pl/man5/apt_preferences.5.gz", "/usr/share/man/pl/man8/apt-cache.8.gz", "/usr/share/man/pl/man8/apt-cdrom.8.gz", "/usr/share/man/pl/man8/apt-config.8.gz", "/usr/share/man/pt/man1/apt-transport-http.1.gz", "/usr/share/man/pt/man1/apt-transport-https.1.gz", "/usr/share/man/pt/man1/apt-transport-mirror.1.gz", "/usr/share/man/pt/man5/apt.conf.5.gz", "/usr/share/man/pt/man5/apt_auth.conf.5.gz", "/usr/share/man/pt/man5/apt_preferences.5.gz", "/usr/share/man/pt/man5/sources.list.5.gz", "/usr/share/man/pt/man7/apt-patterns.7.gz", "/usr/share/man/pt/man8/apt-cache.8.gz", "/usr/share/man/pt/man8/apt-cdrom.8.gz", "/usr/share/man/pt/man8/apt-config.8.gz", "/usr/share/man/pt/man8/apt-get.8.gz", "/usr/share/man/pt/man8/apt-mark.8.gz", "/usr/share/man/pt/man8/apt-secure.8.gz", "/usr/share/man/pt/man8/apt.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "base-files@13.8+deb13u6", "Name": "base-files", "Identifier": { "PURL": "pkg:deb/debian/base-files@13.8%2Bdeb13u6?arch=amd64\u0026distro=debian-13.6", "UID": "92f0efebffd8c58f" }, "Version": "13.8+deb13u6", "Arch": "amd64", "SrcName": "base-files", "SrcVersion": "13.8+deb13u6", "Licenses": [ "GPL-2.0-or-later", "verbatim" ], "Maintainer": "Santiago Vila \u003csanvila@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/os-release", "/usr/share/base-files/dot.bashrc", "/usr/share/base-files/dot.profile", "/usr/share/base-files/dot.profile.md5sums", "/usr/share/base-files/info.dir", "/usr/share/base-files/motd", "/usr/share/base-files/profile", "/usr/share/base-files/profile.md5sums", "/usr/share/base-files/staff-group-for-usr-local", "/usr/share/common-licenses/Apache-2.0", "/usr/share/common-licenses/Artistic", "/usr/share/common-licenses/BSD", "/usr/share/common-licenses/CC0-1.0", "/usr/share/common-licenses/GFDL-1.2", "/usr/share/common-licenses/GFDL-1.3", "/usr/share/common-licenses/GPL-1", "/usr/share/common-licenses/GPL-2", "/usr/share/common-licenses/GPL-3", "/usr/share/common-licenses/LGPL-2", "/usr/share/common-licenses/LGPL-2.1", "/usr/share/common-licenses/LGPL-3", "/usr/share/common-licenses/MPL-1.1", "/usr/share/common-licenses/MPL-2.0", "/usr/share/doc/base-files/NEWS.Debian.gz", "/usr/share/doc/base-files/README", "/usr/share/doc/base-files/README.FHS", "/usr/share/doc/base-files/changelog.gz", "/usr/share/doc/base-files/copyright", "/usr/share/lintian/overrides/base-files" ], "AnalyzedBy": "dpkg" }, { "ID": "base-passwd@3.6.7", "Name": "base-passwd", "Identifier": { "PURL": "pkg:deb/debian/base-passwd@3.6.7?arch=amd64\u0026distro=debian-13.6", "UID": "f77779fa356eca05" }, "Version": "3.6.7", "Arch": "amd64", "SrcName": "base-passwd", "SrcVersion": "3.6.7", "Licenses": [ "GPL-2.0-only", "public-domain" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdebconfclient0@0.280", "libselinux1@3.8.1-1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/sbin/update-passwd", "/usr/share/base-passwd/group.master", "/usr/share/base-passwd/passwd.master", "/usr/share/doc-base/base-passwd.users-and-groups", "/usr/share/doc/base-passwd/README", "/usr/share/doc/base-passwd/changelog.gz", "/usr/share/doc/base-passwd/copyright", "/usr/share/doc/base-passwd/users-and-groups.html", "/usr/share/doc/base-passwd/users-and-groups.txt.gz", "/usr/share/lintian/overrides/base-passwd", "/usr/share/man/de/man8/update-passwd.8.gz", "/usr/share/man/es/man8/update-passwd.8.gz", "/usr/share/man/fr/man8/update-passwd.8.gz", "/usr/share/man/ja/man8/update-passwd.8.gz", "/usr/share/man/man8/update-passwd.8.gz", "/usr/share/man/pl/man8/update-passwd.8.gz", "/usr/share/man/ro/man8/update-passwd.8.gz", "/usr/share/man/ru/man8/update-passwd.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "bash@5.2.37-2+b10", "Name": "bash", "Identifier": { "PURL": "pkg:deb/debian/bash@5.2.37-2%2Bb10?arch=amd64\u0026distro=debian-13.6", "UID": "805a46f48d4c8a9e" }, "Version": "5.2.37", "Release": "2+b10", "Arch": "amd64", "SrcName": "bash", "SrcVersion": "5.2.37", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-3+ with Bison exception", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only", "Latex2e", "BSD-4-Clause-UC", "MIT", "permissive" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "base-files@13.8+deb13u6", "debianutils@5.23.2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/bin/bash", "/usr/bin/bashbug", "/usr/bin/clear_console", "/usr/share/debianutils/shells.d/bash", "/usr/share/doc/bash/CHANGES.gz", "/usr/share/doc/bash/COMPAT.gz", "/usr/share/doc/bash/INTRO.gz", "/usr/share/doc/bash/NEWS.gz", "/usr/share/doc/bash/POSIX.gz", "/usr/share/doc/bash/RBASH", "/usr/share/doc/bash/README.Debian.gz", "/usr/share/doc/bash/README.abs-guide", "/usr/share/doc/bash/README.commands.gz", "/usr/share/doc/bash/README.gz", "/usr/share/doc/bash/changelog.Debian.amd64.gz", "/usr/share/doc/bash/changelog.Debian.gz", "/usr/share/doc/bash/changelog.gz", "/usr/share/doc/bash/copyright", "/usr/share/doc/bash/inputrc.arrows", "/usr/share/lintian/overrides/bash", "/usr/share/locale/af/LC_MESSAGES/bash.mo", "/usr/share/locale/bg/LC_MESSAGES/bash.mo", "/usr/share/locale/ca/LC_MESSAGES/bash.mo", "/usr/share/locale/cs/LC_MESSAGES/bash.mo", "/usr/share/locale/da/LC_MESSAGES/bash.mo", "/usr/share/locale/de/LC_MESSAGES/bash.mo", "/usr/share/locale/el/LC_MESSAGES/bash.mo", "/usr/share/locale/en@boldquot/LC_MESSAGES/bash.mo", "/usr/share/locale/en@quot/LC_MESSAGES/bash.mo", "/usr/share/locale/eo/LC_MESSAGES/bash.mo", "/usr/share/locale/es/LC_MESSAGES/bash.mo", "/usr/share/locale/et/LC_MESSAGES/bash.mo", "/usr/share/locale/fi/LC_MESSAGES/bash.mo", "/usr/share/locale/fr/LC_MESSAGES/bash.mo", "/usr/share/locale/ga/LC_MESSAGES/bash.mo", "/usr/share/locale/gl/LC_MESSAGES/bash.mo", "/usr/share/locale/hr/LC_MESSAGES/bash.mo", "/usr/share/locale/hu/LC_MESSAGES/bash.mo", "/usr/share/locale/id/LC_MESSAGES/bash.mo", "/usr/share/locale/it/LC_MESSAGES/bash.mo", "/usr/share/locale/ja/LC_MESSAGES/bash.mo", "/usr/share/locale/ko/LC_MESSAGES/bash.mo", "/usr/share/locale/lt/LC_MESSAGES/bash.mo", "/usr/share/locale/nb/LC_MESSAGES/bash.mo", "/usr/share/locale/nl/LC_MESSAGES/bash.mo", "/usr/share/locale/pl/LC_MESSAGES/bash.mo", "/usr/share/locale/pt/LC_MESSAGES/bash.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/bash.mo", "/usr/share/locale/ro/LC_MESSAGES/bash.mo", "/usr/share/locale/ru/LC_MESSAGES/bash.mo", "/usr/share/locale/sk/LC_MESSAGES/bash.mo", "/usr/share/locale/sl/LC_MESSAGES/bash.mo", "/usr/share/locale/sr/LC_MESSAGES/bash.mo", "/usr/share/locale/sv/LC_MESSAGES/bash.mo", "/usr/share/locale/tr/LC_MESSAGES/bash.mo", "/usr/share/locale/uk/LC_MESSAGES/bash.mo", "/usr/share/locale/vi/LC_MESSAGES/bash.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/bash.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/bash.mo", "/usr/share/man/man1/bash.1.gz", "/usr/share/man/man1/bashbug.1.gz", "/usr/share/man/man1/clear_console.1.gz", "/usr/share/man/man1/rbash.1.gz", "/usr/share/man/man7/bash-builtins.7.gz", "/usr/share/menu/bash" ], "AnalyzedBy": "dpkg" }, { "ID": "bsdutils@1:2.41.5-0+deb13u1", "Name": "bsdutils", "Identifier": { "PURL": "pkg:deb/debian/bsdutils@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "a4b47561565a3535" }, "Version": "2.41.5", "Release": "0+deb13u1", "Epoch": 1, "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41.5", "SrcRelease": "0+deb13u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/logger", "/usr/bin/renice", "/usr/bin/script", "/usr/bin/scriptlive", "/usr/bin/scriptreplay", "/usr/bin/wall", "/usr/share/bash-completion/completions/logger", "/usr/share/bash-completion/completions/renice", "/usr/share/bash-completion/completions/script", "/usr/share/bash-completion/completions/scriptlive", "/usr/share/bash-completion/completions/scriptreplay", "/usr/share/bash-completion/completions/wall", "/usr/share/doc/bsdutils/NEWS.Debian.gz", "/usr/share/doc/bsdutils/changelog.Debian.gz", "/usr/share/doc/bsdutils/changelog.gz", "/usr/share/doc/bsdutils/copyright", "/usr/share/lintian/overrides/bsdutils", "/usr/share/man/man1/logger.1.gz", "/usr/share/man/man1/renice.1.gz", "/usr/share/man/man1/script.1.gz", "/usr/share/man/man1/scriptlive.1.gz", "/usr/share/man/man1/scriptreplay.1.gz", "/usr/share/man/man1/wall.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ca-certificates@20250419", "Name": "ca-certificates", "Identifier": { "PURL": "pkg:deb/debian/ca-certificates@20250419?arch=all\u0026distro=debian-13.6", "UID": "7d49b711f66cb392" }, "Version": "20250419", "Arch": "all", "SrcName": "ca-certificates", "SrcVersion": "20250419", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "MPL-2.0" ], "Maintainer": "Julien Cristau \u003cjcristau@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "openssl@3.5.7-1~deb13u2" ], "Layer": { "DiffID": "sha256:4d43b7f98e4c38fd2d37f37f1bf9965d2c4018b01453d3b29d924653c3275f4b" }, "InstalledFiles": [ "/usr/sbin/update-ca-certificates", "/usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", "/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", "/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", "/usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", "/usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", "/usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", "/usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", "/usr/share/ca-certificates/mozilla/Baltimore_CyberTrust_Root.crt", "/usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", "/usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", "/usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", "/usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", "/usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", "/usr/share/ca-certificates/mozilla/Certigna.crt", "/usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_ECC_Root-01.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_ECC_Root-02.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_RSA_Root-01.crt", "/usr/share/ca-certificates/mozilla/CommScope_Public_Trust_RSA_Root-02.crt", "/usr/share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", "/usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", "/usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", "/usr/share/ca-certificates/mozilla/Entrust.net_Premium_2048_Secure_Server_CA.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/FIRMAPROFESIONAL_CA_ROOT-A_WEB.crt", "/usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", "/usr/share/ca-certificates/mozilla/GLOBALTRUST_2020.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R2.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", "/usr/share/ca-certificates/mozilla/Go_Daddy_Class_2_CA.crt", "/usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", "/usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", "/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", "/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", "/usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", "/usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", "/usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", "/usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Izenpe.com.crt", "/usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", "/usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", "/usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", "/usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", "/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", "/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", "/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", "/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", "/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", "/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", "/usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", "/usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", "/usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", "/usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", "/usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", "/usr/share/ca-certificates/mozilla/SecureSign_Root_CA12.crt", "/usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", "/usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", "/usr/share/ca-certificates/mozilla/SecureTrust_CA.crt", "/usr/share/ca-certificates/mozilla/Secure_Global_CA.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", "/usr/share/ca-certificates/mozilla/Starfield_Class_2_CA.crt", "/usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt", "/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", "/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", "/usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", "/usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", "/usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", "/usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", "/usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", "/usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt", "/usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", "/usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", "/usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P256_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P384_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", "/usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", "/usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", "/usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/XRamp_Global_CA_Root.crt", "/usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt", "/usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", "/usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", "/usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", "/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", "/usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", "/usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", "/usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", "/usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt", "/usr/share/doc/ca-certificates/README.Debian", "/usr/share/doc/ca-certificates/changelog.gz", "/usr/share/doc/ca-certificates/copyright", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/Makefile", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/README", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/ca-certificates-local.triggers", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/changelog", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/compat", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/control", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/copyright", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/postrm", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/rules", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/source/format", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/local/Local_Root_CA.crt", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/local/Makefile", "/usr/share/man/man8/update-ca-certificates.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "coreutils@9.7-3", "Name": "coreutils", "Identifier": { "PURL": "pkg:deb/debian/coreutils@9.7-3?arch=amd64\u0026distro=debian-13.6", "UID": "cb4a55f50bda2393" }, "Version": "9.7", "Release": "3", "Arch": "amd64", "SrcName": "coreutils", "SrcVersion": "9.7", "SrcRelease": "3", "Licenses": [ "GPL-3.0-or-later", "BSD-4-Clause-UC", "GPL-3.0-only", "ISC", "FSFULLR", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only" ], "Maintainer": "Michael Stone \u003cmstone@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/[", "/usr/bin/arch", "/usr/bin/b2sum", "/usr/bin/base32", "/usr/bin/base64", "/usr/bin/basename", "/usr/bin/basenc", "/usr/bin/cat", "/usr/bin/chcon", "/usr/bin/chgrp", "/usr/bin/chmod", "/usr/bin/chown", "/usr/bin/cksum", "/usr/bin/comm", "/usr/bin/cp", "/usr/bin/csplit", "/usr/bin/cut", "/usr/bin/date", "/usr/bin/dd", "/usr/bin/df", "/usr/bin/dir", "/usr/bin/dircolors", "/usr/bin/dirname", "/usr/bin/du", "/usr/bin/echo", "/usr/bin/env", "/usr/bin/expand", "/usr/bin/expr", "/usr/bin/factor", "/usr/bin/false", "/usr/bin/fmt", "/usr/bin/fold", "/usr/bin/groups", "/usr/bin/head", "/usr/bin/hostid", "/usr/bin/id", "/usr/bin/install", "/usr/bin/join", "/usr/bin/link", "/usr/bin/ln", "/usr/bin/logname", "/usr/bin/ls", "/usr/bin/md5sum", "/usr/bin/mkdir", "/usr/bin/mkfifo", "/usr/bin/mknod", "/usr/bin/mktemp", "/usr/bin/mv", "/usr/bin/nice", "/usr/bin/nl", "/usr/bin/nohup", "/usr/bin/nproc", "/usr/bin/numfmt", "/usr/bin/od", "/usr/bin/paste", "/usr/bin/pathchk", "/usr/bin/pinky", "/usr/bin/pr", "/usr/bin/printenv", "/usr/bin/printf", "/usr/bin/ptx", "/usr/bin/pwd", "/usr/bin/readlink", "/usr/bin/realpath", "/usr/bin/rm", "/usr/bin/rmdir", "/usr/bin/runcon", "/usr/bin/seq", "/usr/bin/sha1sum", "/usr/bin/sha224sum", "/usr/bin/sha256sum", "/usr/bin/sha384sum", "/usr/bin/sha512sum", "/usr/bin/shred", "/usr/bin/shuf", "/usr/bin/sleep", "/usr/bin/sort", "/usr/bin/split", "/usr/bin/stat", "/usr/bin/stdbuf", "/usr/bin/stty", "/usr/bin/sum", "/usr/bin/sync", "/usr/bin/tac", "/usr/bin/tail", "/usr/bin/tee", "/usr/bin/test", "/usr/bin/timeout", "/usr/bin/touch", "/usr/bin/tr", "/usr/bin/true", "/usr/bin/truncate", "/usr/bin/tsort", "/usr/bin/tty", "/usr/bin/uname", "/usr/bin/unexpand", "/usr/bin/uniq", "/usr/bin/unlink", "/usr/bin/users", "/usr/bin/vdir", "/usr/bin/wc", "/usr/bin/who", "/usr/bin/whoami", "/usr/bin/yes", "/usr/libexec/coreutils/libstdbuf.so", "/usr/sbin/chroot", "/usr/share/doc/coreutils/AUTHORS", "/usr/share/doc/coreutils/NEWS.gz", "/usr/share/doc/coreutils/README.Debian", "/usr/share/doc/coreutils/README.gz", "/usr/share/doc/coreutils/THANKS.gz", "/usr/share/doc/coreutils/TODO.gz", "/usr/share/doc/coreutils/changelog.Debian.gz", "/usr/share/doc/coreutils/changelog.gz", "/usr/share/doc/coreutils/copyright", "/usr/share/info/coreutils.info.gz", "/usr/share/lintian/overrides/coreutils", "/usr/share/locale/af/LC_MESSAGES/coreutils.mo", "/usr/share/locale/be/LC_MESSAGES/coreutils.mo", "/usr/share/locale/bg/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ca/LC_MESSAGES/coreutils.mo", "/usr/share/locale/cs/LC_MESSAGES/coreutils.mo", "/usr/share/locale/da/LC_MESSAGES/coreutils.mo", "/usr/share/locale/de/LC_MESSAGES/coreutils.mo", "/usr/share/locale/el/LC_MESSAGES/coreutils.mo", "/usr/share/locale/eo/LC_MESSAGES/coreutils.mo", "/usr/share/locale/es/LC_MESSAGES/coreutils.mo", "/usr/share/locale/et/LC_MESSAGES/coreutils.mo", "/usr/share/locale/eu/LC_MESSAGES/coreutils.mo", "/usr/share/locale/fi/LC_MESSAGES/coreutils.mo", "/usr/share/locale/fr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ga/LC_MESSAGES/coreutils.mo", "/usr/share/locale/gl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/hr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/hu/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ia/LC_MESSAGES/coreutils.mo", "/usr/share/locale/id/LC_MESSAGES/coreutils.mo", "/usr/share/locale/it/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ja/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ka/LC_MESSAGES/coreutils.mo", "/usr/share/locale/kk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ko/LC_MESSAGES/coreutils.mo", "/usr/share/locale/lg/LC_MESSAGES/coreutils.mo", "/usr/share/locale/lt/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ms/LC_MESSAGES/coreutils.mo", "/usr/share/locale/nb/LC_MESSAGES/coreutils.mo", "/usr/share/locale/nl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pt/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ro/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ru/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sv/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ta/LC_MESSAGES/coreutils.mo", "/usr/share/locale/tr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/uk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/vi/LC_MESSAGES/coreutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/coreutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/coreutils.mo", "/usr/share/man/man1/arch.1.gz", "/usr/share/man/man1/b2sum.1.gz", "/usr/share/man/man1/base32.1.gz", "/usr/share/man/man1/base64.1.gz", "/usr/share/man/man1/basename.1.gz", "/usr/share/man/man1/basenc.1.gz", "/usr/share/man/man1/cat.1.gz", "/usr/share/man/man1/chcon.1.gz", "/usr/share/man/man1/chgrp.1.gz", "/usr/share/man/man1/chmod.1.gz", "/usr/share/man/man1/chown.1.gz", "/usr/share/man/man1/cksum.1.gz", "/usr/share/man/man1/comm.1.gz", "/usr/share/man/man1/cp.1.gz", "/usr/share/man/man1/csplit.1.gz", "/usr/share/man/man1/cut.1.gz", "/usr/share/man/man1/date.1.gz", "/usr/share/man/man1/dd.1.gz", "/usr/share/man/man1/df.1.gz", "/usr/share/man/man1/dir.1.gz", "/usr/share/man/man1/dircolors.1.gz", "/usr/share/man/man1/dirname.1.gz", "/usr/share/man/man1/du.1.gz", "/usr/share/man/man1/echo.1.gz", "/usr/share/man/man1/env.1.gz", "/usr/share/man/man1/expand.1.gz", "/usr/share/man/man1/expr.1.gz", "/usr/share/man/man1/factor.1.gz", "/usr/share/man/man1/false.1.gz", "/usr/share/man/man1/fmt.1.gz", "/usr/share/man/man1/fold.1.gz", "/usr/share/man/man1/groups.1.gz", "/usr/share/man/man1/head.1.gz", "/usr/share/man/man1/hostid.1.gz", "/usr/share/man/man1/id.1.gz", "/usr/share/man/man1/install.1.gz", "/usr/share/man/man1/join.1.gz", "/usr/share/man/man1/link.1.gz", "/usr/share/man/man1/ln.1.gz", "/usr/share/man/man1/logname.1.gz", "/usr/share/man/man1/ls.1.gz", "/usr/share/man/man1/md5sum.1.gz", "/usr/share/man/man1/mkdir.1.gz", "/usr/share/man/man1/mkfifo.1.gz", "/usr/share/man/man1/mknod.1.gz", "/usr/share/man/man1/mktemp.1.gz", "/usr/share/man/man1/mv.1.gz", "/usr/share/man/man1/nice.1.gz", "/usr/share/man/man1/nl.1.gz", "/usr/share/man/man1/nohup.1.gz", "/usr/share/man/man1/nproc.1.gz", "/usr/share/man/man1/numfmt.1.gz", "/usr/share/man/man1/od.1.gz", "/usr/share/man/man1/paste.1.gz", "/usr/share/man/man1/pathchk.1.gz", "/usr/share/man/man1/pinky.1.gz", "/usr/share/man/man1/pr.1.gz", "/usr/share/man/man1/printenv.1.gz", "/usr/share/man/man1/printf.1.gz", "/usr/share/man/man1/ptx.1.gz", "/usr/share/man/man1/pwd.1.gz", "/usr/share/man/man1/readlink.1.gz", "/usr/share/man/man1/realpath.1.gz", "/usr/share/man/man1/rm.1.gz", "/usr/share/man/man1/rmdir.1.gz", "/usr/share/man/man1/runcon.1.gz", "/usr/share/man/man1/seq.1.gz", "/usr/share/man/man1/sha1sum.1.gz", "/usr/share/man/man1/sha224sum.1.gz", "/usr/share/man/man1/sha256sum.1.gz", "/usr/share/man/man1/sha384sum.1.gz", "/usr/share/man/man1/sha512sum.1.gz", "/usr/share/man/man1/shred.1.gz", "/usr/share/man/man1/shuf.1.gz", "/usr/share/man/man1/sleep.1.gz", "/usr/share/man/man1/sort.1.gz", "/usr/share/man/man1/split.1.gz", "/usr/share/man/man1/stat.1.gz", "/usr/share/man/man1/stdbuf.1.gz", "/usr/share/man/man1/stty.1.gz", "/usr/share/man/man1/sum.1.gz", "/usr/share/man/man1/sync.1.gz", "/usr/share/man/man1/tac.1.gz", "/usr/share/man/man1/tail.1.gz", "/usr/share/man/man1/tee.1.gz", "/usr/share/man/man1/test.1.gz", "/usr/share/man/man1/timeout.1.gz", "/usr/share/man/man1/touch.1.gz", "/usr/share/man/man1/tr.1.gz", "/usr/share/man/man1/true.1.gz", "/usr/share/man/man1/truncate.1.gz", "/usr/share/man/man1/tsort.1.gz", "/usr/share/man/man1/tty.1.gz", "/usr/share/man/man1/uname.1.gz", "/usr/share/man/man1/unexpand.1.gz", "/usr/share/man/man1/uniq.1.gz", "/usr/share/man/man1/unlink.1.gz", "/usr/share/man/man1/users.1.gz", "/usr/share/man/man1/vdir.1.gz", "/usr/share/man/man1/wc.1.gz", "/usr/share/man/man1/who.1.gz", "/usr/share/man/man1/whoami.1.gz", "/usr/share/man/man1/yes.1.gz", "/usr/share/man/man8/chroot.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "curl@8.14.1-2+deb13u5", "Name": "curl", "Identifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "bdf93d017278ebe4" }, "Version": "8.14.1", "Release": "2+deb13u5", "Arch": "amd64", "SrcName": "curl", "SrcVersion": "8.14.1", "SrcRelease": "2+deb13u5", "Licenses": [ "curl", "OLDAP-2.8", "ISC", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "GPL-2+ with Libtool exception", "BSD-3-Clause", "BSD-4-Clause-UC", "FSFULLR", "X11", "GPL-2.0-only" ], "Maintainer": "Debian Curl Maintainers \u003cteam+curl@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcurl4t64@8.14.1-2+deb13u5", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/bin/curl", "/usr/bin/wcurl", "/usr/share/doc/curl/NEWS.Debian.gz", "/usr/share/doc/curl/README.Debian", "/usr/share/doc/curl/changelog.Debian.gz", "/usr/share/doc/curl/changelog.gz", "/usr/share/doc/curl/copyright", "/usr/share/fish/vendor_completions.d/curl.fish", "/usr/share/man/man1/curl.1.gz", "/usr/share/man/man1/wcurl.1.gz", "/usr/share/zsh/vendor-completions/_curl" ], "AnalyzedBy": "dpkg" }, { "ID": "dash@0.5.12-12", "Name": "dash", "Identifier": { "PURL": "pkg:deb/debian/dash@0.5.12-12?arch=amd64\u0026distro=debian-13.6", "UID": "4990b2098a2a3724" }, "Version": "0.5.12", "Release": "12", "Arch": "amd64", "SrcName": "dash", "SrcVersion": "0.5.12", "SrcRelease": "12", "Licenses": [ "BSD-3-Clause", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Andrej Shadura \u003candrewsh@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debianutils@5.23.2" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/dash", "/usr/share/debianutils/shells.d/dash", "/usr/share/doc/dash/README.Debian.diet", "/usr/share/doc/dash/README.source", "/usr/share/doc/dash/changelog.Debian.gz", "/usr/share/doc/dash/changelog.gz", "/usr/share/doc/dash/copyright", "/usr/share/lintian/overrides/dash", "/usr/share/man/man1/dash.1.gz", "/usr/share/menu/dash" ], "AnalyzedBy": "dpkg" }, { "ID": "debconf@1.5.91", "Name": "debconf", "Identifier": { "PURL": "pkg:deb/debian/debconf@1.5.91?arch=all\u0026distro=debian-13.6", "UID": "f7c8b7ba83ed5cfe" }, "Version": "1.5.91", "Arch": "all", "SrcName": "debconf", "SrcVersion": "1.5.91", "Licenses": [ "BSD-2-Clause" ], "Maintainer": "Debconf Developers \u003cdebconf-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/debconf", "/usr/bin/debconf-apt-progress", "/usr/bin/debconf-communicate", "/usr/bin/debconf-copydb", "/usr/bin/debconf-escape", "/usr/bin/debconf-set-selections", "/usr/bin/debconf-show", "/usr/sbin/dpkg-preconfigure", "/usr/sbin/dpkg-reconfigure", "/usr/share/bash-completion/completions/debconf", "/usr/share/debconf/confmodule", "/usr/share/debconf/confmodule.sh", "/usr/share/debconf/debconf.conf", "/usr/share/debconf/fix_db.pl", "/usr/share/debconf/frontend", "/usr/share/doc/debconf/README.Debian", "/usr/share/doc/debconf/changelog.gz", "/usr/share/doc/debconf/copyright", "/usr/share/lintian/overrides/debconf", "/usr/share/man/man1/debconf-apt-progress.1.gz", "/usr/share/man/man1/debconf-communicate.1.gz", "/usr/share/man/man1/debconf-copydb.1.gz", "/usr/share/man/man1/debconf-escape.1.gz", "/usr/share/man/man1/debconf-set-selections.1.gz", "/usr/share/man/man1/debconf-show.1.gz", "/usr/share/man/man1/debconf.1.gz", "/usr/share/man/man8/dpkg-preconfigure.8.gz", "/usr/share/man/man8/dpkg-reconfigure.8.gz", "/usr/share/perl5/Debconf/AutoSelect.pm", "/usr/share/perl5/Debconf/Base.pm", "/usr/share/perl5/Debconf/Client/ConfModule.pm", "/usr/share/perl5/Debconf/ConfModule.pm", "/usr/share/perl5/Debconf/Config.pm", "/usr/share/perl5/Debconf/Db.pm", "/usr/share/perl5/Debconf/DbDriver.pm", "/usr/share/perl5/Debconf/DbDriver/Backup.pm", "/usr/share/perl5/Debconf/DbDriver/Cache.pm", "/usr/share/perl5/Debconf/DbDriver/Copy.pm", "/usr/share/perl5/Debconf/DbDriver/Debug.pm", "/usr/share/perl5/Debconf/DbDriver/DirTree.pm", "/usr/share/perl5/Debconf/DbDriver/Directory.pm", "/usr/share/perl5/Debconf/DbDriver/File.pm", "/usr/share/perl5/Debconf/DbDriver/LDAP.pm", "/usr/share/perl5/Debconf/DbDriver/PackageDir.pm", "/usr/share/perl5/Debconf/DbDriver/Pipe.pm", "/usr/share/perl5/Debconf/DbDriver/Stack.pm", "/usr/share/perl5/Debconf/Element.pm", "/usr/share/perl5/Debconf/Element/Dialog/Boolean.pm", "/usr/share/perl5/Debconf/Element/Dialog/Error.pm", "/usr/share/perl5/Debconf/Element/Dialog/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Dialog/Note.pm", "/usr/share/perl5/Debconf/Element/Dialog/Password.pm", "/usr/share/perl5/Debconf/Element/Dialog/Progress.pm", "/usr/share/perl5/Debconf/Element/Dialog/Select.pm", "/usr/share/perl5/Debconf/Element/Dialog/String.pm", "/usr/share/perl5/Debconf/Element/Dialog/Text.pm", "/usr/share/perl5/Debconf/Element/Editor/Boolean.pm", "/usr/share/perl5/Debconf/Element/Editor/Error.pm", "/usr/share/perl5/Debconf/Element/Editor/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Editor/Note.pm", "/usr/share/perl5/Debconf/Element/Editor/Password.pm", "/usr/share/perl5/Debconf/Element/Editor/Progress.pm", "/usr/share/perl5/Debconf/Element/Editor/Select.pm", "/usr/share/perl5/Debconf/Element/Editor/String.pm", "/usr/share/perl5/Debconf/Element/Editor/Text.pm", "/usr/share/perl5/Debconf/Element/Gnome.pm", "/usr/share/perl5/Debconf/Element/Gnome/Boolean.pm", "/usr/share/perl5/Debconf/Element/Gnome/Error.pm", "/usr/share/perl5/Debconf/Element/Gnome/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Gnome/Note.pm", "/usr/share/perl5/Debconf/Element/Gnome/Password.pm", "/usr/share/perl5/Debconf/Element/Gnome/Progress.pm", "/usr/share/perl5/Debconf/Element/Gnome/Select.pm", "/usr/share/perl5/Debconf/Element/Gnome/String.pm", "/usr/share/perl5/Debconf/Element/Gnome/Text.pm", "/usr/share/perl5/Debconf/Element/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Noninteractive.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Boolean.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Error.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Note.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Password.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Progress.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Select.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/String.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Text.pm", "/usr/share/perl5/Debconf/Element/Select.pm", "/usr/share/perl5/Debconf/Element/Teletype/Boolean.pm", "/usr/share/perl5/Debconf/Element/Teletype/Error.pm", "/usr/share/perl5/Debconf/Element/Teletype/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Teletype/Note.pm", "/usr/share/perl5/Debconf/Element/Teletype/Password.pm", "/usr/share/perl5/Debconf/Element/Teletype/Progress.pm", "/usr/share/perl5/Debconf/Element/Teletype/Select.pm", "/usr/share/perl5/Debconf/Element/Teletype/String.pm", "/usr/share/perl5/Debconf/Element/Teletype/Text.pm", "/usr/share/perl5/Debconf/Element/Web/Boolean.pm", "/usr/share/perl5/Debconf/Element/Web/Error.pm", "/usr/share/perl5/Debconf/Element/Web/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Web/Note.pm", "/usr/share/perl5/Debconf/Element/Web/Password.pm", "/usr/share/perl5/Debconf/Element/Web/Progress.pm", "/usr/share/perl5/Debconf/Element/Web/Select.pm", "/usr/share/perl5/Debconf/Element/Web/String.pm", "/usr/share/perl5/Debconf/Element/Web/Text.pm", "/usr/share/perl5/Debconf/Encoding.pm", "/usr/share/perl5/Debconf/Format.pm", "/usr/share/perl5/Debconf/Format/822.pm", "/usr/share/perl5/Debconf/FrontEnd.pm", "/usr/share/perl5/Debconf/FrontEnd/Dialog.pm", "/usr/share/perl5/Debconf/FrontEnd/Editor.pm", "/usr/share/perl5/Debconf/FrontEnd/Gnome.pm", "/usr/share/perl5/Debconf/FrontEnd/Kde.pm", "/usr/share/perl5/Debconf/FrontEnd/Noninteractive.pm", "/usr/share/perl5/Debconf/FrontEnd/Passthrough.pm", "/usr/share/perl5/Debconf/FrontEnd/Readline.pm", "/usr/share/perl5/Debconf/FrontEnd/ScreenSize.pm", "/usr/share/perl5/Debconf/FrontEnd/Teletype.pm", "/usr/share/perl5/Debconf/FrontEnd/Text.pm", "/usr/share/perl5/Debconf/FrontEnd/Web.pm", "/usr/share/perl5/Debconf/Gettext.pm", "/usr/share/perl5/Debconf/Iterator.pm", "/usr/share/perl5/Debconf/Log.pm", "/usr/share/perl5/Debconf/Path.pm", "/usr/share/perl5/Debconf/Priority.pm", "/usr/share/perl5/Debconf/Question.pm", "/usr/share/perl5/Debconf/Template.pm", "/usr/share/perl5/Debconf/Template/Transient.pm", "/usr/share/perl5/Debconf/TmpFile.pm", "/usr/share/perl5/Debian/DebConf/Client/ConfModule.pm", "/usr/share/pixmaps/debian-logo.png" ], "AnalyzedBy": "dpkg" }, { "ID": "debian-archive-keyring@2025.1", "Name": "debian-archive-keyring", "Identifier": { "PURL": "pkg:deb/debian/debian-archive-keyring@2025.1?arch=all\u0026distro=debian-13.6", "UID": "a22d861380b1187c" }, "Version": "2025.1", "Arch": "all", "SrcName": "debian-archive-keyring", "SrcVersion": "2025.1", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian Release Team \u003cpackages@release.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/share/doc/debian-archive-keyring/NEWS.Debian.gz", "/usr/share/doc/debian-archive-keyring/README", "/usr/share/doc/debian-archive-keyring/changelog.gz", "/usr/share/doc/debian-archive-keyring/copyright", "/usr/share/keyrings/debian-archive-bookworm-automatic.pgp", "/usr/share/keyrings/debian-archive-bookworm-security-automatic.pgp", "/usr/share/keyrings/debian-archive-bookworm-stable.pgp", "/usr/share/keyrings/debian-archive-bullseye-automatic.pgp", "/usr/share/keyrings/debian-archive-bullseye-security-automatic.pgp", "/usr/share/keyrings/debian-archive-bullseye-stable.pgp", "/usr/share/keyrings/debian-archive-keyring.pgp", "/usr/share/keyrings/debian-archive-removed-keys.pgp", "/usr/share/keyrings/debian-archive-trixie-automatic.pgp", "/usr/share/keyrings/debian-archive-trixie-security-automatic.pgp", "/usr/share/keyrings/debian-archive-trixie-stable.pgp" ], "AnalyzedBy": "dpkg" }, { "ID": "debianutils@5.23.2", "Name": "debianutils", "Identifier": { "PURL": "pkg:deb/debian/debianutils@5.23.2?arch=amd64\u0026distro=debian-13.6", "UID": "3c5d0b66afafddbb" }, "Version": "5.23.2", "Arch": "amd64", "SrcName": "debianutils", "SrcVersion": "5.23.2", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "public-domain", "SMAIL-GPL" ], "Maintainer": "Ileana Dumitrescu \u003cileanadumitrescu95@gmail.com\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/ischroot", "/usr/bin/run-parts", "/usr/bin/savelog", "/usr/bin/tempfile", "/usr/bin/which.debianutils", "/usr/sbin/add-shell", "/usr/sbin/installkernel", "/usr/sbin/remove-shell", "/usr/sbin/update-shells", "/usr/share/debianutils/shells", "/usr/share/doc/debianutils/README.shells", "/usr/share/doc/debianutils/changelog.gz", "/usr/share/doc/debianutils/copyright", "/usr/share/man/de/man1/which.debianutils.1.gz", "/usr/share/man/de/man8/add-shell.8.gz", "/usr/share/man/de/man8/installkernel.8.gz", "/usr/share/man/de/man8/remove-shell.8.gz", "/usr/share/man/de/man8/run-parts.8.gz", "/usr/share/man/de/man8/savelog.8.gz", "/usr/share/man/es/man1/which.debianutils.1.gz", "/usr/share/man/es/man8/add-shell.8.gz", "/usr/share/man/es/man8/installkernel.8.gz", "/usr/share/man/es/man8/remove-shell.8.gz", "/usr/share/man/es/man8/run-parts.8.gz", "/usr/share/man/es/man8/savelog.8.gz", "/usr/share/man/fr/man1/which.debianutils.1.gz", "/usr/share/man/fr/man8/add-shell.8.gz", "/usr/share/man/fr/man8/installkernel.8.gz", "/usr/share/man/fr/man8/remove-shell.8.gz", "/usr/share/man/fr/man8/run-parts.8.gz", "/usr/share/man/fr/man8/savelog.8.gz", "/usr/share/man/it/man1/which.debianutils.1.gz", "/usr/share/man/it/man8/add-shell.8.gz", "/usr/share/man/it/man8/installkernel.8.gz", "/usr/share/man/it/man8/remove-shell.8.gz", "/usr/share/man/it/man8/run-parts.8.gz", "/usr/share/man/it/man8/savelog.8.gz", "/usr/share/man/ja/man1/which.debianutils.1.gz", "/usr/share/man/ja/man8/add-shell.8.gz", "/usr/share/man/ja/man8/installkernel.8.gz", "/usr/share/man/ja/man8/remove-shell.8.gz", "/usr/share/man/ja/man8/run-parts.8.gz", "/usr/share/man/ja/man8/savelog.8.gz", "/usr/share/man/man1/ischroot.1.gz", "/usr/share/man/man1/tempfile.1.gz", "/usr/share/man/man1/which.debianutils.1.gz", "/usr/share/man/man8/add-shell.8.gz", "/usr/share/man/man8/installkernel.8.gz", "/usr/share/man/man8/remove-shell.8.gz", "/usr/share/man/man8/run-parts.8.gz", "/usr/share/man/man8/savelog.8.gz", "/usr/share/man/man8/update-shells.8.gz", "/usr/share/man/pl/man1/which.debianutils.1.gz", "/usr/share/man/pl/man8/add-shell.8.gz", "/usr/share/man/pl/man8/installkernel.8.gz", "/usr/share/man/pl/man8/remove-shell.8.gz", "/usr/share/man/pl/man8/run-parts.8.gz", "/usr/share/man/pl/man8/savelog.8.gz", "/usr/share/man/pt/man1/which.debianutils.1.gz", "/usr/share/man/pt/man8/add-shell.8.gz", "/usr/share/man/pt/man8/installkernel.8.gz", "/usr/share/man/pt/man8/remove-shell.8.gz", "/usr/share/man/pt/man8/run-parts.8.gz", "/usr/share/man/pt/man8/savelog.8.gz", "/usr/share/man/sl/man1/which.debianutils.1.gz", "/usr/share/man/sl/man8/add-shell.8.gz", "/usr/share/man/sl/man8/installkernel.8.gz", "/usr/share/man/sl/man8/remove-shell.8.gz", "/usr/share/man/sl/man8/run-parts.8.gz", "/usr/share/man/sl/man8/savelog.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "diffutils@1:3.10-4", "Name": "diffutils", "Identifier": { "PURL": "pkg:deb/debian/diffutils@3.10-4?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "852f693a78aaa149" }, "Version": "3.10", "Release": "4", "Epoch": 1, "Arch": "amd64", "SrcName": "diffutils", "SrcVersion": "3.10", "SrcRelease": "4", "SrcEpoch": 1, "Licenses": [ "GPL-3.0-or-later", "FSFULLR", "LGPL-2.1-or-later", "GPL-3.0-with-autoconf-exception+", "GPL-3.0-only", "GPL-3+ with texinfo exception", "LGPL-2.0-or-later", "GPL-2.0-or-later", "X11", "FSFAP", "GFDL-1.3-no-invariants-only", "LGPL-3.0-or-later", "LGPL-3.0-only", "public-domain", "LGPL-2.0-only", "LGPL-2.1-only", "GPL-2.0-only", "GFDL-1.3-only" ], "Maintainer": "Santiago Vila \u003csanvila@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/cmp", "/usr/bin/diff", "/usr/bin/diff3", "/usr/bin/sdiff", "/usr/share/doc/diffutils/NEWS.gz", "/usr/share/doc/diffutils/changelog.Debian.gz", "/usr/share/doc/diffutils/changelog.gz", "/usr/share/doc/diffutils/copyright", "/usr/share/info/diffutils.info.gz", "/usr/share/locale/bg/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ca/LC_MESSAGES/diffutils.mo", "/usr/share/locale/cs/LC_MESSAGES/diffutils.mo", "/usr/share/locale/da/LC_MESSAGES/diffutils.mo", "/usr/share/locale/de/LC_MESSAGES/diffutils.mo", "/usr/share/locale/el/LC_MESSAGES/diffutils.mo", "/usr/share/locale/eo/LC_MESSAGES/diffutils.mo", "/usr/share/locale/es/LC_MESSAGES/diffutils.mo", "/usr/share/locale/fi/LC_MESSAGES/diffutils.mo", "/usr/share/locale/fr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ga/LC_MESSAGES/diffutils.mo", "/usr/share/locale/gl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/he/LC_MESSAGES/diffutils.mo", "/usr/share/locale/hr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/hu/LC_MESSAGES/diffutils.mo", "/usr/share/locale/id/LC_MESSAGES/diffutils.mo", "/usr/share/locale/it/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ja/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ka/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ko/LC_MESSAGES/diffutils.mo", "/usr/share/locale/lv/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ms/LC_MESSAGES/diffutils.mo", "/usr/share/locale/nb/LC_MESSAGES/diffutils.mo", "/usr/share/locale/nl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pt/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ro/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ru/LC_MESSAGES/diffutils.mo", "/usr/share/locale/sr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/sv/LC_MESSAGES/diffutils.mo", "/usr/share/locale/tr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/uk/LC_MESSAGES/diffutils.mo", "/usr/share/locale/vi/LC_MESSAGES/diffutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/diffutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/diffutils.mo", "/usr/share/man/man1/cmp.1.gz", "/usr/share/man/man1/diff.1.gz", "/usr/share/man/man1/diff3.1.gz", "/usr/share/man/man1/sdiff.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "dpkg@1.22.22", "Name": "dpkg", "Identifier": { "PURL": "pkg:deb/debian/dpkg@1.22.22?arch=amd64\u0026distro=debian-13.6", "UID": "7b97f27e3bec0417" }, "Version": "1.22.22", "Arch": "amd64", "SrcName": "dpkg", "SrcVersion": "1.22.22", "Licenses": [ "GPL-2.0-or-later", "public-domain-s-s-d", "GPL-2.0-only" ], "Maintainer": "Dpkg Developers \u003cdebian-dpkg@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "tar@1.35+dfsg-3.1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/dpkg", "/usr/bin/dpkg-deb", "/usr/bin/dpkg-divert", "/usr/bin/dpkg-maintscript-helper", "/usr/bin/dpkg-query", "/usr/bin/dpkg-realpath", "/usr/bin/dpkg-split", "/usr/bin/dpkg-statoverride", "/usr/bin/dpkg-trigger", "/usr/bin/update-alternatives", "/usr/lib/systemd/system/dpkg-db-backup.service", "/usr/lib/systemd/system/dpkg-db-backup.timer", "/usr/libexec/dpkg/dpkg-db-backup", "/usr/libexec/dpkg/dpkg-db-keeper", "/usr/sbin/start-stop-daemon", "/usr/share/doc/dpkg/AUTHORS", "/usr/share/doc/dpkg/README.api", "/usr/share/doc/dpkg/README.bug-usertags.gz", "/usr/share/doc/dpkg/README.feature-removal-schedule.gz", "/usr/share/doc/dpkg/THANKS.gz", "/usr/share/doc/dpkg/changelog.gz", "/usr/share/doc/dpkg/copyright", "/usr/share/dpkg/abitable", "/usr/share/dpkg/cputable", "/usr/share/dpkg/ostable", "/usr/share/dpkg/sh/dpkg-error.sh", "/usr/share/dpkg/tupletable", "/usr/share/lintian/overrides/dpkg", "/usr/share/lintian/profiles/dpkg/main.profile", "/usr/share/locale/ast/LC_MESSAGES/dpkg.mo", "/usr/share/locale/bs/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ca/LC_MESSAGES/dpkg.mo", "/usr/share/locale/cs/LC_MESSAGES/dpkg.mo", "/usr/share/locale/da/LC_MESSAGES/dpkg.mo", "/usr/share/locale/de/LC_MESSAGES/dpkg.mo", "/usr/share/locale/dz/LC_MESSAGES/dpkg.mo", "/usr/share/locale/el/LC_MESSAGES/dpkg.mo", "/usr/share/locale/eo/LC_MESSAGES/dpkg.mo", "/usr/share/locale/es/LC_MESSAGES/dpkg.mo", "/usr/share/locale/et/LC_MESSAGES/dpkg.mo", "/usr/share/locale/eu/LC_MESSAGES/dpkg.mo", "/usr/share/locale/fr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/gl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/hu/LC_MESSAGES/dpkg.mo", "/usr/share/locale/id/LC_MESSAGES/dpkg.mo", "/usr/share/locale/it/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ja/LC_MESSAGES/dpkg.mo", "/usr/share/locale/km/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ko/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ku/LC_MESSAGES/dpkg.mo", "/usr/share/locale/lt/LC_MESSAGES/dpkg.mo", "/usr/share/locale/mr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nb/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ne/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nn/LC_MESSAGES/dpkg.mo", "/usr/share/locale/oc/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pa/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pt/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ro/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ru/LC_MESSAGES/dpkg.mo", "/usr/share/locale/sk/LC_MESSAGES/dpkg.mo", "/usr/share/locale/sv/LC_MESSAGES/dpkg.mo", "/usr/share/locale/th/LC_MESSAGES/dpkg.mo", "/usr/share/locale/tl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/tr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/vi/LC_MESSAGES/dpkg.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/dpkg.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/dpkg.mo", "/usr/share/man/de/man1/dpkg-deb.1.gz", "/usr/share/man/de/man1/dpkg-divert.1.gz", "/usr/share/man/de/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/de/man1/dpkg-query.1.gz", "/usr/share/man/de/man1/dpkg-realpath.1.gz", "/usr/share/man/de/man1/dpkg-split.1.gz", "/usr/share/man/de/man1/dpkg-statoverride.1.gz", "/usr/share/man/de/man1/dpkg-trigger.1.gz", "/usr/share/man/de/man1/dpkg.1.gz", "/usr/share/man/de/man1/update-alternatives.1.gz", "/usr/share/man/de/man5/dpkg.cfg.5.gz", "/usr/share/man/de/man8/start-stop-daemon.8.gz", "/usr/share/man/es/man5/dpkg.cfg.5.gz", "/usr/share/man/fr/man1/dpkg-divert.1.gz", "/usr/share/man/fr/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/fr/man1/dpkg-query.1.gz", "/usr/share/man/fr/man1/dpkg-realpath.1.gz", "/usr/share/man/fr/man1/dpkg-split.1.gz", "/usr/share/man/fr/man1/dpkg-trigger.1.gz", "/usr/share/man/fr/man1/update-alternatives.1.gz", "/usr/share/man/fr/man5/dpkg.cfg.5.gz", "/usr/share/man/fr/man8/start-stop-daemon.8.gz", "/usr/share/man/it/man5/dpkg.cfg.5.gz", "/usr/share/man/ja/man5/dpkg.cfg.5.gz", "/usr/share/man/man1/dpkg-deb.1.gz", "/usr/share/man/man1/dpkg-divert.1.gz", "/usr/share/man/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/man1/dpkg-query.1.gz", "/usr/share/man/man1/dpkg-realpath.1.gz", "/usr/share/man/man1/dpkg-split.1.gz", "/usr/share/man/man1/dpkg-statoverride.1.gz", "/usr/share/man/man1/dpkg-trigger.1.gz", "/usr/share/man/man1/dpkg.1.gz", "/usr/share/man/man1/update-alternatives.1.gz", "/usr/share/man/man5/dpkg.cfg.5.gz", "/usr/share/man/man8/start-stop-daemon.8.gz", "/usr/share/man/nl/man1/dpkg-deb.1.gz", "/usr/share/man/nl/man1/dpkg-divert.1.gz", "/usr/share/man/nl/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/nl/man1/dpkg-query.1.gz", "/usr/share/man/nl/man1/dpkg-realpath.1.gz", "/usr/share/man/nl/man1/dpkg-split.1.gz", "/usr/share/man/nl/man1/dpkg-statoverride.1.gz", "/usr/share/man/nl/man1/dpkg-trigger.1.gz", "/usr/share/man/nl/man1/dpkg.1.gz", "/usr/share/man/nl/man1/update-alternatives.1.gz", "/usr/share/man/nl/man5/dpkg.cfg.5.gz", "/usr/share/man/nl/man8/start-stop-daemon.8.gz", "/usr/share/man/pl/man5/dpkg.cfg.5.gz", "/usr/share/man/pt/man1/dpkg-deb.1.gz", "/usr/share/man/pt/man1/dpkg-divert.1.gz", "/usr/share/man/pt/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/pt/man1/dpkg-query.1.gz", "/usr/share/man/pt/man1/dpkg-realpath.1.gz", "/usr/share/man/pt/man1/dpkg-split.1.gz", "/usr/share/man/pt/man1/dpkg-statoverride.1.gz", "/usr/share/man/pt/man1/dpkg-trigger.1.gz", "/usr/share/man/pt/man1/dpkg.1.gz", "/usr/share/man/pt/man1/update-alternatives.1.gz", "/usr/share/man/pt/man5/dpkg.cfg.5.gz", "/usr/share/man/pt/man8/start-stop-daemon.8.gz", "/usr/share/man/sv/man1/dpkg-deb.1.gz", "/usr/share/man/sv/man1/dpkg-divert.1.gz", "/usr/share/man/sv/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/sv/man1/dpkg-query.1.gz", "/usr/share/man/sv/man1/dpkg-realpath.1.gz", "/usr/share/man/sv/man1/dpkg-split.1.gz", "/usr/share/man/sv/man1/dpkg-statoverride.1.gz", "/usr/share/man/sv/man1/dpkg-trigger.1.gz", "/usr/share/man/sv/man1/dpkg.1.gz", "/usr/share/man/sv/man1/update-alternatives.1.gz", "/usr/share/man/sv/man5/dpkg.cfg.5.gz", "/usr/share/man/sv/man8/start-stop-daemon.8.gz", "/usr/share/polkit-1/actions/org.dpkg.pkexec.update-alternatives.policy" ], "AnalyzedBy": "dpkg" }, { "ID": "ffmpeg@7:7.1.5-0+deb13u1", "Name": "ffmpeg", "Identifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "Version": "7.1.5", "Release": "0+deb13u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "7.1.5", "SrcRelease": "0+deb13u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavcodec61@7:7.1.5-0+deb13u1", "libavdevice61@7:7.1.5-0+deb13u1", "libavfilter10@7:7.1.5-0+deb13u1", "libavformat61@7:7.1.5-0+deb13u1", "libavutil59@7:7.1.5-0+deb13u1", "libc6@2.41-12+deb13u3", "libplacebo349@7.349.0-3", "libpostproc58@7:7.1.5-0+deb13u1", "libsdl2-2.0-0@2.32.4+dfsg-1", "libswresample5@7:7.1.5-0+deb13u1", "libswscale8@7:7.1.5-0+deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/bin/ffmpeg", "/usr/bin/ffplay", "/usr/bin/ffprobe", "/usr/bin/qt-faststart", "/usr/share/doc/ffmpeg/README.Debian", "/usr/share/doc/ffmpeg/RELEASE_NOTES", "/usr/share/doc/ffmpeg/TODO.Debian", "/usr/share/doc/ffmpeg/changelog.Debian.gz", "/usr/share/doc/ffmpeg/changelog.gz", "/usr/share/doc/ffmpeg/copyright", "/usr/share/ffmpeg/ffprobe.xsd", "/usr/share/ffmpeg/libvpx-1080p.ffpreset", "/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset", "/usr/share/ffmpeg/libvpx-360p.ffpreset", "/usr/share/ffmpeg/libvpx-720p.ffpreset", "/usr/share/ffmpeg/libvpx-720p50_60.ffpreset", "/usr/share/lintian/overrides/ffmpeg", "/usr/share/man/man1/ffmpeg-all.1.gz", "/usr/share/man/man1/ffmpeg-bitstream-filters.1.gz", "/usr/share/man/man1/ffmpeg-codecs.1.gz", "/usr/share/man/man1/ffmpeg-devices.1.gz", "/usr/share/man/man1/ffmpeg-filters.1.gz", "/usr/share/man/man1/ffmpeg-formats.1.gz", "/usr/share/man/man1/ffmpeg-protocols.1.gz", "/usr/share/man/man1/ffmpeg-resampler.1.gz", "/usr/share/man/man1/ffmpeg-scaler.1.gz", "/usr/share/man/man1/ffmpeg-utils.1.gz", "/usr/share/man/man1/ffmpeg.1.gz", "/usr/share/man/man1/ffplay-all.1.gz", "/usr/share/man/man1/ffplay.1.gz", "/usr/share/man/man1/ffprobe-all.1.gz", "/usr/share/man/man1/ffprobe.1.gz", "/usr/share/man/man1/qt-faststart.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "findutils@4.10.0-3", "Name": "findutils", "Identifier": { "PURL": "pkg:deb/debian/findutils@4.10.0-3?arch=amd64\u0026distro=debian-13.6", "UID": "12e741692291b42a" }, "Version": "4.10.0", "Release": "3", "Arch": "amd64", "SrcName": "findutils", "SrcVersion": "4.10.0", "SrcRelease": "3", "Licenses": [ "GFDL-1.3-no-invariants-or-later", "GPL-3.0-or-later", "FSFAP", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "FSFULLR", "GPL-2.0-or-later", "X11", "public-domain", "LGPL-2.1-or-later", "GPL with automake exception", "LGPL-2.0-or-later", "LGPL-3.0-or-later", "BSD-3-Clause", "GPL-3+ with Bison-2.2 exception", "LGPL-3.0-only", "ISC", "GFDL-1.3-only", "GPL-2.0-only", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Andreas Metzler \u003cametzler@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/find", "/usr/bin/xargs", "/usr/share/doc-base/findutils.findutils", "/usr/share/doc/findutils/NEWS.gz", "/usr/share/doc/findutils/README.gz", "/usr/share/doc/findutils/TODO", "/usr/share/doc/findutils/changelog.Debian.gz", "/usr/share/doc/findutils/changelog.gz", "/usr/share/doc/findutils/copyright", "/usr/share/info/find-maint.info.gz", "/usr/share/info/find.info.gz", "/usr/share/locale/be/LC_MESSAGES/findutils.mo", "/usr/share/locale/bg/LC_MESSAGES/findutils.mo", "/usr/share/locale/ca/LC_MESSAGES/findutils.mo", "/usr/share/locale/cs/LC_MESSAGES/findutils.mo", "/usr/share/locale/da/LC_MESSAGES/findutils.mo", "/usr/share/locale/de/LC_MESSAGES/findutils.mo", "/usr/share/locale/el/LC_MESSAGES/findutils.mo", "/usr/share/locale/eo/LC_MESSAGES/findutils.mo", "/usr/share/locale/es/LC_MESSAGES/findutils.mo", "/usr/share/locale/et/LC_MESSAGES/findutils.mo", "/usr/share/locale/fi/LC_MESSAGES/findutils.mo", "/usr/share/locale/fr/LC_MESSAGES/findutils.mo", "/usr/share/locale/ga/LC_MESSAGES/findutils.mo", "/usr/share/locale/gl/LC_MESSAGES/findutils.mo", "/usr/share/locale/hr/LC_MESSAGES/findutils.mo", "/usr/share/locale/hu/LC_MESSAGES/findutils.mo", "/usr/share/locale/id/LC_MESSAGES/findutils.mo", "/usr/share/locale/it/LC_MESSAGES/findutils.mo", "/usr/share/locale/ja/LC_MESSAGES/findutils.mo", "/usr/share/locale/ka/LC_MESSAGES/findutils.mo", "/usr/share/locale/ko/LC_MESSAGES/findutils.mo", "/usr/share/locale/lg/LC_MESSAGES/findutils.mo", "/usr/share/locale/lt/LC_MESSAGES/findutils.mo", "/usr/share/locale/ms/LC_MESSAGES/findutils.mo", "/usr/share/locale/nb/LC_MESSAGES/findutils.mo", "/usr/share/locale/nl/LC_MESSAGES/findutils.mo", "/usr/share/locale/pl/LC_MESSAGES/findutils.mo", "/usr/share/locale/pt/LC_MESSAGES/findutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/findutils.mo", "/usr/share/locale/ro/LC_MESSAGES/findutils.mo", "/usr/share/locale/ru/LC_MESSAGES/findutils.mo", "/usr/share/locale/sk/LC_MESSAGES/findutils.mo", "/usr/share/locale/sl/LC_MESSAGES/findutils.mo", "/usr/share/locale/sr/LC_MESSAGES/findutils.mo", "/usr/share/locale/sv/LC_MESSAGES/findutils.mo", "/usr/share/locale/tr/LC_MESSAGES/findutils.mo", "/usr/share/locale/uk/LC_MESSAGES/findutils.mo", "/usr/share/locale/vi/LC_MESSAGES/findutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/findutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/findutils.mo", "/usr/share/man/man1/find.1.gz", "/usr/share/man/man1/xargs.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "fontconfig@2.15.0-2.3", "Name": "fontconfig", "Identifier": { "PURL": "pkg:deb/debian/fontconfig@2.15.0-2.3?arch=amd64\u0026distro=debian-13.6", "UID": "488e450ac6e1b8ed" }, "Version": "2.15.0", "Release": "2.3", "Arch": "amd64", "SrcName": "fontconfig", "SrcVersion": "2.15.0", "SrcRelease": "2.3", "Maintainer": "Debian freedesktop.org maintainers \u003cpkg-freedesktop-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "fontconfig-config@2.15.0-2.3", "libc6@2.41-12+deb13u3", "libfontconfig1@2.15.0-2.3", "libfreetype6@2.13.3+dfsg-1+deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/bin/fc-cache", "/usr/bin/fc-cat", "/usr/bin/fc-conflist", "/usr/bin/fc-list", "/usr/bin/fc-match", "/usr/bin/fc-pattern", "/usr/bin/fc-query", "/usr/bin/fc-scan", "/usr/bin/fc-validate", "/usr/share/doc-base/fontconfig.fontconfig-user", "/usr/share/doc/fontconfig/README.Debian", "/usr/share/doc/fontconfig/changelog.Debian.gz", "/usr/share/doc/fontconfig/changelog.gz", "/usr/share/doc/fontconfig/copyright", "/usr/share/doc/fontconfig/fontconfig-user.html", "/usr/share/doc/fontconfig/fontconfig-user.pdf.gz", "/usr/share/doc/fontconfig/fontconfig-user.txt.gz", "/usr/share/locale/ka/LC_MESSAGES/fontconfig-conf.mo", "/usr/share/locale/ka/LC_MESSAGES/fontconfig.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/fontconfig-conf.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/fontconfig.mo", "/usr/share/man/man1/fc-cache.1.gz", "/usr/share/man/man1/fc-cat.1.gz", "/usr/share/man/man1/fc-conflist.1.gz", "/usr/share/man/man1/fc-list.1.gz", "/usr/share/man/man1/fc-match.1.gz", "/usr/share/man/man1/fc-pattern.1.gz", "/usr/share/man/man1/fc-query.1.gz", "/usr/share/man/man1/fc-scan.1.gz", "/usr/share/man/man1/fc-validate.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "fontconfig-config@2.15.0-2.3", "Name": "fontconfig-config", "Identifier": { "PURL": "pkg:deb/debian/fontconfig-config@2.15.0-2.3?arch=amd64\u0026distro=debian-13.6", "UID": "2ebf9c6542eb6a41" }, "Version": "2.15.0", "Release": "2.3", "Arch": "amd64", "SrcName": "fontconfig", "SrcVersion": "2.15.0", "SrcRelease": "2.3", "Maintainer": "Debian freedesktop.org maintainers \u003cpkg-freedesktop-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "fonts-dejavu-core@2.37-8" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/doc/fontconfig-config/changelog.Debian.gz", "/usr/share/doc/fontconfig-config/changelog.gz", "/usr/share/doc/fontconfig-config/copyright", "/usr/share/fontconfig/conf.avail/05-reset-dirs-sample.conf", "/usr/share/fontconfig/conf.avail/09-autohint-if-no-hinting.conf", "/usr/share/fontconfig/conf.avail/10-autohint.conf", "/usr/share/fontconfig/conf.avail/10-hinting-full.conf", "/usr/share/fontconfig/conf.avail/10-hinting-medium.conf", "/usr/share/fontconfig/conf.avail/10-hinting-none.conf", "/usr/share/fontconfig/conf.avail/10-hinting-slight.conf", "/usr/share/fontconfig/conf.avail/10-no-antialias.conf", "/usr/share/fontconfig/conf.avail/10-scale-bitmap-fonts.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-bgr.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-none.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-rgb.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-vbgr.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-vrgb.conf", "/usr/share/fontconfig/conf.avail/10-unhinted.conf", "/usr/share/fontconfig/conf.avail/10-yes-antialias.conf", "/usr/share/fontconfig/conf.avail/11-lcdfilter-default.conf", "/usr/share/fontconfig/conf.avail/11-lcdfilter-legacy.conf", "/usr/share/fontconfig/conf.avail/11-lcdfilter-light.conf", "/usr/share/fontconfig/conf.avail/11-lcdfilter-none.conf", "/usr/share/fontconfig/conf.avail/20-unhint-small-vera.conf", "/usr/share/fontconfig/conf.avail/25-unhint-nonlatin.conf", "/usr/share/fontconfig/conf.avail/30-metric-aliases.conf", "/usr/share/fontconfig/conf.avail/35-lang-normalize.conf", "/usr/share/fontconfig/conf.avail/40-nonlatin.conf", "/usr/share/fontconfig/conf.avail/45-generic.conf", "/usr/share/fontconfig/conf.avail/45-latin.conf", "/usr/share/fontconfig/conf.avail/48-spacing.conf", "/usr/share/fontconfig/conf.avail/49-sansserif.conf", "/usr/share/fontconfig/conf.avail/50-user.conf", "/usr/share/fontconfig/conf.avail/51-local.conf", "/usr/share/fontconfig/conf.avail/60-generic.conf", "/usr/share/fontconfig/conf.avail/60-latin.conf", "/usr/share/fontconfig/conf.avail/65-fonts-persian.conf", "/usr/share/fontconfig/conf.avail/65-khmer.conf", "/usr/share/fontconfig/conf.avail/65-nonlatin.conf", "/usr/share/fontconfig/conf.avail/69-unifont.conf", "/usr/share/fontconfig/conf.avail/70-force-bitmaps.conf", "/usr/share/fontconfig/conf.avail/70-no-bitmaps-and-emoji.conf", "/usr/share/fontconfig/conf.avail/70-no-bitmaps-except-emoji.conf", "/usr/share/fontconfig/conf.avail/70-no-bitmaps.conf", "/usr/share/fontconfig/conf.avail/70-yes-bitmaps.conf", "/usr/share/fontconfig/conf.avail/80-delicious.conf", "/usr/share/fontconfig/conf.avail/90-synthetic.conf", "/usr/share/man/man5/fonts-conf.5.gz", "/usr/share/xml/fontconfig/fonts.dtd" ], "AnalyzedBy": "dpkg" }, { "ID": "fonts-dejavu-core@2.37-8", "Name": "fonts-dejavu-core", "Identifier": { "PURL": "pkg:deb/debian/fonts-dejavu-core@2.37-8?arch=all\u0026distro=debian-13.6", "UID": "49b3e2770d03125d" }, "Version": "2.37", "Release": "8", "Arch": "all", "SrcName": "fonts-dejavu", "SrcVersion": "2.37", "SrcRelease": "8", "Licenses": [ "Bitstream-Vera", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Fonts Task Force \u003cdebian-fonts@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "fonts-dejavu-mono@2.37-8" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/doc/fonts-dejavu-core/AUTHORS", "/usr/share/doc/fonts-dejavu-core/BUGS", "/usr/share/doc/fonts-dejavu-core/README.md", "/usr/share/doc/fonts-dejavu-core/changelog.Debian.gz", "/usr/share/doc/fonts-dejavu-core/changelog.gz", "/usr/share/doc/fonts-dejavu-core/copyright", "/usr/share/doc/fonts-dejavu-core/langcover.txt.gz", "/usr/share/doc/fonts-dejavu-core/status.txt.gz", "/usr/share/doc/fonts-dejavu-core/unicover.txt.gz", "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf", "/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf", "/usr/share/fonts/truetype/dejavu/DejaVuSerif-Bold.ttf", "/usr/share/fonts/truetype/dejavu/DejaVuSerif.ttf" ], "AnalyzedBy": "dpkg" }, { "ID": "fonts-dejavu-mono@2.37-8", "Name": "fonts-dejavu-mono", "Identifier": { "PURL": "pkg:deb/debian/fonts-dejavu-mono@2.37-8?arch=all\u0026distro=debian-13.6", "UID": "1ba9a619eb841c83" }, "Version": "2.37", "Release": "8", "Arch": "all", "SrcName": "fonts-dejavu", "SrcVersion": "2.37", "SrcRelease": "8", "Licenses": [ "Bitstream-Vera", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Fonts Task Force \u003cdebian-fonts@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/doc/fonts-dejavu-mono/AUTHORS", "/usr/share/doc/fonts-dejavu-mono/BUGS", "/usr/share/doc/fonts-dejavu-mono/README.md", "/usr/share/doc/fonts-dejavu-mono/changelog.Debian.gz", "/usr/share/doc/fonts-dejavu-mono/changelog.gz", "/usr/share/doc/fonts-dejavu-mono/copyright", "/usr/share/doc/fonts-dejavu-mono/langcover.txt.gz", "/usr/share/doc/fonts-dejavu-mono/status.txt.gz", "/usr/share/doc/fonts-dejavu-mono/unicover.txt.gz", "/usr/share/fonts/truetype/dejavu/DejaVuSansMono-Bold.ttf", "/usr/share/fonts/truetype/dejavu/DejaVuSansMono-BoldOblique.ttf", "/usr/share/fonts/truetype/dejavu/DejaVuSansMono-Oblique.ttf", "/usr/share/fonts/truetype/dejavu/DejaVuSansMono.ttf" ], "AnalyzedBy": "dpkg" }, { "ID": "gcc-14-base@14.2.0-19", "Name": "gcc-14-base", "Identifier": { "PURL": "pkg:deb/debian/gcc-14-base@14.2.0-19?arch=amd64\u0026distro=debian-13.6", "UID": "371c061d08215a1b" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Licenses": [ "GPL-2.0-or-later", "GPL-3.0-only", "GFDL-1.2-only", "Artistic-2.0", "LGPL-2.0-or-later" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/share/doc/gcc-14-base/README.Debian.amd64.gz", "/usr/share/doc/gcc-14-base/TODO.Debian", "/usr/share/doc/gcc-14-base/changelog.Debian.gz", "/usr/share/doc/gcc-14-base/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "grep@3.11-4", "Name": "grep", "Identifier": { "PURL": "pkg:deb/debian/grep@3.11-4?arch=amd64\u0026distro=debian-13.6", "UID": "6ce8b4eed9c0d137" }, "Version": "3.11", "Release": "4", "Arch": "amd64", "SrcName": "grep", "SrcVersion": "3.11", "SrcRelease": "4", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/egrep", "/usr/bin/fgrep", "/usr/bin/grep", "/usr/bin/rgrep", "/usr/share/doc/grep/AUTHORS", "/usr/share/doc/grep/NEWS.Debian.gz", "/usr/share/doc/grep/NEWS.gz", "/usr/share/doc/grep/README", "/usr/share/doc/grep/THANKS.gz", "/usr/share/doc/grep/TODO.gz", "/usr/share/doc/grep/changelog.Debian.gz", "/usr/share/doc/grep/changelog.gz", "/usr/share/doc/grep/copyright", "/usr/share/info/grep.info.gz", "/usr/share/locale/af/LC_MESSAGES/grep.mo", "/usr/share/locale/be/LC_MESSAGES/grep.mo", "/usr/share/locale/bg/LC_MESSAGES/grep.mo", "/usr/share/locale/ca/LC_MESSAGES/grep.mo", "/usr/share/locale/cs/LC_MESSAGES/grep.mo", "/usr/share/locale/da/LC_MESSAGES/grep.mo", "/usr/share/locale/de/LC_MESSAGES/grep.mo", "/usr/share/locale/el/LC_MESSAGES/grep.mo", "/usr/share/locale/eo/LC_MESSAGES/grep.mo", "/usr/share/locale/es/LC_MESSAGES/grep.mo", "/usr/share/locale/et/LC_MESSAGES/grep.mo", "/usr/share/locale/eu/LC_MESSAGES/grep.mo", "/usr/share/locale/fi/LC_MESSAGES/grep.mo", "/usr/share/locale/fr/LC_MESSAGES/grep.mo", "/usr/share/locale/ga/LC_MESSAGES/grep.mo", "/usr/share/locale/gl/LC_MESSAGES/grep.mo", "/usr/share/locale/he/LC_MESSAGES/grep.mo", "/usr/share/locale/hr/LC_MESSAGES/grep.mo", "/usr/share/locale/hu/LC_MESSAGES/grep.mo", "/usr/share/locale/id/LC_MESSAGES/grep.mo", "/usr/share/locale/it/LC_MESSAGES/grep.mo", "/usr/share/locale/ja/LC_MESSAGES/grep.mo", "/usr/share/locale/ka/LC_MESSAGES/grep.mo", "/usr/share/locale/ko/LC_MESSAGES/grep.mo", "/usr/share/locale/ky/LC_MESSAGES/grep.mo", "/usr/share/locale/lt/LC_MESSAGES/grep.mo", "/usr/share/locale/nb/LC_MESSAGES/grep.mo", "/usr/share/locale/nl/LC_MESSAGES/grep.mo", "/usr/share/locale/pa/LC_MESSAGES/grep.mo", "/usr/share/locale/pl/LC_MESSAGES/grep.mo", "/usr/share/locale/pt/LC_MESSAGES/grep.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/grep.mo", "/usr/share/locale/ro/LC_MESSAGES/grep.mo", "/usr/share/locale/ru/LC_MESSAGES/grep.mo", "/usr/share/locale/sk/LC_MESSAGES/grep.mo", "/usr/share/locale/sl/LC_MESSAGES/grep.mo", "/usr/share/locale/sr/LC_MESSAGES/grep.mo", "/usr/share/locale/sv/LC_MESSAGES/grep.mo", "/usr/share/locale/ta/LC_MESSAGES/grep.mo", "/usr/share/locale/th/LC_MESSAGES/grep.mo", "/usr/share/locale/tr/LC_MESSAGES/grep.mo", "/usr/share/locale/uk/LC_MESSAGES/grep.mo", "/usr/share/locale/vi/LC_MESSAGES/grep.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/grep.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/grep.mo", "/usr/share/man/man1/grep.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gzip@1.13-1", "Name": "gzip", "Identifier": { "PURL": "pkg:deb/debian/gzip@1.13-1?arch=amd64\u0026distro=debian-13.6", "UID": "954545ce99bc687e" }, "Version": "1.13", "Release": "1", "Arch": "amd64", "SrcName": "gzip", "SrcVersion": "1.13", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "GFDL-1.3+-no-invariant", "FSF-manpages", "GPL-3.0-only", "GFDL-3" ], "Maintainer": "Milan Kupcevic \u003cmilan@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/gunzip", "/usr/bin/gzexe", "/usr/bin/gzip", "/usr/bin/zcat", "/usr/bin/zcmp", "/usr/bin/zdiff", "/usr/bin/zegrep", "/usr/bin/zfgrep", "/usr/bin/zforce", "/usr/bin/zgrep", "/usr/bin/zless", "/usr/bin/zmore", "/usr/bin/znew", "/usr/share/doc/gzip/NEWS.gz", "/usr/share/doc/gzip/README.gz", "/usr/share/doc/gzip/TODO", "/usr/share/doc/gzip/changelog.Debian.gz", "/usr/share/doc/gzip/changelog.gz", "/usr/share/doc/gzip/copyright", "/usr/share/info/gzip.info.gz", "/usr/share/man/man1/gzexe.1.gz", "/usr/share/man/man1/gzip.1.gz", "/usr/share/man/man1/zdiff.1.gz", "/usr/share/man/man1/zforce.1.gz", "/usr/share/man/man1/zgrep.1.gz", "/usr/share/man/man1/zless.1.gz", "/usr/share/man/man1/zmore.1.gz", "/usr/share/man/man1/znew.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "hostname@3.25", "Name": "hostname", "Identifier": { "PURL": "pkg:deb/debian/hostname@3.25?arch=amd64\u0026distro=debian-13.6", "UID": "641772722328aedf" }, "Version": "3.25", "Arch": "amd64", "SrcName": "hostname", "SrcVersion": "3.25", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Michael Meskes \u003cmeskes@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/hostname", "/usr/share/doc/hostname/changelog.gz", "/usr/share/doc/hostname/copyright", "/usr/share/man/man1/hostname.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "init-system-helpers@1.69~deb13u1", "Name": "init-system-helpers", "Identifier": { "PURL": "pkg:deb/debian/init-system-helpers@1.69~deb13u1?arch=all\u0026distro=debian-13.6", "UID": "cb52819ec2f1a236" }, "Version": "1.69~deb13u1", "Arch": "all", "SrcName": "init-system-helpers", "SrcVersion": "1.69~deb13u1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/deb-systemd-helper", "/usr/bin/deb-systemd-invoke", "/usr/sbin/invoke-rc.d", "/usr/sbin/service", "/usr/sbin/update-rc.d", "/usr/share/bug/init-system-helpers/control", "/usr/share/doc/init-system-helpers/README.invoke-rc.d.gz", "/usr/share/doc/init-system-helpers/README.policy-rc.d.gz", "/usr/share/doc/init-system-helpers/changelog.gz", "/usr/share/doc/init-system-helpers/copyright", "/usr/share/lintian/overrides/init-system-helpers", "/usr/share/man/man1/deb-systemd-helper.1p.gz", "/usr/share/man/man1/deb-systemd-invoke.1p.gz", "/usr/share/man/man8/invoke-rc.d.8.gz", "/usr/share/man/man8/service.8.gz", "/usr/share/man/man8/update-rc.d.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libacl1@2.3.2-2+b1", "Name": "libacl1", "Identifier": { "PURL": "pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "f9f7789d147b9636" }, "Version": "2.3.2", "Release": "2+b1", "Arch": "amd64", "SrcName": "acl", "SrcVersion": "2.3.2", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.1-only" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libacl.so.1.1.2302", "/usr/share/doc/libacl1/changelog.Debian.amd64.gz", "/usr/share/doc/libacl1/changelog.Debian.gz", "/usr/share/doc/libacl1/changelog.gz", "/usr/share/doc/libacl1/copyright", "/usr/share/lintian/overrides/libacl1" ], "AnalyzedBy": "dpkg" }, { "ID": "libaom3@3.12.1-1+deb13u1", "Name": "libaom3", "Identifier": { "PURL": "pkg:deb/debian/libaom3@3.12.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "24c7e585a2af0b80" }, "Version": "3.12.1", "Release": "1+deb13u1", "Arch": "amd64", "SrcName": "aom", "SrcVersion": "3.12.1", "SrcRelease": "1+deb13u1", "Licenses": [ "BSD-2-Clause", "public-domain-md5", "BSD-3-Clause", "ISC", "MIT" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libaom.so.3.12.1", "/usr/share/doc/libaom3/changelog.Debian.gz", "/usr/share/doc/libaom3/changelog.gz", "/usr/share/doc/libaom3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libapt-pkg7.0@3.0.3", "Name": "libapt-pkg7.0", "Identifier": { "PURL": "pkg:deb/debian/libapt-pkg7.0@3.0.3?arch=amd64\u0026distro=debian-13.6", "UID": "f84404f3bc23d874" }, "Version": "3.0.3", "Arch": "amd64", "SrcName": "apt", "SrcVersion": "3.0.3", "Licenses": [ "GPL-2.0-or-later", "curl", "BSD-3-Clause", "MIT", "GPL-2.0-only" ], "Maintainer": "APT Development Team \u003cdeity@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-6", "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "liblz4-1@1.10.0-4", "liblzma5@5.8.1-1+deb13u1", "libssl3t64@3.5.7-1~deb13u2", "libstdc++6@14.2.0-19", "libsystemd0@257.13-1~deb13u1", "libudev1@257.13-1~deb13u1", "libxxhash0@0.8.3-2", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libapt-pkg.so.7.0.0", "/usr/share/doc/libapt-pkg7.0/NEWS.Debian.gz", "/usr/share/doc/libapt-pkg7.0/changelog.gz", "/usr/share/doc/libapt-pkg7.0/copyright", "/usr/share/locale/ar/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ast/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/bg/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/bs/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ca/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/cs/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/cy/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/da/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/de/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/dz/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/el/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/es/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/eu/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/fi/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/fr/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/gl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/hu/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/it/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ja/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/km/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ko/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ku/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/lt/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/mr/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/nb/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ne/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/nl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/nn/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/pl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/pt/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ro/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/ru/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/sk/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/sl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/sv/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/th/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/tl/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/tr/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/uk/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/vi/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/libapt-pkg7.0.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/libapt-pkg7.0.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libasound2-data@1.2.14-1+deb13u1", "Name": "libasound2-data", "Identifier": { "PURL": "pkg:deb/debian/libasound2-data@1.2.14-1%2Bdeb13u1?arch=all\u0026distro=debian-13.6", "UID": "34e854edfb971425" }, "Version": "1.2.14", "Release": "1+deb13u1", "Arch": "all", "SrcName": "alsa-lib", "SrcVersion": "1.2.14", "SrcRelease": "1+deb13u1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only" ], "Maintainer": "Debian ALSA Maintainers \u003cpkg-alsa-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/alsa/alsa.conf", "/usr/share/alsa/cards/AACI.conf", "/usr/share/alsa/cards/ATIIXP-MODEM.conf", "/usr/share/alsa/cards/ATIIXP-SPDMA.conf", "/usr/share/alsa/cards/ATIIXP.conf", "/usr/share/alsa/cards/AU8810.conf", "/usr/share/alsa/cards/AU8820.conf", "/usr/share/alsa/cards/AU8830.conf", "/usr/share/alsa/cards/Audigy.conf", "/usr/share/alsa/cards/Audigy2.conf", "/usr/share/alsa/cards/Aureon51.conf", "/usr/share/alsa/cards/Aureon71.conf", "/usr/share/alsa/cards/CA0106.conf", "/usr/share/alsa/cards/CMI8338-SWIEC.conf", "/usr/share/alsa/cards/CMI8338.conf", "/usr/share/alsa/cards/CMI8738-MC6.conf", "/usr/share/alsa/cards/CMI8738-MC8.conf", "/usr/share/alsa/cards/CMI8788.conf", "/usr/share/alsa/cards/CS46xx.conf", "/usr/share/alsa/cards/EMU10K1.conf", "/usr/share/alsa/cards/EMU10K1X.conf", "/usr/share/alsa/cards/ENS1370.conf", "/usr/share/alsa/cards/ENS1371.conf", "/usr/share/alsa/cards/ES1968.conf", "/usr/share/alsa/cards/Echo_Echo3G.conf", "/usr/share/alsa/cards/FM801.conf", "/usr/share/alsa/cards/FWSpeakers.conf", "/usr/share/alsa/cards/FireWave.conf", "/usr/share/alsa/cards/GUS.conf", "/usr/share/alsa/cards/HDA-Intel.conf", "/usr/share/alsa/cards/HdmiLpeAudio.conf", "/usr/share/alsa/cards/ICE1712.conf", "/usr/share/alsa/cards/ICE1724.conf", "/usr/share/alsa/cards/ICH-MODEM.conf", "/usr/share/alsa/cards/ICH.conf", "/usr/share/alsa/cards/ICH4.conf", "/usr/share/alsa/cards/Loopback.conf", "/usr/share/alsa/cards/Maestro3.conf", "/usr/share/alsa/cards/NFORCE.conf", "/usr/share/alsa/cards/PC-Speaker.conf", "/usr/share/alsa/cards/PMac.conf", "/usr/share/alsa/cards/PMacToonie.conf", "/usr/share/alsa/cards/PS3.conf", "/usr/share/alsa/cards/RME9636.conf", "/usr/share/alsa/cards/RME9652.conf", "/usr/share/alsa/cards/SB-XFi.conf", "/usr/share/alsa/cards/SI7018.conf", "/usr/share/alsa/cards/TRID4DWAVENX.conf", "/usr/share/alsa/cards/USB-Audio.conf", "/usr/share/alsa/cards/VIA686A.conf", "/usr/share/alsa/cards/VIA8233.conf", "/usr/share/alsa/cards/VIA8233A.conf", "/usr/share/alsa/cards/VIA8237.conf", "/usr/share/alsa/cards/VX222.conf", "/usr/share/alsa/cards/VXPocket.conf", "/usr/share/alsa/cards/VXPocket440.conf", "/usr/share/alsa/cards/YMF744.conf", "/usr/share/alsa/cards/aliases.conf", "/usr/share/alsa/cards/pistachio-card.conf", "/usr/share/alsa/cards/vc4-hdmi.conf", "/usr/share/alsa/ctl/default.conf", "/usr/share/alsa/pcm/center_lfe.conf", "/usr/share/alsa/pcm/default.conf", "/usr/share/alsa/pcm/dmix.conf", "/usr/share/alsa/pcm/dpl.conf", "/usr/share/alsa/pcm/dsnoop.conf", "/usr/share/alsa/pcm/front.conf", "/usr/share/alsa/pcm/hdmi.conf", "/usr/share/alsa/pcm/iec958.conf", "/usr/share/alsa/pcm/modem.conf", "/usr/share/alsa/pcm/rear.conf", "/usr/share/alsa/pcm/side.conf", "/usr/share/alsa/pcm/surround21.conf", "/usr/share/alsa/pcm/surround40.conf", "/usr/share/alsa/pcm/surround41.conf", "/usr/share/alsa/pcm/surround50.conf", "/usr/share/alsa/pcm/surround51.conf", "/usr/share/alsa/pcm/surround71.conf", "/usr/share/doc/libasound2-data/changelog.Debian.gz", "/usr/share/doc/libasound2-data/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libasound2t64@1.2.14-1+deb13u1", "Name": "libasound2t64", "Identifier": { "PURL": "pkg:deb/debian/libasound2t64@1.2.14-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "675ef567dd6929d5" }, "Version": "1.2.14", "Release": "1+deb13u1", "Arch": "amd64", "SrcName": "alsa-lib", "SrcVersion": "1.2.14", "SrcRelease": "1+deb13u1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only" ], "Maintainer": "Debian ALSA Maintainers \u003cpkg-alsa-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasound2-data@1.2.14-1+deb13u1", "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libasound.so.2.0.0", "/usr/share/doc/libasound2t64/changelog.Debian.gz", "/usr/share/doc/libasound2t64/copyright", "/usr/share/doc/libasound2t64/examples/asoundrc.txt", "/usr/share/lintian/overrides/libasound2t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libass9@1:0.17.3-1+deb13u1", "Name": "libass9", "Identifier": { "PURL": "pkg:deb/debian/libass9@0.17.3-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "bb547f7b6b7efc9f" }, "Version": "0.17.3", "Release": "1+deb13u1", "Epoch": 1, "Arch": "amd64", "SrcName": "libass", "SrcVersion": "0.17.3", "SrcRelease": "1+deb13u1", "SrcEpoch": 1, "Licenses": [ "ISC", "NTP", "BSD-2-Clause", "Unlicense", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libfontconfig1@2.15.0-2.3", "libfreetype6@2.13.3+dfsg-1+deb13u1", "libfribidi0@1.0.16-1", "libharfbuzz0b@10.2.0-1+deb13u1", "libunibreak6@6.1-3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libass.so.9.3.1", "/usr/share/doc/libass9/changelog.Debian.gz", "/usr/share/doc/libass9/changelog.gz", "/usr/share/doc/libass9/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libasyncns0@0.8-6+b5", "Name": "libasyncns0", "Identifier": { "PURL": "pkg:deb/debian/libasyncns0@0.8-6%2Bb5?arch=amd64\u0026distro=debian-13.6", "UID": "7ac75d49dfaef36d" }, "Version": "0.8", "Release": "6+b5", "Arch": "amd64", "SrcName": "libasyncns", "SrcVersion": "0.8", "SrcRelease": "6", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only" ], "Maintainer": "Tanguy Ortolo \u003ctanguy+debian@ortolo.eu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libasyncns.so.0.3.1", "/usr/share/doc/libasyncns0/changelog.Debian.amd64.gz", "/usr/share/doc/libasyncns0/changelog.Debian.gz", "/usr/share/doc/libasyncns0/changelog.gz", "/usr/share/doc/libasyncns0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libatomic1@14.2.0-19", "Name": "libatomic1", "Identifier": { "PURL": "pkg:deb/debian/libatomic1@14.2.0-19?arch=amd64\u0026distro=debian-13.6", "UID": "3b3057bbe3ae5e7" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libatomic.so.1.2.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libattr1@1:2.5.2-3", "Name": "libattr1", "Identifier": { "PURL": "pkg:deb/debian/libattr1@2.5.2-3?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "90d554a582a8683b" }, "Version": "2.5.2", "Release": "3", "Epoch": 1, "Arch": "amd64", "SrcName": "attr", "SrcVersion": "2.5.2", "SrcRelease": "3", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.1-only" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libattr.so.1.1.2502", "/usr/share/doc/libattr1/changelog.Debian.gz", "/usr/share/doc/libattr1/changelog.gz", "/usr/share/doc/libattr1/copyright", "/usr/share/lintian/overrides/libattr1" ], "AnalyzedBy": "dpkg" }, { "ID": "libaudit-common@1:4.0.2-2", "Name": "libaudit-common", "Identifier": { "PURL": "pkg:deb/debian/libaudit-common@4.0.2-2?arch=all\u0026distro=debian-13.6\u0026epoch=1", "UID": "d20cd9a11d8e018d" }, "Version": "4.0.2", "Release": "2", "Epoch": 1, "Arch": "all", "SrcName": "audit", "SrcVersion": "4.0.2", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only", "GPL-1.0-only" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/share/doc/libaudit-common/changelog.Debian.gz", "/usr/share/doc/libaudit-common/changelog.gz", "/usr/share/doc/libaudit-common/copyright", "/usr/share/man/man5/libaudit.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libaudit1@1:4.0.2-2+b2", "Name": "libaudit1", "Identifier": { "PURL": "pkg:deb/debian/libaudit1@4.0.2-2%2Bb2?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "c47a55b8e27ace3c" }, "Version": "4.0.2", "Release": "2+b2", "Epoch": 1, "Arch": "amd64", "SrcName": "audit", "SrcVersion": "4.0.2", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only", "GPL-1.0-only" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit-common@1:4.0.2-2", "libc6@2.41-12+deb13u3", "libcap-ng0@0.8.5-4+b1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0", "/usr/share/doc/libaudit1/changelog.Debian.amd64.gz", "/usr/share/doc/libaudit1/changelog.Debian.gz", "/usr/share/doc/libaudit1/changelog.gz", "/usr/share/doc/libaudit1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libavc1394-0@0.5.4-5+b2", "Name": "libavc1394-0", "Identifier": { "PURL": "pkg:deb/debian/libavc1394-0@0.5.4-5%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "2babc219fcab51f5" }, "Version": "0.5.4", "Release": "5+b2", "Arch": "amd64", "SrcName": "libavc1394", "SrcVersion": "0.5.4", "SrcRelease": "5", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libraw1394-11@2.1.2-2+b2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavc1394.so.0.3.0", "/usr/lib/x86_64-linux-gnu/librom1394.so.0.3.0", "/usr/share/doc/libavc1394-0/changelog.Debian.amd64.gz", "/usr/share/doc/libavc1394-0/changelog.Debian.gz", "/usr/share/doc/libavc1394-0/changelog.gz", "/usr/share/doc/libavc1394-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libavcodec61@7:7.1.5-0+deb13u1", "Name": "libavcodec61", "Identifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "Version": "7.1.5", "Release": "0+deb13u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "7.1.5", "SrcRelease": "0+deb13u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaom3@3.12.1-1+deb13u1", "libavutil59@7:7.1.5-0+deb13u1", "libc6@2.41-12+deb13u3", "libcairo2@1.18.4-1+b1", "libcodec2-1.2@1.2.0-3", "libdav1d7@1.5.1-1", "libglib2.0-0t64@2.84.4-3~deb13u5", "libgsm1@1.0.22-1+b2", "libjxl0.11@0.11.2-0.1~deb13u2", "liblzma5@5.8.1-1+deb13u1", "libmp3lame0@3.100-6+b3", "libopenjp2-7@2.5.3-2.1~deb13u2", "libopus0@1.5.2-2", "librav1e0.7@0.7.1-9+b2", "librsvg2-2@2.60.0+dfsg-1", "libshine3@3.1.1-2+b2", "libsnappy1v5@1.2.2-1", "libspeex1@1.2.1-3", "libsvtav1enc2@2.3.0+dfsg-1", "libswresample5@7:7.1.5-0+deb13u1", "libtheoradec1@1.2.0~alpha1+dfsg-6", "libtheoraenc1@1.2.0~alpha1+dfsg-6", "libtwolame0@0.4.0-2+b2", "libva2@2.22.0-3", "libvorbis0a@1.3.7-3", "libvorbisenc2@1.3.7-3", "libvpl2@1:2.14.0-1+b1", "libvpx9@1.15.0-2.1+deb13u1", "libwebp7@1.5.0-0.1", "libwebpmux3@1.5.0-0.1", "libx264-164@2:0.164.3108+git31e19f9-2+b1", "libx265-215@4.1-2", "libxvidcore4@2:1.3.7-1+b2", "libzvbi0t64@0.2.44-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavcodec.so.61.19.101", "/usr/share/doc/libavcodec61/changelog.Debian.gz", "/usr/share/doc/libavcodec61/changelog.gz", "/usr/share/doc/libavcodec61/copyright", "/usr/share/lintian/overrides/libavcodec61" ], "AnalyzedBy": "dpkg" }, { "ID": "libavdevice61@7:7.1.5-0+deb13u1", "Name": "libavdevice61", "Identifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "Version": "7.1.5", "Release": "0+deb13u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "7.1.5", "SrcRelease": "0+deb13u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasound2t64@1.2.14-1+deb13u1", "libavc1394-0@0.5.4-5+b2", "libavcodec61@7:7.1.5-0+deb13u1", "libavfilter10@7:7.1.5-0+deb13u1", "libavformat61@7:7.1.5-0+deb13u1", "libavutil59@7:7.1.5-0+deb13u1", "libc6@2.41-12+deb13u3", "libcaca0@0.99.beta20-5+deb13u1", "libcdio-cdda2t64@10.2+2.0.2-1+b1", "libcdio-paranoia2t64@10.2+2.0.2-1+b1", "libdc1394-25@2.2.6-5", "libdrm2@2.4.124-2", "libgl1@1.7.0-1+b2", "libiec61883-0@1.2.0-7", "libjack-jackd2-0@1.9.22~dfsg-4", "libopenal1@1:1.24.2-1", "libpulse0@17.0+dfsg1-2+b1", "libraw1394-11@2.1.2-2+b2", "libsdl2-2.0-0@2.32.4+dfsg-1", "libx11-6@2:1.8.12-1", "libxcb-shape0@1.17.0-2+b1", "libxcb-shm0@1.17.0-2+b1", "libxcb-xfixes0@1.17.0-2+b1", "libxcb1@1.17.0-2+b1", "libxext6@2:1.3.4-1+b3", "libxv1@2:1.0.11-1.1+b3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavdevice.so.61.3.100", "/usr/share/doc/libavdevice61/changelog.Debian.gz", "/usr/share/doc/libavdevice61/changelog.gz", "/usr/share/doc/libavdevice61/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libavfilter10@7:7.1.5-0+deb13u1", "Name": "libavfilter10", "Identifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "Version": "7.1.5", "Release": "0+deb13u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "7.1.5", "SrcRelease": "0+deb13u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libass9@1:0.17.3-1+deb13u1", "libavcodec61@7:7.1.5-0+deb13u1", "libavformat61@7:7.1.5-0+deb13u1", "libavutil59@7:7.1.5-0+deb13u1", "libbs2b0@3.1.0+dfsg-8+b1", "libc6@2.41-12+deb13u3", "libflite1@2.2-7", "libfontconfig1@2.15.0-2.3", "libfreetype6@2.13.3+dfsg-1+deb13u1", "libfribidi0@1.0.16-1", "libharfbuzz0b@10.2.0-1+deb13u1", "liblilv-0-0@0.24.26-1", "libmysofa1@1.3.3+dfsg-1", "libplacebo349@7.349.0-3", "libpocketsphinx3@0.8+5prealpha+1-15+b4", "libpostproc58@7:7.1.5-0+deb13u1", "librubberband2@3.3.0+dfsg-2+b3", "libsphinxbase3t64@0.8+5prealpha+1-21+b1", "libstdc++6@14.2.0-19", "libswresample5@7:7.1.5-0+deb13u1", "libswscale8@7:7.1.5-0+deb13u1", "libva2@2.22.0-3", "libvidstab1.1@1.1.0-2+b2", "libvpl2@1:2.14.0-1+b1", "libzimg2@3.0.5+ds1-1+b2", "libzmq5@4.3.5-1+b3", "ocl-icd-libopencl1@2.3.3-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavfilter.so.10.5.100", "/usr/share/doc/libavfilter10/changelog.Debian.gz", "/usr/share/doc/libavfilter10/changelog.gz", "/usr/share/doc/libavfilter10/copyright", "/usr/share/lintian/overrides/libavfilter10" ], "AnalyzedBy": "dpkg" }, { "ID": "libavformat61@7:7.1.5-0+deb13u1", "Name": "libavformat61", "Identifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "Version": "7.1.5", "Release": "0+deb13u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "7.1.5", "SrcRelease": "0+deb13u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavcodec61@7:7.1.5-0+deb13u1", "libavutil59@7:7.1.5-0+deb13u1", "libbluray2@1:1.3.4-1+b2", "libbz2-1.0@1.0.8-6", "libc6@2.41-12+deb13u3", "libchromaprint1@1.5.1-7", "libdvdnav4@6.1.1-3+b1", "libdvdread8t64@6.1.3-2", "libgme0@0.6.3-7+b2", "libgnutls30t64@3.8.9-3+deb13u4", "libopenmpt0t64@0.7.13-1+b1", "librabbitmq4@0.15.0-1+deb13u2", "librist4@0.2.11+dfsg-1", "libsrt1.5-gnutls@1.5.4-1+deb13u1", "libssh-4@0.11.5-0+deb13u1", "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3", "libzmq5@4.3.5-1+b3", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavformat.so.61.7.103", "/usr/share/doc/libavformat61/changelog.Debian.gz", "/usr/share/doc/libavformat61/changelog.gz", "/usr/share/doc/libavformat61/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libavutil59@7:7.1.5-0+deb13u1", "Name": "libavutil59", "Identifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "Version": "7.1.5", "Release": "0+deb13u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "7.1.5", "SrcRelease": "0+deb13u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdrm2@2.4.124-2", "libva-drm2@2.22.0-3", "libva-x11-2@2.22.0-3", "libva2@2.22.0-3", "libvdpau1@1.5-3+b1", "libvpl2@1:2.14.0-1+b1", "libx11-6@2:1.8.12-1", "ocl-icd-libopencl1@2.3.3-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavutil.so.59.39.100", "/usr/share/doc/libavutil59/changelog.Debian.gz", "/usr/share/doc/libavutil59/changelog.gz", "/usr/share/doc/libavutil59/copyright", "/usr/share/lintian/overrides/libavutil59" ], "AnalyzedBy": "dpkg" }, { "ID": "libblas3@3.12.1-6", "Name": "libblas3", "Identifier": { "PURL": "pkg:deb/debian/libblas3@3.12.1-6?arch=amd64\u0026distro=debian-13.6", "UID": "a06b3a26eac12ed8" }, "Version": "3.12.1", "Release": "6", "Arch": "amd64", "SrcName": "lapack", "SrcVersion": "3.12.1", "SrcRelease": "6", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-intel" ], "Maintainer": "Debian Science Team \u003cdebian-science-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/blas/libblas.so.3.12.1", "/usr/share/doc/libblas3/changelog.Debian.gz", "/usr/share/doc/libblas3/copyright", "/usr/share/lintian/overrides/libblas3" ], "AnalyzedBy": "dpkg" }, { "ID": "libblkid1@2.41.5-0+deb13u1", "Name": "libblkid1", "Identifier": { "PURL": "pkg:deb/debian/libblkid1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "57ce331079f40f84" }, "Version": "2.41.5", "Release": "0+deb13u1", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41.5", "SrcRelease": "0+deb13u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0", "/usr/share/doc/libblkid1/NEWS.Debian.gz", "/usr/share/doc/libblkid1/changelog.Debian.gz", "/usr/share/doc/libblkid1/changelog.gz", "/usr/share/doc/libblkid1/copyright", "/usr/share/lintian/overrides/libblkid1" ], "AnalyzedBy": "dpkg" }, { "ID": "libbluray2@1:1.3.4-1+b2", "Name": "libbluray2", "Identifier": { "PURL": "pkg:deb/debian/libbluray2@1.3.4-1%2Bb2?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "e7772c6e4e107a45" }, "Version": "1.3.4", "Release": "1+b2", "Epoch": 1, "Arch": "amd64", "SrcName": "libbluray", "SrcVersion": "1.3.4", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "LGPL-2.1-or-later", "custom", "GPL-2.0-or-later", "BSD-3-Clause", "MPL-1.0", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libfontconfig1@2.15.0-2.3", "libfreetype6@2.13.3+dfsg-1+deb13u1", "libudfread0@1.1.2-1+b2", "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbluray.so.2.4.3", "/usr/share/doc/libbluray2/changelog.Debian.amd64.gz", "/usr/share/doc/libbluray2/changelog.Debian.gz", "/usr/share/doc/libbluray2/changelog.gz", "/usr/share/doc/libbluray2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libbrotli1@1.1.0-2+b7", "Name": "libbrotli1", "Identifier": { "PURL": "pkg:deb/debian/libbrotli1@1.1.0-2%2Bb7?arch=amd64\u0026distro=debian-13.6", "UID": "3f78e505ac03922b" }, "Version": "1.1.0", "Release": "2+b7", "Arch": "amd64", "SrcName": "brotli", "SrcVersion": "1.1.0", "SrcRelease": "2", "Licenses": [ "MIT" ], "Maintainer": "Tomasz Buchert \u003ctomasz@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbrotlicommon.so.1.1.0", "/usr/lib/x86_64-linux-gnu/libbrotlidec.so.1.1.0", "/usr/lib/x86_64-linux-gnu/libbrotlienc.so.1.1.0", "/usr/share/doc/libbrotli1/changelog.Debian.amd64.gz", "/usr/share/doc/libbrotli1/changelog.Debian.gz", "/usr/share/doc/libbrotli1/changelog.gz", "/usr/share/doc/libbrotli1/copyright", "/usr/share/lintian/overrides/libbrotli1" ], "AnalyzedBy": "dpkg" }, { "ID": "libbs2b0@3.1.0+dfsg-8+b1", "Name": "libbs2b0", "Identifier": { "PURL": "pkg:deb/debian/libbs2b0@3.1.0%2Bdfsg-8%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "ffb6a3b328acea20" }, "Version": "3.1.0+dfsg", "Release": "8+b1", "Arch": "amd64", "SrcName": "libbs2b", "SrcVersion": "3.1.0+dfsg", "SrcRelease": "8", "Licenses": [ "MIT", "GPL-3.0-or-later", "GPL-2.0-or-later", "MIT+FSF-public", "FSF-unlimited", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian QA Group \u003cpackages@qa.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbs2b.so.0.0.0", "/usr/share/doc/libbs2b0/changelog.Debian.amd64.gz", "/usr/share/doc/libbs2b0/changelog.Debian.gz", "/usr/share/doc/libbs2b0/changelog.gz", "/usr/share/doc/libbs2b0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libbsd0@0.12.2-2", "Name": "libbsd0", "Identifier": { "PURL": "pkg:deb/debian/libbsd0@0.12.2-2?arch=amd64\u0026distro=debian-13.6", "UID": "a8f4afa42f768363" }, "Version": "0.12.2", "Release": "2", "Arch": "amd64", "SrcName": "libbsd", "SrcVersion": "0.12.2", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-Regents", "BSD-2-Clause-NetBSD", "BSD-3-clause-author", "BSD-3-clause-John-Birrell", "BSD-5-clause-Peter-Wemm", "BSD-2-Clause", "BSD-2-clause-verbatim", "BSD-2-clause-author", "ISC", "ISC-Original", "MIT", "public-domain", "Beerware" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libmd0@1.1.0-2+b1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbsd.so.0.12.2", "/usr/share/doc/libbsd0/changelog.Debian.gz", "/usr/share/doc/libbsd0/changelog.gz", "/usr/share/doc/libbsd0/copyright", "/usr/share/lintian/overrides/libbsd0" ], "AnalyzedBy": "dpkg" }, { "ID": "libbz2-1.0@1.0.8-6", "Name": "libbz2-1.0", "Identifier": { "PURL": "pkg:deb/debian/libbz2-1.0@1.0.8-6?arch=amd64\u0026distro=debian-13.6", "UID": "2da429aca83dde92" }, "Version": "1.0.8", "Release": "6", "Arch": "amd64", "SrcName": "bzip2", "SrcVersion": "1.0.8", "SrcRelease": "6", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbz2.so.1.0.4", "/usr/share/doc/libbz2-1.0/changelog.Debian.gz", "/usr/share/doc/libbz2-1.0/changelog.gz", "/usr/share/doc/libbz2-1.0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libc-bin@2.41-12+deb13u3", "Name": "libc-bin", "Identifier": { "PURL": "pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "c45af597301c8c0b" }, "Version": "2.41", "Release": "12+deb13u3", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.41", "SrcRelease": "12+deb13u3", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.0-or-later", "LGPL-2.1+-with-link-exception", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2+-with-link-exception", "GPL-2.0-only", "GPL-3.0-or-later", "FSFAP", "Carnegie", "Inner-Net", "MIT-like-Lord", "BSD-like-Spencer", "PCRE", "BSD-3-clause-Carnegie", "Unicode-DFS-2016", "BSL-1.0", "SunPro", "CORE-MATH", "BSD-3-clause-Berkeley", "BSD-3-clause-WIDE", "BSD-2-Clause", "BSD-3-clause-Oracle", "DEC", "IBM", "ISC", "Univ-Coimbra", "public-domain", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/getconf", "/usr/bin/getent", "/usr/bin/iconv", "/usr/bin/ldd", "/usr/bin/locale", "/usr/bin/localedef", "/usr/bin/pldd", "/usr/bin/tzselect", "/usr/bin/zdump", "/usr/lib/locale/C.utf8/LC_ADDRESS", "/usr/lib/locale/C.utf8/LC_COLLATE", "/usr/lib/locale/C.utf8/LC_CTYPE", "/usr/lib/locale/C.utf8/LC_IDENTIFICATION", "/usr/lib/locale/C.utf8/LC_MEASUREMENT", "/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES", "/usr/lib/locale/C.utf8/LC_MONETARY", "/usr/lib/locale/C.utf8/LC_NAME", "/usr/lib/locale/C.utf8/LC_NUMERIC", "/usr/lib/locale/C.utf8/LC_PAPER", "/usr/lib/locale/C.utf8/LC_TELEPHONE", "/usr/lib/locale/C.utf8/LC_TIME", "/usr/sbin/iconvconfig", "/usr/sbin/ldconfig", "/usr/sbin/zic", "/usr/share/doc/libc-bin/changelog.Debian.gz", "/usr/share/doc/libc-bin/changelog.gz", "/usr/share/doc/libc-bin/copyright", "/usr/share/libc-bin/nsswitch.conf", "/usr/share/lintian/overrides/libc-bin", "/usr/share/man/man1/getconf.1.gz", "/usr/share/man/man1/tzselect.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libc6@2.41-12+deb13u3", "Name": "libc6", "Identifier": { "PURL": "pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "2a1acf211abcdd46" }, "Version": "2.41", "Release": "12+deb13u3", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.41", "SrcRelease": "12+deb13u3", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.0-or-later", "LGPL-2.1+-with-link-exception", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2+-with-link-exception", "GPL-2.0-only", "GPL-3.0-or-later", "FSFAP", "Carnegie", "Inner-Net", "MIT-like-Lord", "BSD-like-Spencer", "PCRE", "BSD-3-clause-Carnegie", "Unicode-DFS-2016", "BSL-1.0", "SunPro", "CORE-MATH", "BSD-3-clause-Berkeley", "BSD-3-clause-WIDE", "BSD-2-Clause", "BSD-3-clause-Oracle", "DEC", "IBM", "ISC", "Univ-Coimbra", "public-domain", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/gconv/ANSI_X3.110.so", "/usr/lib/x86_64-linux-gnu/gconv/ARMSCII-8.so", "/usr/lib/x86_64-linux-gnu/gconv/ASMO_449.so", "/usr/lib/x86_64-linux-gnu/gconv/BIG5.so", "/usr/lib/x86_64-linux-gnu/gconv/BIG5HKSCS.so", "/usr/lib/x86_64-linux-gnu/gconv/BRF.so", "/usr/lib/x86_64-linux-gnu/gconv/CP10007.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1125.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1250.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1251.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1252.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1253.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1254.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1255.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1256.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1257.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1258.so", "/usr/lib/x86_64-linux-gnu/gconv/CP737.so", "/usr/lib/x86_64-linux-gnu/gconv/CP770.so", "/usr/lib/x86_64-linux-gnu/gconv/CP771.so", "/usr/lib/x86_64-linux-gnu/gconv/CP772.so", "/usr/lib/x86_64-linux-gnu/gconv/CP773.so", "/usr/lib/x86_64-linux-gnu/gconv/CP774.so", "/usr/lib/x86_64-linux-gnu/gconv/CP775.so", "/usr/lib/x86_64-linux-gnu/gconv/CP932.so", "/usr/lib/x86_64-linux-gnu/gconv/CSN_369103.so", "/usr/lib/x86_64-linux-gnu/gconv/CWI.so", "/usr/lib/x86_64-linux-gnu/gconv/DEC-MCS.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-AT-DE-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-AT-DE.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-CA-FR.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-DK-NO-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-DK-NO.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES-S.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FI-SE-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FI-SE.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FR.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-IS-FRISS.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-IT.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-PT.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-UK.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-US.so", "/usr/lib/x86_64-linux-gnu/gconv/ECMA-CYRILLIC.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-CN.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JP-MS.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JP.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-KR.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-TW.so", "/usr/lib/x86_64-linux-gnu/gconv/GB18030.so", "/usr/lib/x86_64-linux-gnu/gconv/GBBIG5.so", "/usr/lib/x86_64-linux-gnu/gconv/GBGBK.so", "/usr/lib/x86_64-linux-gnu/gconv/GBK.so", "/usr/lib/x86_64-linux-gnu/gconv/GEORGIAN-ACADEMY.so", "/usr/lib/x86_64-linux-gnu/gconv/GEORGIAN-PS.so", "/usr/lib/x86_64-linux-gnu/gconv/GOST_19768-74.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK-CCITT.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK7-OLD.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK7.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-GREEK8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-ROMAN8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-ROMAN9.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-THAI8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-TURKISH8.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM037.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM038.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1004.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1008.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1008_420.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1025.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1026.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1046.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1047.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1097.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1112.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1122.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1123.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1124.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1129.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1130.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1132.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1133.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1137.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1140.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1141.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1142.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1143.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1144.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1145.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1146.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1147.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1148.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1149.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1153.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1154.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1155.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1156.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1157.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1158.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1160.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1161.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1162.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1163.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1164.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1166.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1167.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM12712.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1364.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1371.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1388.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1390.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1399.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM16804.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM256.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM273.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM274.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM275.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM277.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM278.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM280.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM281.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM284.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM285.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM290.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM297.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM420.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM423.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM424.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM437.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4517.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4899.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4909.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4971.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM500.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM5347.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM803.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM850.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM851.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM852.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM855.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM856.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM857.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM858.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM860.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM861.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM862.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM863.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM864.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM865.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM866.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM866NAV.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM868.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM869.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM870.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM871.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM874.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM875.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM880.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM891.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM901.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM902.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM903.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9030.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM904.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM905.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9066.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM918.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM921.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM922.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM930.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM932.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM933.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM935.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM937.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM939.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM943.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9448.so", "/usr/lib/x86_64-linux-gnu/gconv/IEC_P27-1.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS-8.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS-CYRILLIC.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS.so", "/usr/lib/x86_64-linux-gnu/gconv/ISIRI-3342.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-CN-EXT.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-CN.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-JP-3.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-JP.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-KR.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-IR-197.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-IR-209.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO646.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-1.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-10.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-11.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-13.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-14.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-15.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-16.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-2.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-3.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-4.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-5.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-6.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-7.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-8.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-9.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-9E.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_10367-BOX.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_11548-1.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_2033.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5427-EXT.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5427.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5428.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_6937-2.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_6937.so", "/usr/lib/x86_64-linux-gnu/gconv/JOHAB.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI-8.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-R.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-RU.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-T.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-U.so", "/usr/lib/x86_64-linux-gnu/gconv/LATIN-GREEK-1.so", "/usr/lib/x86_64-linux-gnu/gconv/LATIN-GREEK.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-CENTRALEUROPE.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-IS.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-SAMI.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-UK.so", "/usr/lib/x86_64-linux-gnu/gconv/MACINTOSH.so", "/usr/lib/x86_64-linux-gnu/gconv/MIK.so", "/usr/lib/x86_64-linux-gnu/gconv/NATS-DANO.so", "/usr/lib/x86_64-linux-gnu/gconv/NATS-SEFI.so", "/usr/lib/x86_64-linux-gnu/gconv/PT154.so", "/usr/lib/x86_64-linux-gnu/gconv/RK1048.so", "/usr/lib/x86_64-linux-gnu/gconv/SAMI-WS2.so", "/usr/lib/x86_64-linux-gnu/gconv/SHIFT_JISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/SJIS.so", "/usr/lib/x86_64-linux-gnu/gconv/T.61.so", "/usr/lib/x86_64-linux-gnu/gconv/TCVN5712-1.so", "/usr/lib/x86_64-linux-gnu/gconv/TIS-620.so", "/usr/lib/x86_64-linux-gnu/gconv/TSCII.so", "/usr/lib/x86_64-linux-gnu/gconv/UHC.so", "/usr/lib/x86_64-linux-gnu/gconv/UNICODE.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-16.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-32.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-7.so", "/usr/lib/x86_64-linux-gnu/gconv/VISCII.so", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.d/gconv-modules-extra.conf", "/usr/lib/x86_64-linux-gnu/gconv/libCNS.so", "/usr/lib/x86_64-linux-gnu/gconv/libGB.so", "/usr/lib/x86_64-linux-gnu/gconv/libISOIR165.so", "/usr/lib/x86_64-linux-gnu/gconv/libJIS.so", "/usr/lib/x86_64-linux-gnu/gconv/libJISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/libKSC.so", "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", "/usr/lib/x86_64-linux-gnu/libBrokenLocale.so.1", "/usr/lib/x86_64-linux-gnu/libanl.so.1", "/usr/lib/x86_64-linux-gnu/libc.so.6", "/usr/lib/x86_64-linux-gnu/libc_malloc_debug.so.0", "/usr/lib/x86_64-linux-gnu/libdl.so.2", "/usr/lib/x86_64-linux-gnu/libm.so.6", "/usr/lib/x86_64-linux-gnu/libmemusage.so", "/usr/lib/x86_64-linux-gnu/libmvec.so.1", "/usr/lib/x86_64-linux-gnu/libnsl.so.1", "/usr/lib/x86_64-linux-gnu/libnss_compat.so.2", "/usr/lib/x86_64-linux-gnu/libnss_dns.so.2", "/usr/lib/x86_64-linux-gnu/libnss_files.so.2", "/usr/lib/x86_64-linux-gnu/libnss_hesiod.so.2", "/usr/lib/x86_64-linux-gnu/libpcprofile.so", "/usr/lib/x86_64-linux-gnu/libpthread.so.0", "/usr/lib/x86_64-linux-gnu/libresolv.so.2", "/usr/lib/x86_64-linux-gnu/librt.so.1", "/usr/lib/x86_64-linux-gnu/libthread_db.so.1", "/usr/lib/x86_64-linux-gnu/libutil.so.1", "/usr/share/doc/libc6/NEWS.Debian.gz", "/usr/share/doc/libc6/NEWS.gz", "/usr/share/doc/libc6/README.Debian.gz", "/usr/share/doc/libc6/README.hesiod.gz", "/usr/share/doc/libc6/changelog.Debian.gz", "/usr/share/doc/libc6/changelog.gz", "/usr/share/doc/libc6/copyright", "/usr/share/lintian/overrides/libc6" ], "AnalyzedBy": "dpkg" }, { "ID": "libcaca0@0.99.beta20-5+deb13u1", "Name": "libcaca0", "Identifier": { "PURL": "pkg:deb/debian/libcaca0@0.99.beta20-5%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "b47c95dce0406897" }, "Version": "0.99.beta20", "Release": "5+deb13u1", "Arch": "amd64", "SrcName": "libcaca", "SrcVersion": "0.99.beta20", "SrcRelease": "5+deb13u1", "Licenses": [ "WTFPL-2", "ISC", "LGPL-2.0-or-later", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "LGPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libncursesw6@6.5+20250216-2", "libslang2@2.3.3-5+b2", "libstdc++6@14.2.0-19", "libtinfo6@6.5+20250216-2", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/caca/libgl_plugin.so.0.0.0", "/usr/lib/x86_64-linux-gnu/caca/libx11_plugin.so.0.0.0", "/usr/lib/x86_64-linux-gnu/libcaca++.so.0.99.20", "/usr/lib/x86_64-linux-gnu/libcaca.so.0.99.20", "/usr/share/doc/libcaca0/changelog.Debian.gz", "/usr/share/doc/libcaca0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcairo-gobject2@1.18.4-1+b1", "Name": "libcairo-gobject2", "Identifier": { "PURL": "pkg:deb/debian/libcairo-gobject2@1.18.4-1%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "4a53b0642698b2f6" }, "Version": "1.18.4", "Release": "1+b1", "Arch": "amd64", "SrcName": "cairo", "SrcVersion": "1.18.4", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libcairo2@1.18.4-1+b1", "libglib2.0-0t64@2.84.4-3~deb13u5" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcairo-gobject.so.2.11804.4", "/usr/share/doc/libcairo-gobject2/AUTHORS.gz", "/usr/share/doc/libcairo-gobject2/NEWS.gz", "/usr/share/doc/libcairo-gobject2/README.md.gz", "/usr/share/doc/libcairo-gobject2/changelog.Debian.amd64.gz", "/usr/share/doc/libcairo-gobject2/changelog.Debian.gz", "/usr/share/doc/libcairo-gobject2/copyright", "/usr/share/lintian/overrides/libcairo-gobject2" ], "AnalyzedBy": "dpkg" }, { "ID": "libcairo2@1.18.4-1+b1", "Name": "libcairo2", "Identifier": { "PURL": "pkg:deb/debian/libcairo2@1.18.4-1%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "fc0d5cdd3900d6f2" }, "Version": "1.18.4", "Release": "1+b1", "Arch": "amd64", "SrcName": "cairo", "SrcVersion": "1.18.4", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libfontconfig1@2.15.0-2.3", "libfreetype6@2.13.3+dfsg-1+deb13u1", "libpixman-1-0@0.44.0-3", "libpng16-16t64@1.6.48-1+deb13u5", "libx11-6@2:1.8.12-1", "libxcb-render0@1.17.0-2+b1", "libxcb-shm0@1.17.0-2+b1", "libxcb1@1.17.0-2+b1", "libxext6@2:1.3.4-1+b3", "libxrender1@1:0.9.12-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcairo.so.2.11804.4", "/usr/share/doc/libcairo2/changelog.Debian.amd64.gz", "/usr/share/doc/libcairo2/changelog.Debian.gz", "/usr/share/doc/libcairo2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcap-ng0@0.8.5-4+b1", "Name": "libcap-ng0", "Identifier": { "PURL": "pkg:deb/debian/libcap-ng0@0.8.5-4%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "9b7c2d5667513e48" }, "Version": "0.8.5", "Release": "4+b1", "Arch": "amd64", "SrcName": "libcap-ng", "SrcVersion": "0.8.5", "SrcRelease": "4", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later", "GPL-3.0-only", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Håvard F. Aasen \u003chavard.f.aasen@pfft.no\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0", "/usr/lib/x86_64-linux-gnu/libdrop_ambient.so.0.0.0", "/usr/share/doc/libcap-ng0/changelog.Debian.amd64.gz", "/usr/share/doc/libcap-ng0/changelog.Debian.gz", "/usr/share/doc/libcap-ng0/changelog.gz", "/usr/share/doc/libcap-ng0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcap2@1:2.75-10+deb13u1+b1", "Name": "libcap2", "Identifier": { "PURL": "pkg:deb/debian/libcap2@2.75-10%2Bdeb13u1%2Bb1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "7cefa0399e4d88d4" }, "Version": "2.75", "Release": "10+deb13u1+b1", "Epoch": 1, "Arch": "amd64", "SrcName": "libcap2", "SrcVersion": "2.75", "SrcRelease": "10+deb13u1", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Christian Kastner \u003cckk@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcap.so.2.75", "/usr/lib/x86_64-linux-gnu/libpsx.so.2.75", "/usr/share/doc/libcap2/changelog.Debian.amd64.gz", "/usr/share/doc/libcap2/changelog.Debian.gz", "/usr/share/doc/libcap2/changelog.gz", "/usr/share/doc/libcap2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcdio-cdda2t64@10.2+2.0.2-1+b1", "Name": "libcdio-cdda2t64", "Identifier": { "PURL": "pkg:deb/debian/libcdio-cdda2t64@10.2%2B2.0.2-1%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "97909c90054b53fa" }, "Version": "10.2+2.0.2", "Release": "1+b1", "Arch": "amd64", "SrcName": "libcdio-paranoia", "SrcVersion": "10.2+2.0.2", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "GFDL-1.2-no-invariants-only", "GPL-3.0-only", "GFDL-1.2-only" ], "Maintainer": "Philippe SWARTVAGHER \u003cphil.swart@gmx.fr\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcdio19t64@2.2.0-4.1~deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcdio_cdda.so.2.0.0", "/usr/share/doc/libcdio-cdda2t64/changelog.Debian.amd64.gz", "/usr/share/doc/libcdio-cdda2t64/changelog.Debian.gz", "/usr/share/doc/libcdio-cdda2t64/copyright", "/usr/share/lintian/overrides/libcdio-cdda2t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libcdio-paranoia2t64@10.2+2.0.2-1+b1", "Name": "libcdio-paranoia2t64", "Identifier": { "PURL": "pkg:deb/debian/libcdio-paranoia2t64@10.2%2B2.0.2-1%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "4b368db01c5b5484" }, "Version": "10.2+2.0.2", "Release": "1+b1", "Arch": "amd64", "SrcName": "libcdio-paranoia", "SrcVersion": "10.2+2.0.2", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "GFDL-1.2-no-invariants-only", "GPL-3.0-only", "GFDL-1.2-only" ], "Maintainer": "Philippe SWARTVAGHER \u003cphil.swart@gmx.fr\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcdio-cdda2t64@10.2+2.0.2-1+b1", "libcdio19t64@2.2.0-4.1~deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcdio_paranoia.so.2.0.0", "/usr/share/doc/libcdio-paranoia2t64/changelog.Debian.amd64.gz", "/usr/share/doc/libcdio-paranoia2t64/changelog.Debian.gz", "/usr/share/doc/libcdio-paranoia2t64/copyright", "/usr/share/lintian/overrides/libcdio-paranoia2t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libcdio19t64@2.2.0-4.1~deb13u1", "Name": "libcdio19t64", "Identifier": { "PURL": "pkg:deb/debian/libcdio19t64@2.2.0-4.1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "50ebd32468845526" }, "Version": "2.2.0", "Release": "4.1~deb13u1", "Arch": "amd64", "SrcName": "libcdio", "SrcVersion": "2.2.0", "SrcRelease": "4.1~deb13u1", "Licenses": [ "GPL-3.0-only", "GPL-2+ with autoconf-macro exception", "GFDL-1.2-only", "GPL-2.0-only" ], "Maintainer": "Gabriel F. T. Gomes \u003cgabriel@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcdio.so.19.0.0", "/usr/share/doc/libcdio19t64/changelog.Debian.gz", "/usr/share/doc/libcdio19t64/copyright", "/usr/share/lintian/overrides/libcdio19t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libchromaprint1@1.5.1-7", "Name": "libchromaprint1", "Identifier": { "PURL": "pkg:deb/debian/libchromaprint1@1.5.1-7?arch=amd64\u0026distro=debian-13.6", "UID": "fef99bff73edb3ac" }, "Version": "1.5.1", "Release": "7", "Arch": "amd64", "SrcName": "chromaprint", "SrcVersion": "1.5.1", "SrcRelease": "7", "Licenses": [ "MIT", "BSD-3-Clause", "LGPL-2.1-or-later", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libchromaprint.so.1.5.1", "/usr/share/doc/libchromaprint1/changelog.Debian.gz", "/usr/share/doc/libchromaprint1/changelog.gz", "/usr/share/doc/libchromaprint1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcjson1@1.7.18-3.1+deb13u1", "Name": "libcjson1", "Identifier": { "PURL": "pkg:deb/debian/libcjson1@1.7.18-3.1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "4e2f6c2ffefb1018" }, "Version": "1.7.18", "Release": "3.1+deb13u1", "Arch": "amd64", "SrcName": "cjson", "SrcVersion": "1.7.18", "SrcRelease": "3.1+deb13u1", "Licenses": [ "MIT", "Apache-2.0" ], "Maintainer": "Maytham Alsudany \u003cmaytha8thedev@gmail.com\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcjson.so.1.7.18", "/usr/lib/x86_64-linux-gnu/libcjson_utils.so.1.7.18", "/usr/share/doc/libcjson1/changelog.Debian.gz", "/usr/share/doc/libcjson1/changelog.gz", "/usr/share/doc/libcjson1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcodec2-1.2@1.2.0-3", "Name": "libcodec2-1.2", "Identifier": { "PURL": "pkg:deb/debian/libcodec2-1.2@1.2.0-3?arch=amd64\u0026distro=debian-13.6", "UID": "d095cd7585c67b13" }, "Version": "1.2.0", "Release": "3", "Arch": "amd64", "SrcName": "codec2", "SrcVersion": "1.2.0", "SrcRelease": "3", "Licenses": [ "LGPL-2.1-only", "JMVBSD", "KISSFFTBSD" ], "Maintainer": "A. Maitland Bottoms \u003cbottoms@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcodec2.so.1.2", "/usr/share/doc/libcodec2-1.2/changelog.Debian.gz", "/usr/share/doc/libcodec2-1.2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcom-err2@1.47.2-3+b12", "Name": "libcom-err2", "Identifier": { "PURL": "pkg:deb/debian/libcom-err2@1.47.2-3%2Bb12?arch=amd64\u0026distro=debian-13.6", "UID": "327116116d1e0100" }, "Version": "1.47.2", "Release": "3+b12", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.2", "SrcRelease": "3", "Licenses": [ "GPL-2.0-only", "GPL-2.0-or-later", "0BSD", "MIT", "BSD-3-Clause-Variant", "BSD-3-Clause", "BSD-4-Clause-CMU", "LGPL-2.0-only", "Apache-2.0", "ISC", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcom_err.so.2.1", "/usr/share/doc/libcom-err2/changelog.Debian.amd64.gz", "/usr/share/doc/libcom-err2/changelog.Debian.gz", "/usr/share/doc/libcom-err2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcrypt1@1:4.4.38-1", "Name": "libcrypt1", "Identifier": { "PURL": "pkg:deb/debian/libcrypt1@4.4.38-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "afe984ba824f92ac" }, "Version": "4.4.38", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxcrypt", "SrcVersion": "4.4.38", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcrypt.so.1.1.0", "/usr/share/doc/libcrypt1/changelog.Debian.gz", "/usr/share/doc/libcrypt1/changelog.gz", "/usr/share/doc/libcrypt1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcurl4t64@8.14.1-2+deb13u5", "Name": "libcurl4t64", "Identifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "49a807f44571c630" }, "Version": "8.14.1", "Release": "2+deb13u5", "Arch": "amd64", "SrcName": "curl", "SrcVersion": "8.14.1", "SrcRelease": "2+deb13u5", "Licenses": [ "curl", "OLDAP-2.8", "ISC", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "GPL-2+ with Libtool exception", "BSD-3-Clause", "BSD-4-Clause-UC", "FSFULLR", "X11", "GPL-2.0-only" ], "Maintainer": "Debian Curl Maintainers \u003cteam+curl@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbrotli1@1.1.0-2+b7", "libc6@2.41-12+deb13u3", "libgssapi-krb5-2@1.21.3-5+deb13u1", "libidn2-0@2.3.8-2", "libldap2@2.6.10+dfsg-1", "libnghttp2-14@1.64.0-1.1+deb13u1", "libnghttp3-9@1.8.0-1", "libpsl5t64@0.21.2-1.1+b1", "librtmp1@2.4+20151223.gitfa8646d.1-2+b5", "libssh2-1t64@1.11.1-1+deb13u2", "libssl3t64@3.5.7-1~deb13u2", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcurl.so.4.8.0", "/usr/share/doc/libcurl4t64/changelog.Debian.gz", "/usr/share/doc/libcurl4t64/changelog.gz", "/usr/share/doc/libcurl4t64/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdatrie1@0.2.13-3+b1", "Name": "libdatrie1", "Identifier": { "PURL": "pkg:deb/debian/libdatrie1@0.2.13-3%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "9f3f53b2caa93c80" }, "Version": "0.2.13", "Release": "3+b1", "Arch": "amd64", "SrcName": "libdatrie", "SrcVersion": "0.2.13", "SrcRelease": "3", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Theppitak Karoonboonyanan \u003cthep@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdatrie.so.1.4.0", "/usr/share/doc/libdatrie1/NEWS.gz", "/usr/share/doc/libdatrie1/README", "/usr/share/doc/libdatrie1/changelog.Debian.amd64.gz", "/usr/share/doc/libdatrie1/changelog.Debian.gz", "/usr/share/doc/libdatrie1/changelog.gz", "/usr/share/doc/libdatrie1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdav1d7@1.5.1-1", "Name": "libdav1d7", "Identifier": { "PURL": "pkg:deb/debian/libdav1d7@1.5.1-1?arch=amd64\u0026distro=debian-13.6", "UID": "102310186a4a9715" }, "Version": "1.5.1", "Release": "1", "Arch": "amd64", "SrcName": "dav1d", "SrcVersion": "1.5.1", "SrcRelease": "1", "Licenses": [ "BSD-2-Clause", "public-domain", "ISC" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdav1d.so.7.0.0", "/usr/share/doc/libdav1d7/changelog.Debian.gz", "/usr/share/doc/libdav1d7/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdb5.3t64@5.3.28+dfsg2-9", "Name": "libdb5.3t64", "Identifier": { "PURL": "pkg:deb/debian/libdb5.3t64@5.3.28%2Bdfsg2-9?arch=amd64\u0026distro=debian-13.6", "UID": "2f5f1c2fd77295dc" }, "Version": "5.3.28+dfsg2", "Release": "9", "Arch": "amd64", "SrcName": "db5.3", "SrcVersion": "5.3.28+dfsg2", "SrcRelease": "9", "Licenses": [ "Sleepycat", "BSD-3-Clause", "MS-PL", "GPL-2.0-or-later", "Artistic-2.0", "X11", "MIT-old", "TCL-like", "BSD-3-clause-fjord", "GPL-3.0-only", "Zlib" ], "Maintainer": "Debian QA Group \u003cpackages@qa.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdb-5.3.so", "/usr/share/doc/libdb5.3t64/build_signature_amd64.txt", "/usr/share/doc/libdb5.3t64/changelog.Debian.gz", "/usr/share/doc/libdb5.3t64/copyright", "/usr/share/lintian/overrides/libdb5.3t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libdbus-1-3@1.16.2-2", "Name": "libdbus-1-3", "Identifier": { "PURL": "pkg:deb/debian/libdbus-1-3@1.16.2-2?arch=amd64\u0026distro=debian-13.6", "UID": "d332de0abee0e5f0" }, "Version": "1.16.2", "Release": "2", "Arch": "amd64", "SrcName": "dbus", "SrcVersion": "1.16.2", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "AFL-2.1", "MIT", "Tcl-BSDish", "BSD-3-Clause", "BSD-3-clause-generic", "LGPL-2.1-or-later", "g10-permissive", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Utopia Maintenance Team \u003cpkg-utopia-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libsystemd0@257.13-1~deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdbus-1.so.3.38.3", "/usr/share/doc/libdbus-1-3/AUTHORS.gz", "/usr/share/doc/libdbus-1-3/NEWS.gz", "/usr/share/doc/libdbus-1-3/README.gz", "/usr/share/doc/libdbus-1-3/changelog.Debian.gz", "/usr/share/doc/libdbus-1-3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdc1394-25@2.2.6-5", "Name": "libdc1394-25", "Identifier": { "PURL": "pkg:deb/debian/libdc1394-25@2.2.6-5?arch=amd64\u0026distro=debian-13.6", "UID": "c0a5053023b4cacd" }, "Version": "2.2.6", "Release": "5", "Arch": "amd64", "SrcName": "libdc1394", "SrcVersion": "2.2.6", "SrcRelease": "5", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libraw1394-11@2.1.2-2+b2", "libusb-1.0-0@2:1.0.28-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdc1394.so.25.0.0", "/usr/share/doc/libdc1394-25/changelog.Debian.gz", "/usr/share/doc/libdc1394-25/changelog.gz", "/usr/share/doc/libdc1394-25/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdebconfclient0@0.280", "Name": "libdebconfclient0", "Identifier": { "PURL": "pkg:deb/debian/libdebconfclient0@0.280?arch=amd64\u0026distro=debian-13.6", "UID": "fcad452fa456130" }, "Version": "0.280", "Arch": "amd64", "SrcName": "cdebconf", "SrcVersion": "0.280", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Install System Team \u003cdebian-boot@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdebconfclient.so.0.0.0", "/usr/share/doc/libdebconfclient0/changelog.gz", "/usr/share/doc/libdebconfclient0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdecor-0-0@0.2.2-2", "Name": "libdecor-0-0", "Identifier": { "PURL": "pkg:deb/debian/libdecor-0-0@0.2.2-2?arch=amd64\u0026distro=debian-13.6", "UID": "31f3496d1f68b2c0" }, "Version": "0.2.2", "Release": "2", "Arch": "amd64", "SrcName": "libdecor-0", "SrcVersion": "0.2.2", "SrcRelease": "2", "Licenses": [ "MIT", "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian SDL packages maintainers \u003cpkg-sdl-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libwayland-client0@1.23.1-3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdecor-0.so.0.200.2", "/usr/share/doc/libdecor-0-0/changelog.Debian.gz", "/usr/share/doc/libdecor-0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdeflate0@1.23-2", "Name": "libdeflate0", "Identifier": { "PURL": "pkg:deb/debian/libdeflate0@1.23-2?arch=amd64\u0026distro=debian-13.6", "UID": "ab8072ab69cc3fd2" }, "Version": "1.23", "Release": "2", "Arch": "amd64", "SrcName": "libdeflate", "SrcVersion": "1.23", "SrcRelease": "2", "Licenses": [ "MIT" ], "Maintainer": "Deflate Team \u003clibdeflate@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdeflate.so.0", "/usr/share/doc/libdeflate0/changelog.Debian.gz", "/usr/share/doc/libdeflate0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-amdgpu1@2.4.124-2", "Name": "libdrm-amdgpu1", "Identifier": { "PURL": "pkg:deb/debian/libdrm-amdgpu1@2.4.124-2?arch=amd64\u0026distro=debian-13.6", "UID": "a4f115207b0cd4bd" }, "Version": "2.4.124", "Release": "2", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.124", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdrm2@2.4.124-2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm_amdgpu.so.1.124.0", "/usr/share/doc/libdrm-amdgpu1/changelog.Debian.gz", "/usr/share/doc/libdrm-amdgpu1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-common@2.4.124-2", "Name": "libdrm-common", "Identifier": { "PURL": "pkg:deb/debian/libdrm-common@2.4.124-2?arch=all\u0026distro=debian-13.6", "UID": "83d256e8222dccd6" }, "Version": "2.4.124", "Release": "2", "Arch": "all", "SrcName": "libdrm", "SrcVersion": "2.4.124", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/doc/libdrm-common/changelog.Debian.gz", "/usr/share/doc/libdrm-common/copyright", "/usr/share/libdrm/amdgpu.ids" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-intel1@2.4.124-2", "Name": "libdrm-intel1", "Identifier": { "PURL": "pkg:deb/debian/libdrm-intel1@2.4.124-2?arch=amd64\u0026distro=debian-13.6", "UID": "ff7aeb669cdd7d14" }, "Version": "2.4.124", "Release": "2", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.124", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdrm2@2.4.124-2", "libpciaccess0@0.17-3+b3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm_intel.so.1.124.0", "/usr/share/doc/libdrm-intel1/changelog.Debian.gz", "/usr/share/doc/libdrm-intel1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm2@2.4.124-2", "Name": "libdrm2", "Identifier": { "PURL": "pkg:deb/debian/libdrm2@2.4.124-2?arch=amd64\u0026distro=debian-13.6", "UID": "73d21889b2bc42a5" }, "Version": "2.4.124", "Release": "2", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.124", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdrm-common@2.4.124-2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm.so.2.124.0", "/usr/share/doc/libdrm2/changelog.Debian.gz", "/usr/share/doc/libdrm2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdvdnav4@6.1.1-3+b1", "Name": "libdvdnav4", "Identifier": { "PURL": "pkg:deb/debian/libdvdnav4@6.1.1-3%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "373af816015113af" }, "Version": "6.1.1", "Release": "3+b1", "Arch": "amd64", "SrcName": "libdvdnav", "SrcVersion": "6.1.1", "SrcRelease": "3", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdvdread8t64@6.1.3-2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdvdnav.so.4.3.0", "/usr/share/bug/libdvdnav4/control", "/usr/share/doc/libdvdnav4/AUTHORS", "/usr/share/doc/libdvdnav4/README", "/usr/share/doc/libdvdnav4/changelog.Debian.amd64.gz", "/usr/share/doc/libdvdnav4/changelog.Debian.gz", "/usr/share/doc/libdvdnav4/changelog.gz", "/usr/share/doc/libdvdnav4/copyright", "/usr/share/lintian/overrides/libdvdnav4" ], "AnalyzedBy": "dpkg" }, { "ID": "libdvdread8t64@6.1.3-2", "Name": "libdvdread8t64", "Identifier": { "PURL": "pkg:deb/debian/libdvdread8t64@6.1.3-2?arch=amd64\u0026distro=debian-13.6", "UID": "bd7adf354f188528" }, "Version": "6.1.3", "Release": "2", "Arch": "amd64", "SrcName": "libdvdread", "SrcVersion": "6.1.3", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdvdread.so.8.0.0", "/usr/share/bug/libdvdread8t64/control", "/usr/share/doc/libdvdread8t64/README.css", "/usr/share/doc/libdvdread8t64/changelog.Debian.gz", "/usr/share/doc/libdvdread8t64/changelog.gz", "/usr/share/doc/libdvdread8t64/copyright", "/usr/share/lintian/overrides/libdvdread8t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libedit2@3.1-20250104-1", "Name": "libedit2", "Identifier": { "PURL": "pkg:deb/debian/libedit2@3.1-20250104-1?arch=amd64\u0026distro=debian-13.6", "UID": "4fb0ab571d152b42" }, "Version": "3.1-20250104", "Release": "1", "Arch": "amd64", "SrcName": "libedit", "SrcVersion": "3.1-20250104", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "LLVM Packaging Team \u003cpkg-llvm-team@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbsd0@0.12.2-2", "libc6@2.41-12+deb13u3", "libtinfo6@6.5+20250216-2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libedit.so.2.0.75", "/usr/share/doc/libedit2/TODO.Debian", "/usr/share/doc/libedit2/changelog.Debian.gz", "/usr/share/doc/libedit2/changelog.gz", "/usr/share/doc/libedit2/copyright", "/usr/share/lintian/overrides/libedit2", "/usr/share/man/man5/editrc.5edit.gz", "/usr/share/man/man7/editline.7edit.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libelf1t64@0.192-4", "Name": "libelf1t64", "Identifier": { "PURL": "pkg:deb/debian/libelf1t64@0.192-4?arch=amd64\u0026distro=debian-13.6", "UID": "8f02629149b09a03" }, "Version": "0.192", "Release": "4", "Arch": "amd64", "SrcName": "elfutils", "SrcVersion": "0.192", "SrcRelease": "4", "Licenses": [ "GPL-3.0-or-later", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-3.0-only", "BSD-2-Clause", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only", "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-3+ with Bison exception", "GPL-3.0-only" ], "Maintainer": "Debian Elfutils Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libelf-0.192.so", "/usr/share/doc/libelf1t64/changelog.Debian.gz", "/usr/share/doc/libelf1t64/changelog.gz", "/usr/share/doc/libelf1t64/copyright", "/usr/share/locale/de/LC_MESSAGES/elfutils.mo", "/usr/share/locale/en@boldquot/LC_MESSAGES/elfutils.mo", "/usr/share/locale/en@quot/LC_MESSAGES/elfutils.mo", "/usr/share/locale/es/LC_MESSAGES/elfutils.mo", "/usr/share/locale/ja/LC_MESSAGES/elfutils.mo", "/usr/share/locale/pl/LC_MESSAGES/elfutils.mo", "/usr/share/locale/uk/LC_MESSAGES/elfutils.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libexpat1@2.8.3-1~deb13u1", "Name": "libexpat1", "Identifier": { "PURL": "pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "bacd3a088c2a3546" }, "Version": "2.8.3", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "expat", "SrcVersion": "2.8.3", "SrcRelease": "1~deb13u1", "Licenses": [ "MIT" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libexpat.so.1.12.3", "/usr/lib/x86_64-linux-gnu/libexpatw.so.1.12.3", "/usr/share/doc/libexpat1/AUTHORS", "/usr/share/doc/libexpat1/changelog.Debian.gz", "/usr/share/doc/libexpat1/changelog.gz", "/usr/share/doc/libexpat1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libffi8@3.4.8-2", "Name": "libffi8", "Identifier": { "PURL": "pkg:deb/debian/libffi8@3.4.8-2?arch=amd64\u0026distro=debian-13.6", "UID": "9b9f5a0532948cab" }, "Version": "3.4.8", "Release": "2", "Arch": "amd64", "SrcName": "libffi", "SrcVersion": "3.4.8", "SrcRelease": "2", "Licenses": [ "MIT", "X11", "GPL-2.0-or-later", "GPL-3.0-or-later", "MPL-1.1", "LGPL-2.1-or-later", "public-domain" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libffi.so.8.1.4", "/usr/share/doc/libffi8/changelog.Debian.gz", "/usr/share/doc/libffi8/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libfftw3-double3@3.3.10-2+b1", "Name": "libfftw3-double3", "Identifier": { "PURL": "pkg:deb/debian/libfftw3-double3@3.3.10-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "832024dcfa0fd564" }, "Version": "3.3.10", "Release": "2+b1", "Arch": "amd64", "SrcName": "fftw3", "SrcVersion": "3.3.10", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Science Maintainers \u003cdebian-science-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgomp1@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libfftw3.so.3.6.10", "/usr/lib/x86_64-linux-gnu/libfftw3_omp.so.3.6.10", "/usr/lib/x86_64-linux-gnu/libfftw3_threads.so.3.6.10", "/usr/share/doc/libfftw3-double3/NEWS.gz", "/usr/share/doc/libfftw3-double3/README", "/usr/share/doc/libfftw3-double3/README.Debian", "/usr/share/doc/libfftw3-double3/changelog.Debian.amd64.gz", "/usr/share/doc/libfftw3-double3/changelog.Debian.gz", "/usr/share/doc/libfftw3-double3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libflac14@1.5.0+ds-2", "Name": "libflac14", "Identifier": { "PURL": "pkg:deb/debian/libflac14@1.5.0%2Bds-2?arch=amd64\u0026distro=debian-13.6", "UID": "4fc0cd7b86bdf831" }, "Version": "1.5.0+ds", "Release": "2", "Arch": "amd64", "SrcName": "flac", "SrcVersion": "1.5.0+ds", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "GFDL-1.1-or-later", "GFDL-1.2-only", "BSD-3-Clause", "LGPL-2.0-or-later", "LGPL-2.0-only", "Public-domain", "ISC", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libogg0@1.3.5-3+b2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libFLAC.so.14.0.0", "/usr/share/doc/libflac14/changelog.Debian.gz", "/usr/share/doc/libflac14/changelog.gz", "/usr/share/doc/libflac14/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libflite1@2.2-7", "Name": "libflite1", "Identifier": { "PURL": "pkg:deb/debian/libflite1@2.2-7?arch=amd64\u0026distro=debian-13.6", "UID": "78e2097252fcc171" }, "Version": "2.2", "Release": "7", "Arch": "amd64", "SrcName": "flite", "SrcVersion": "2.2", "SrcRelease": "7", "Licenses": [ "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Accessibility Team \u003cpkg-a11y-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasound2t64@1.2.14-1+deb13u1", "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libflite.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_grapheme_lang.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_grapheme_lex.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_indic_lang.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_indic_lex.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_time_awb.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_us_awb.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_us_kal.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_us_kal16.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_us_rms.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_us_slt.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmulex.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_usenglish.so.2.2", "/usr/share/doc/libflite1/changelog.Debian.gz", "/usr/share/doc/libflite1/copyright", "/usr/share/lintian/overrides/libflite1" ], "AnalyzedBy": "dpkg" }, { "ID": "libfontconfig1@2.15.0-2.3", "Name": "libfontconfig1", "Identifier": { "PURL": "pkg:deb/debian/libfontconfig1@2.15.0-2.3?arch=amd64\u0026distro=debian-13.6", "UID": "e46fd36208a48aed" }, "Version": "2.15.0", "Release": "2.3", "Arch": "amd64", "SrcName": "fontconfig", "SrcVersion": "2.15.0", "SrcRelease": "2.3", "Maintainer": "Debian freedesktop.org maintainers \u003cpkg-freedesktop-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "fontconfig-config@2.15.0-2.3", "libc6@2.41-12+deb13u3", "libexpat1@2.8.3-1~deb13u1", "libfreetype6@2.13.3+dfsg-1+deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libfontconfig.so.1.12.1", "/usr/share/doc/libfontconfig1/changelog.Debian.gz", "/usr/share/doc/libfontconfig1/changelog.gz", "/usr/share/doc/libfontconfig1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libfreetype6@2.13.3+dfsg-1+deb13u1", "Name": "libfreetype6", "Identifier": { "PURL": "pkg:deb/debian/libfreetype6@2.13.3%2Bdfsg-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "e6083f32eda39325" }, "Version": "2.13.3+dfsg", "Release": "1+deb13u1", "Arch": "amd64", "SrcName": "freetype", "SrcVersion": "2.13.3+dfsg", "SrcRelease": "1+deb13u1", "Licenses": [ "FTL", "MIT", "BSD-3-Clause", "FSFAP", "GPL-3.0-or-later", "GPL-2.0-or-later", "Public-Domain", "MIT-SMC", "BSL-1.0", "MIT-Modern-Variant", "Zlib", "OpenGroup-MIT", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Hugh McMaster \u003chmc@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbrotli1@1.1.0-2+b7", "libbz2-1.0@1.0.8-6", "libc6@2.41-12+deb13u3", "libpng16-16t64@1.6.48-1+deb13u5", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libfreetype.so.6.20.2", "/usr/share/doc/libfreetype6/README", "/usr/share/doc/libfreetype6/changelog.Debian.gz", "/usr/share/doc/libfreetype6/changelog.gz", "/usr/share/doc/libfreetype6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libfribidi0@1.0.16-1", "Name": "libfribidi0", "Identifier": { "PURL": "pkg:deb/debian/libfribidi0@1.0.16-1?arch=amd64\u0026distro=debian-13.6", "UID": "33067076f781866c" }, "Version": "1.0.16", "Release": "1", "Arch": "amd64", "SrcName": "fribidi", "SrcVersion": "1.0.16", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only" ], "Maintainer": "Debian Hebrew Packaging Team \u003cteam+hebrew@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libfribidi.so.0.4.0", "/usr/share/doc/libfribidi0/NEWS.gz", "/usr/share/doc/libfribidi0/README", "/usr/share/doc/libfribidi0/THANKS", "/usr/share/doc/libfribidi0/TODO", "/usr/share/doc/libfribidi0/changelog.Debian.gz", "/usr/share/doc/libfribidi0/changelog.gz", "/usr/share/doc/libfribidi0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgbm1@25.0.7-2+deb13u1", "Name": "libgbm1", "Identifier": { "PURL": "pkg:deb/debian/libgbm1@25.0.7-2%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "9b85a73682bcb1c4" }, "Version": "25.0.7", "Release": "2+deb13u1", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "25.0.7", "SrcRelease": "2+deb13u1", "Licenses": [ "MIT", "GPL-2.0-only", "GPL-1.0-or-later", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdrm2@2.4.124-2", "libexpat1@2.8.3-1~deb13u1", "libwayland-server0@1.23.1-3", "mesa-libgallium@25.0.7-2+deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/gbm/dri_gbm.so", "/usr/lib/x86_64-linux-gnu/libgbm.so.1.0.0", "/usr/share/bug/libgbm1/control", "/usr/share/bug/libgbm1/script", "/usr/share/doc/libgbm1/changelog.Debian.gz", "/usr/share/doc/libgbm1/changelog.gz", "/usr/share/doc/libgbm1/copyright", "/usr/share/lintian/overrides/libgbm1" ], "AnalyzedBy": "dpkg" }, { "ID": "libgcc-s1@14.2.0-19", "Name": "libgcc-s1", "Identifier": { "PURL": "pkg:deb/debian/libgcc-s1@14.2.0-19?arch=amd64\u0026distro=debian-13.6", "UID": "6ebf985ba3bd76f3" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgcc_s.so.1", "/usr/share/lintian/overrides/libgcc-s1" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdbm6t64@1.24-2", "Name": "libgdbm6t64", "Identifier": { "PURL": "pkg:deb/debian/libgdbm6t64@1.24-2?arch=amd64\u0026distro=debian-13.6", "UID": "942142133e693ac4" }, "Version": "1.24", "Release": "2", "Arch": "amd64", "SrcName": "gdbm", "SrcVersion": "1.24", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-2.0-or-later", "GFDL-1.3-no-invariants-or-later", "GPL-3.0-only", "GPL-2.0-only" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgdbm.so.6.0.0", "/usr/share/doc/libgdbm6t64/changelog.Debian.gz", "/usr/share/doc/libgdbm6t64/changelog.gz", "/usr/share/doc/libgdbm6t64/copyright", "/usr/share/lintian/overrides/libgdbm6t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdk-pixbuf-2.0-0@2.42.12+dfsg-4+deb13u1", "Name": "libgdk-pixbuf-2.0-0", "Identifier": { "PURL": "pkg:deb/debian/libgdk-pixbuf-2.0-0@2.42.12%2Bdfsg-4%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "4e8aadaea54f5149" }, "Version": "2.42.12+dfsg", "Release": "4+deb13u1", "Arch": "amd64", "SrcName": "gdk-pixbuf", "SrcVersion": "2.42.12+dfsg", "SrcRelease": "4+deb13u1", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "CC0-1.0", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgdk-pixbuf2.0-common@2.42.12+dfsg-4+deb13u1", "libglib2.0-0t64@2.84.4-3~deb13u5", "libjpeg62-turbo@1:2.1.5-4", "libpng16-16t64@1.6.48-1+deb13u5", "libtiff6@4.7.0-3+deb13u3", "shared-mime-info@2.4-5+b2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-ani.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-bmp.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-gif.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-icns.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-ico.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-pnm.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-qtif.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-tga.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-tiff.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-xbm.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-xpm.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders", "/usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4200.12", "/usr/share/doc/libgdk-pixbuf-2.0-0/NEWS.gz", "/usr/share/doc/libgdk-pixbuf-2.0-0/README.md", "/usr/share/doc/libgdk-pixbuf-2.0-0/changelog.Debian.gz", "/usr/share/doc/libgdk-pixbuf-2.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdk-pixbuf2.0-common@2.42.12+dfsg-4+deb13u1", "Name": "libgdk-pixbuf2.0-common", "Identifier": { "PURL": "pkg:deb/debian/libgdk-pixbuf2.0-common@2.42.12%2Bdfsg-4%2Bdeb13u1?arch=all\u0026distro=debian-13.6", "UID": "67e8c4cd275d5e0d" }, "Version": "2.42.12+dfsg", "Release": "4+deb13u1", "Arch": "all", "SrcName": "gdk-pixbuf", "SrcVersion": "2.42.12+dfsg", "SrcRelease": "4+deb13u1", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "CC0-1.0", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/doc/libgdk-pixbuf2.0-common/changelog.Debian.gz", "/usr/share/doc/libgdk-pixbuf2.0-common/copyright", "/usr/share/locale/ab/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/af/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ang/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ar/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/as/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ast/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/az/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/be/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/be@latin/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/bg/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/bn/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/bn_IN/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/br/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/bs/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ca/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ca@valencia/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/crh/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/cs/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/csb/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/cy/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/da/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/de/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/dz/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/el/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/en@shaw/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/en_CA/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/en_GB/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/eo/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/es/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/et/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/eu/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/fa/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/fi/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/fr/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/fur/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ga/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/gl/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/gu/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/he/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/hi/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/hr/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/hu/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/hy/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ia/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/id/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/io/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/is/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/it/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ja/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ka/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/kab/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/kk/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/km/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/kn/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ko/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ku/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/li/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/lt/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/lv/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/mai/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/mi/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/mk/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ml/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/mn/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/mr/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ms/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/my/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/nb/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/nds/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ne/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/nl/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/nn/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/nso/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/oc/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/or/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/pa/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/pl/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ps/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/pt/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ro/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ru/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/si/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sk/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sl/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sq/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sr/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sr@ije/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sr@latin/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sv/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ta/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/te/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/tg/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/th/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/tk/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/tr/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/tt/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ug/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/uk/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/uz/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/uz@cyrillic/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/vi/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/wa/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/xh/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/yi/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/zh_HK/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/gdk-pixbuf.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libgfortran5@14.2.0-19", "Name": "libgfortran5", "Identifier": { "PURL": "pkg:deb/debian/libgfortran5@14.2.0-19?arch=amd64\u0026distro=debian-13.6", "UID": "e5155d68fa949786" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgfortran.so.5.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libgl1@1.7.0-1+b2", "Name": "libgl1", "Identifier": { "PURL": "pkg:deb/debian/libgl1@1.7.0-1%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "97f1f49bd8266b51" }, "Version": "1.7.0", "Release": "1+b2", "Arch": "amd64", "SrcName": "libglvnd", "SrcVersion": "1.7.0", "SrcRelease": "1", "Licenses": [ "MIT", "Apache-2.0", "public-domain", "GPL-3.0-or-later", "BSD-1-Clause", "GPL-2.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libglvnd0@1.7.0-1+b2", "libglx0@1.7.0-1+b2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libGL.so.1.7.0", "/usr/share/bug/libgl1/control", "/usr/share/doc/libgl1/changelog.Debian.amd64.gz", "/usr/share/doc/libgl1/changelog.Debian.gz", "/usr/share/doc/libgl1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgl1-mesa-dri@25.0.7-2+deb13u1", "Name": "libgl1-mesa-dri", "Identifier": { "PURL": "pkg:deb/debian/libgl1-mesa-dri@25.0.7-2%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "2b36df3e97cbcead" }, "Version": "25.0.7", "Release": "2+deb13u1", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "25.0.7", "SrcRelease": "2+deb13u1", "Licenses": [ "MIT", "GPL-2.0-only", "GPL-1.0-or-later", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgbm1@25.0.7-2+deb13u1", "libvulkan1@1.4.309.0-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/dri/libdril_dri.so", "/usr/share/bug/libgl1-mesa-dri/control", "/usr/share/bug/libgl1-mesa-dri/script", "/usr/share/doc/libgl1-mesa-dri/changelog.Debian.gz", "/usr/share/doc/libgl1-mesa-dri/changelog.gz", "/usr/share/doc/libgl1-mesa-dri/copyright", "/usr/share/drirc.d/00-mesa-defaults.conf" ], "AnalyzedBy": "dpkg" }, { "ID": "libglib2.0-0t64@2.84.4-3~deb13u5", "Name": "libglib2.0-0t64", "Identifier": { "PURL": "pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "c1d1f30dc16e75f4" }, "Version": "2.84.4", "Release": "3~deb13u5", "Arch": "amd64", "SrcName": "glib2.0", "SrcVersion": "2.84.4", "SrcRelease": "3~deb13u5", "Licenses": [ "LGPL-2.1-or-later", "old-glib-tests", "AFL-2.0", "Janik-permissive", "LGPL-2.0-or-later", "CC0-1.0", "FSFULLR", "Iconv-PD", "Mingw-PD", "Unicode-DFS-2016", "MIT", "GPL-2.0-or-later", "LGPL-3.0-or-later", "Apache-2.0 with LLVM exception", "Kuchling-PD", "Plumb-PD", "bzip2-1.0.6", "CC-BY-SA-3.0", "cmph", "LGPL-2.0-only", "LGPL-2.1-only", "MPL-1.1", "Apache-2.0", "GPL-2.0-only", "LGPL-3.0-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libatomic1@14.2.0-19", "libc6@2.41-12+deb13u3", "libffi8@3.4.8-2", "libmount1@2.41.5-0+deb13u1", "libpcre2-8-0@10.46-1~deb13u1", "libselinux1@3.8.1-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/glib-2.0/gio-launch-desktop", "/usr/lib/x86_64-linux-gnu/glib-2.0/gio-querymodules", "/usr/lib/x86_64-linux-gnu/glib-2.0/glib-compile-schemas", "/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0.8400.4", "/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.8400.4", "/usr/lib/x86_64-linux-gnu/libgmodule-2.0.so.0.8400.4", "/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.8400.4", "/usr/lib/x86_64-linux-gnu/libgthread-2.0.so.0.8400.4", "/usr/share/doc/libglib2.0-0t64/NEWS.gz", "/usr/share/doc/libglib2.0-0t64/README.Debian", "/usr/share/doc/libglib2.0-0t64/README.md", "/usr/share/doc/libglib2.0-0t64/changelog.Debian.gz", "/usr/share/doc/libglib2.0-0t64/copyright", "/usr/share/lintian/overrides/libglib2.0-0t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libglvnd0@1.7.0-1+b2", "Name": "libglvnd0", "Identifier": { "PURL": "pkg:deb/debian/libglvnd0@1.7.0-1%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "723682e9fb1ef60f" }, "Version": "1.7.0", "Release": "1+b2", "Arch": "amd64", "SrcName": "libglvnd", "SrcVersion": "1.7.0", "SrcRelease": "1", "Licenses": [ "MIT", "Apache-2.0", "public-domain", "GPL-3.0-or-later", "BSD-1-Clause", "GPL-2.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libGLdispatch.so.0.0.0", "/usr/share/bug/libglvnd0/control", "/usr/share/doc/libglvnd0/changelog.Debian.amd64.gz", "/usr/share/doc/libglvnd0/changelog.Debian.gz", "/usr/share/doc/libglvnd0/copyright", "/usr/share/lintian/overrides/libglvnd0" ], "AnalyzedBy": "dpkg" }, { "ID": "libglx-mesa0@25.0.7-2+deb13u1", "Name": "libglx-mesa0", "Identifier": { "PURL": "pkg:deb/debian/libglx-mesa0@25.0.7-2%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "b94f507e9a1bc770" }, "Version": "25.0.7", "Release": "2+deb13u1", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "25.0.7", "SrcRelease": "2+deb13u1", "Licenses": [ "MIT", "GPL-2.0-only", "GPL-1.0-or-later", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdrm2@2.4.124-2", "libexpat1@2.8.3-1~deb13u1", "libgl1-mesa-dri@25.0.7-2+deb13u1", "libx11-6@2:1.8.12-1", "libx11-xcb1@2:1.8.12-1", "libxcb-dri3-0@1.17.0-2+b1", "libxcb-glx0@1.17.0-2+b1", "libxcb-present0@1.17.0-2+b1", "libxcb-shm0@1.17.0-2+b1", "libxcb-xfixes0@1.17.0-2+b1", "libxcb1@1.17.0-2+b1", "libxext6@2:1.3.4-1+b3", "libxxf86vm1@1:1.1.4-1+b4", "mesa-libgallium@25.0.7-2+deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libGLX_mesa.so.0.0.0", "/usr/share/bug/libglx-mesa0/control", "/usr/share/bug/libglx-mesa0/script", "/usr/share/doc/libglx-mesa0/changelog.Debian.gz", "/usr/share/doc/libglx-mesa0/changelog.gz", "/usr/share/doc/libglx-mesa0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libglx0@1.7.0-1+b2", "Name": "libglx0", "Identifier": { "PURL": "pkg:deb/debian/libglx0@1.7.0-1%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "cf4d93221d7d4254" }, "Version": "1.7.0", "Release": "1+b2", "Arch": "amd64", "SrcName": "libglvnd", "SrcVersion": "1.7.0", "SrcRelease": "1", "Licenses": [ "MIT", "Apache-2.0", "public-domain", "GPL-3.0-or-later", "BSD-1-Clause", "GPL-2.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libglvnd0@1.7.0-1+b2", "libglx-mesa0@25.0.7-2+deb13u1", "libx11-6@2:1.8.12-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libGLX.so.0.0.0", "/usr/share/bug/libglx0/control", "/usr/share/doc/libglx0/changelog.Debian.amd64.gz", "/usr/share/doc/libglx0/changelog.Debian.gz", "/usr/share/doc/libglx0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgme0@0.6.3-7+b2", "Name": "libgme0", "Identifier": { "PURL": "pkg:deb/debian/libgme0@0.6.3-7%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "360509d974ddbb4b" }, "Version": "0.6.3", "Release": "7+b2", "Arch": "amd64", "SrcName": "game-music-emu", "SrcVersion": "0.6.3", "SrcRelease": "7", "Licenses": [ "LGPL-2.1-or-later", "MIT", "LGPL-2.1-only" ], "Maintainer": "Ileana Dumitrescu \u003cileanadumitrescu95@gmail.com\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libstdc++6@14.2.0-19", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgme.so.0.6.3", "/usr/share/doc/libgme0/changelog.Debian.amd64.gz", "/usr/share/doc/libgme0/changelog.Debian.gz", "/usr/share/doc/libgme0/changelog.gz", "/usr/share/doc/libgme0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgmp10@2:6.3.0+dfsg-3", "Name": "libgmp10", "Identifier": { "PURL": "pkg:deb/debian/libgmp10@6.3.0%2Bdfsg-3?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "fec85c1b440262e2" }, "Version": "6.3.0+dfsg", "Release": "3", "Epoch": 2, "Arch": "amd64", "SrcName": "gmp", "SrcVersion": "6.3.0+dfsg", "SrcRelease": "3", "SrcEpoch": 2, "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later", "GPL-3.0-or-later", "GPL-3+ with Bison exception", "GPL-2.0-only", "GPL-3.0-only", "LGPL-3.0-only" ], "Maintainer": "Debian Science Maintainers \u003cdebian-science-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgmp.so.10.5.0", "/usr/share/doc/libgmp10/README.Debian", "/usr/share/doc/libgmp10/changelog.Debian.gz", "/usr/share/doc/libgmp10/changelog.gz", "/usr/share/doc/libgmp10/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgnutls30t64@3.8.9-3+deb13u4", "Name": "libgnutls30t64", "Identifier": { "PURL": "pkg:deb/debian/libgnutls30t64@3.8.9-3%2Bdeb13u4?arch=amd64\u0026distro=debian-13.6", "UID": "8460d7a536007c2b" }, "Version": "3.8.9", "Release": "3+deb13u4", "Arch": "amd64", "SrcName": "gnutls28", "SrcVersion": "3.8.9", "SrcRelease": "3+deb13u4", "Licenses": [ "LGPL-2.1-only", "LGPL-2.0-or-later", "LGPL-3.0-only", "GPL-2.0-or-later", "GPL-3.0-only", "GFDL-1.3-only", "CC0-1.0", "MIT", "Apache-2.0", "LGPL-3.0-or-later", "LGPL-2.1-or-later", "GPL-3.0-or-later", "BSD-3-Clause", "FSFAP" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgmp10@2:6.3.0+dfsg-3", "libhogweed6t64@3.10.1-1", "libidn2-0@2.3.8-2", "libnettle8t64@3.10.1-1", "libp11-kit0@0.25.5-3", "libtasn1-6@4.20.0-2+deb13u1", "libunistring5@1.3-2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgnutls.so.30.40.3", "/usr/share/doc/libgnutls30t64/AUTHORS.gz", "/usr/share/doc/libgnutls30t64/NEWS.gz", "/usr/share/doc/libgnutls30t64/README.md.gz", "/usr/share/doc/libgnutls30t64/THANKS.gz", "/usr/share/doc/libgnutls30t64/changelog.Debian.gz", "/usr/share/doc/libgnutls30t64/changelog.gz", "/usr/share/doc/libgnutls30t64/copyright", "/usr/share/lintian/overrides/libgnutls30t64", "/usr/share/locale/cs/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/de/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/eo/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/es/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/fi/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/fr/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/it/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ka/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ms/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/nl/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/pl/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ro/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/sr/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/sv/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/uk/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/vi/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/gnutls30.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libgomp1@14.2.0-19", "Name": "libgomp1", "Identifier": { "PURL": "pkg:deb/debian/libgomp1@14.2.0-19?arch=amd64\u0026distro=debian-13.6", "UID": "7677b3b5e38dcec7" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgomp.so.1.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libgraphite2-3@1.3.14-2+deb13u1", "Name": "libgraphite2-3", "Identifier": { "PURL": "pkg:deb/debian/libgraphite2-3@1.3.14-2%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "22eda21798727af8" }, "Version": "1.3.14", "Release": "2+deb13u1", "Arch": "amd64", "SrcName": "graphite2", "SrcVersion": "1.3.14", "SrcRelease": "2+deb13u1", "Licenses": [ "LGPL-2.1-or-later", "MPL-1.1", "GPL-2.0-or-later", "public-domain", "Artistic-2.0", "GPL-1.0-or-later", "custom-sil-open-font-license", "GPL-1.0-only", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian LibreOffice Maintainers \u003cdebian-openoffice@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgraphite2.so.3.2.1", "/usr/share/doc/libgraphite2-3/changelog.Debian.gz", "/usr/share/doc/libgraphite2-3/changelog.gz", "/usr/share/doc/libgraphite2-3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgsm1@1.0.22-1+b2", "Name": "libgsm1", "Identifier": { "PURL": "pkg:deb/debian/libgsm1@1.0.22-1%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "94194d5bd63dfb3b" }, "Version": "1.0.22", "Release": "1+b2", "Arch": "amd64", "SrcName": "libgsm", "SrcVersion": "1.0.22", "SrcRelease": "1", "Licenses": [ "TU-Berlin-2.0" ], "Maintainer": "Debian Mobcom Maintainers \u003cDebian-mobcom-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgsm.so.1.0.19", "/usr/share/doc/libgsm1/MACHINES", "/usr/share/doc/libgsm1/README", "/usr/share/doc/libgsm1/README.Debian", "/usr/share/doc/libgsm1/changelog.Debian.amd64.gz", "/usr/share/doc/libgsm1/changelog.Debian.gz", "/usr/share/doc/libgsm1/changelog.gz", "/usr/share/doc/libgsm1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgssapi-krb5-2@1.21.3-5+deb13u1", "Name": "libgssapi-krb5-2", "Identifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "8562fe1c97f9995" }, "Version": "1.21.3", "Release": "5+deb13u1", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5+deb13u1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcom-err2@1.47.2-3+b12", "libk5crypto3@1.21.3-5+deb13u1", "libkrb5-3@1.21.3-5+deb13u1", "libkrb5support0@1.21.3-5+deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2", "/usr/share/doc/libgssapi-krb5-2/changelog.Debian.gz", "/usr/share/doc/libgssapi-krb5-2/copyright", "/usr/share/lintian/overrides/libgssapi-krb5-2" ], "AnalyzedBy": "dpkg" }, { "ID": "libharfbuzz0b@10.2.0-1+deb13u1", "Name": "libharfbuzz0b", "Identifier": { "PURL": "pkg:deb/debian/libharfbuzz0b@10.2.0-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "6e7e7fb38b0a0dd7" }, "Version": "10.2.0", "Release": "1+deb13u1", "Arch": "amd64", "SrcName": "harfbuzz", "SrcVersion": "10.2.0", "SrcRelease": "1+deb13u1", "Licenses": [ "MIT", "Unicode", "ISC", "Apache-2.0", "OFL-1.1", "Monotype", "CC0-1.0", "GPL-3.0-or-later", "GPL-2+ with Font exception", "UFL-1.0", "FSFULLR", "GPL-2.0-with-autoconf-exception+", "GPL-3.0-with-autoconf-exception+", "FSFAP", "LGPL-2.1-or-later", "GPL-2+ with LibTool exception", "FSFUL", "GPL-2.0-only", "GPL-3.0-only", "LGPL-2.1-only" ], "Maintainer": "أحمد المحمودي (Ahmed El-Mahmoudy) \u003caelmahmoudy@users.sourceforge.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libfreetype6@2.13.3+dfsg-1+deb13u1", "libglib2.0-0t64@2.84.4-3~deb13u5", "libgraphite2-3@1.3.14-2+deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0.61020.0", "/usr/share/doc/libharfbuzz0b/changelog.Debian.gz", "/usr/share/doc/libharfbuzz0b/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libhogweed6t64@3.10.1-1", "Name": "libhogweed6t64", "Identifier": { "PURL": "pkg:deb/debian/libhogweed6t64@3.10.1-1?arch=amd64\u0026distro=debian-13.6", "UID": "8a048285d77ff6c0" }, "Version": "3.10.1", "Release": "1", "Arch": "amd64", "SrcName": "nettle", "SrcVersion": "3.10.1", "SrcRelease": "1", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "MIT", "GPL-3.0-with-autoconf-exception+", "public-domain", "GPL-2.0-only", "GAP" ], "Maintainer": "Magnus Holmgren \u003cholmgren@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgmp10@2:6.3.0+dfsg-3", "libnettle8t64@3.10.1-1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhogweed.so.6.10", "/usr/share/doc/libhogweed6t64/changelog.Debian.gz", "/usr/share/doc/libhogweed6t64/changelog.gz", "/usr/share/doc/libhogweed6t64/copyright", "/usr/share/lintian/overrides/libhogweed6t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libhwy1t64@1.2.0-2+b2", "Name": "libhwy1t64", "Identifier": { "PURL": "pkg:deb/debian/libhwy1t64@1.2.0-2%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "6640199ecb81c959" }, "Version": "1.2.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "highway", "SrcVersion": "1.2.0", "SrcRelease": "2", "Licenses": [ "Apache-2.0" ], "Maintainer": "Debian PhotoTools Maintainers \u003cpkg-phototools-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhwy.so.1.2.0", "/usr/lib/x86_64-linux-gnu/libhwy_contrib.so.1.2.0", "/usr/lib/x86_64-linux-gnu/libhwy_test.so.1.2.0", "/usr/share/doc/libhwy1t64/changelog.Debian.amd64.gz", "/usr/share/doc/libhwy1t64/changelog.Debian.gz", "/usr/share/doc/libhwy1t64/copyright", "/usr/share/lintian/overrides/libhwy1t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libidn2-0@2.3.8-2", "Name": "libidn2-0", "Identifier": { "PURL": "pkg:deb/debian/libidn2-0@2.3.8-2?arch=amd64\u0026distro=debian-13.6", "UID": "52b3aaa65fda94bc" }, "Version": "2.3.8", "Release": "2", "Arch": "amd64", "SrcName": "libidn2", "SrcVersion": "2.3.8", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "LGPL-3.0-or-later", "GPL-2.0-or-later", "MIT", "Unicode", "GPL-3.0-only", "GPL-2.0-only", "LGPL-3.0-only" ], "Maintainer": "Debian Libidn team \u003chelp-libidn@gnu.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libunistring5@1.3-2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libidn2.so.0.4.0", "/usr/share/doc/libidn2-0/AUTHORS", "/usr/share/doc/libidn2-0/NEWS.gz", "/usr/share/doc/libidn2-0/README.md.gz", "/usr/share/doc/libidn2-0/changelog.Debian.gz", "/usr/share/doc/libidn2-0/copyright", "/usr/share/lintian/overrides/libidn2-0", "/usr/share/locale/cs/LC_MESSAGES/libidn2.mo", "/usr/share/locale/da/LC_MESSAGES/libidn2.mo", "/usr/share/locale/de/LC_MESSAGES/libidn2.mo", "/usr/share/locale/eo/LC_MESSAGES/libidn2.mo", "/usr/share/locale/es/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fi/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fur/LC_MESSAGES/libidn2.mo", "/usr/share/locale/hr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/hu/LC_MESSAGES/libidn2.mo", "/usr/share/locale/id/LC_MESSAGES/libidn2.mo", "/usr/share/locale/it/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ja/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ka/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ko/LC_MESSAGES/libidn2.mo", "/usr/share/locale/lv/LC_MESSAGES/libidn2.mo", "/usr/share/locale/nl/LC_MESSAGES/libidn2.mo", "/usr/share/locale/pl/LC_MESSAGES/libidn2.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ro/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ru/LC_MESSAGES/libidn2.mo", "/usr/share/locale/sr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/sv/LC_MESSAGES/libidn2.mo", "/usr/share/locale/uk/LC_MESSAGES/libidn2.mo", "/usr/share/locale/vi/LC_MESSAGES/libidn2.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/libidn2.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libiec61883-0@1.2.0-7", "Name": "libiec61883-0", "Identifier": { "PURL": "pkg:deb/debian/libiec61883-0@1.2.0-7?arch=amd64\u0026distro=debian-13.6", "UID": "6c19d7cddf08be01" }, "Version": "1.2.0", "Release": "7", "Arch": "amd64", "SrcName": "libiec61883", "SrcVersion": "1.2.0", "SrcRelease": "7", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.0-or-later", "GPL-2.0-or-later", "LGPL-2.1-only", "LGPL-2.0-only", "GPL-2.0-only" ], "Maintainer": "Debian QA Group \u003cpackages@qa.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libraw1394-11@2.1.2-2+b2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libiec61883.so.0.1.1", "/usr/share/doc/libiec61883-0/NEWS.gz", "/usr/share/doc/libiec61883-0/README", "/usr/share/doc/libiec61883-0/changelog.Debian.gz", "/usr/share/doc/libiec61883-0/changelog.gz", "/usr/share/doc/libiec61883-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libjack-jackd2-0@1.9.22~dfsg-4", "Name": "libjack-jackd2-0", "Identifier": { "PURL": "pkg:deb/debian/libjack-jackd2-0@1.9.22~dfsg-4?arch=amd64\u0026distro=debian-13.6", "UID": "b529e0b3db90a90d" }, "Version": "1.9.22~dfsg", "Release": "4", "Arch": "amd64", "SrcName": "jackd2", "SrcVersion": "1.9.22~dfsg", "SrcRelease": "4", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later", "GPL-2~either", "GPL-2.0-only", "LGPL-2.0-or-later", "GPL-2~or", "MIT", "BSD-3-Clause", "public-domain~Kroon", "BSD-2-Clause", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdb5.3t64@5.3.28+dfsg2-9", "libgcc-s1@14.2.0-19", "libopus0@1.5.2-2", "libsamplerate0@0.2.2-4+b2", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libjack.so.0.1.0", "/usr/lib/x86_64-linux-gnu/libjacknet.so.0.1.0", "/usr/lib/x86_64-linux-gnu/libjackserver.so.0.1.0", "/usr/share/doc/libjack-jackd2-0/changelog.Debian.gz", "/usr/share/doc/libjack-jackd2-0/changelog.gz", "/usr/share/doc/libjack-jackd2-0/copyright", "/usr/share/lintian/overrides/libjack-jackd2-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libjbig0@2.1-6.1+b2", "Name": "libjbig0", "Identifier": { "PURL": "pkg:deb/debian/libjbig0@2.1-6.1%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "4990bd22fad0369b" }, "Version": "2.1", "Release": "6.1+b2", "Arch": "amd64", "SrcName": "jbigkit", "SrcVersion": "2.1", "SrcRelease": "6.1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Michael van der Kolff \u003cmvanderkolff@gmail.com\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libjbig.so.0", "/usr/share/doc/libjbig0/changelog.Debian.amd64.gz", "/usr/share/doc/libjbig0/changelog.Debian.gz", "/usr/share/doc/libjbig0/changelog.gz", "/usr/share/doc/libjbig0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libjpeg62-turbo@1:2.1.5-4", "Name": "libjpeg62-turbo", "Identifier": { "PURL": "pkg:deb/debian/libjpeg62-turbo@2.1.5-4?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "7d9d94ae7a79eae9" }, "Version": "2.1.5", "Release": "4", "Epoch": 1, "Arch": "amd64", "SrcName": "libjpeg-turbo", "SrcVersion": "2.1.5", "SrcRelease": "4", "SrcEpoch": 1, "Licenses": [ "BSD-BY-LC-NE", "Zlib", "BSD-3-Clause", "MIT", "NTP" ], "Maintainer": "Ondřej Surý \u003condrej@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libjpeg.so.62.3.0", "/usr/share/doc/libjpeg62-turbo/changelog.Debian.gz", "/usr/share/doc/libjpeg62-turbo/changelog.gz", "/usr/share/doc/libjpeg62-turbo/copyright", "/usr/share/lintian/overrides/libjpeg62-turbo" ], "AnalyzedBy": "dpkg" }, { "ID": "libjxl0.11@0.11.2-0.1~deb13u2", "Name": "libjxl0.11", "Identifier": { "PURL": "pkg:deb/debian/libjxl0.11@0.11.2-0.1~deb13u2?arch=amd64\u0026distro=debian-13.6", "UID": "50d81aad37b99a0c" }, "Version": "0.11.2", "Release": "0.1~deb13u2", "Arch": "amd64", "SrcName": "jpeg-xl", "SrcVersion": "0.11.2", "SrcRelease": "0.1~deb13u2", "Licenses": [ "BSD-3-clause-Google", "ISC" ], "Maintainer": "Debian PhotoTools Maintainers \u003cpkg-phototools-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbrotli1@1.1.0-2+b7", "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libhwy1t64@1.2.0-2+b2", "liblcms2-2@2.16-2+deb13u2", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libjxl.so.0.11.2", "/usr/lib/x86_64-linux-gnu/libjxl_cms.so.0.11.2", "/usr/lib/x86_64-linux-gnu/libjxl_threads.so.0.11.2", "/usr/share/doc/libjxl0.11/changelog.Debian.gz", "/usr/share/doc/libjxl0.11/changelog.gz", "/usr/share/doc/libjxl0.11/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libk5crypto3@1.21.3-5+deb13u1", "Name": "libk5crypto3", "Identifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "c62ac626db2eb5f6" }, "Version": "1.21.3", "Release": "5+deb13u1", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5+deb13u1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libkrb5support0@1.21.3-5+deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1", "/usr/share/doc/libk5crypto3/changelog.Debian.gz", "/usr/share/doc/libk5crypto3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libkeyutils1@1.6.3-6", "Name": "libkeyutils1", "Identifier": { "PURL": "pkg:deb/debian/libkeyutils1@1.6.3-6?arch=amd64\u0026distro=debian-13.6", "UID": "40429856846c1f9a" }, "Version": "1.6.3", "Release": "6", "Arch": "amd64", "SrcName": "keyutils", "SrcVersion": "1.6.3", "SrcRelease": "6", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only" ], "Maintainer": "Christian Kastner \u003cckk@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libkeyutils.so.1.10", "/usr/share/doc/libkeyutils1/changelog.Debian.gz", "/usr/share/doc/libkeyutils1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libkrb5-3@1.21.3-5+deb13u1", "Name": "libkrb5-3", "Identifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "d2b66d56628da716" }, "Version": "1.21.3", "Release": "5+deb13u1", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5+deb13u1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcom-err2@1.47.2-3+b12", "libk5crypto3@1.21.3-5+deb13u1", "libkeyutils1@1.6.3-6", "libkrb5support0@1.21.3-5+deb13u1", "libssl3t64@3.5.7-1~deb13u2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so", "/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3", "/usr/share/doc/libkrb5-3/README.Debian", "/usr/share/doc/libkrb5-3/README.gz", "/usr/share/doc/libkrb5-3/changelog.Debian.gz", "/usr/share/doc/libkrb5-3/copyright", "/usr/share/lintian/overrides/libkrb5-3" ], "AnalyzedBy": "dpkg" }, { "ID": "libkrb5support0@1.21.3-5+deb13u1", "Name": "libkrb5support0", "Identifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "9a69f9b1048a28cf" }, "Version": "1.21.3", "Release": "5+deb13u1", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.21.3", "SrcRelease": "5+deb13u1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1", "/usr/share/doc/libkrb5support0/changelog.Debian.gz", "/usr/share/doc/libkrb5support0/copyright", "/usr/share/lintian/overrides/libkrb5support0" ], "AnalyzedBy": "dpkg" }, { "ID": "liblapack3@3.12.1-6", "Name": "liblapack3", "Identifier": { "PURL": "pkg:deb/debian/liblapack3@3.12.1-6?arch=amd64\u0026distro=debian-13.6", "UID": "8d81873c9af901b0" }, "Version": "3.12.1", "Release": "6", "Arch": "amd64", "SrcName": "lapack", "SrcVersion": "3.12.1", "SrcRelease": "6", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-intel" ], "Maintainer": "Debian Science Team \u003cdebian-science-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libblas3@3.12.1-6", "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libgfortran5@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/lapack/liblapack.so.3.12.1", "/usr/share/doc/liblapack3/changelog.Debian.gz", "/usr/share/doc/liblapack3/copyright", "/usr/share/lintian/overrides/liblapack3" ], "AnalyzedBy": "dpkg" }, { "ID": "liblastlog2-2@2.41.5-0+deb13u1", "Name": "liblastlog2-2", "Identifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "9b0fe2f2c9e6f842" }, "Version": "2.41.5", "Release": "0+deb13u1", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41.5", "SrcRelease": "0+deb13u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libsqlite3-0@3.46.1-7+deb13u1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblastlog2.so.2.0.0", "/usr/share/doc/liblastlog2-2/NEWS.Debian.gz", "/usr/share/doc/liblastlog2-2/changelog.Debian.gz", "/usr/share/doc/liblastlog2-2/changelog.gz", "/usr/share/doc/liblastlog2-2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblcms2-2@2.16-2+deb13u2", "Name": "liblcms2-2", "Identifier": { "PURL": "pkg:deb/debian/liblcms2-2@2.16-2%2Bdeb13u2?arch=amd64\u0026distro=debian-13.6", "UID": "c2826f51f1aeb0c6" }, "Version": "2.16", "Release": "2+deb13u2", "Arch": "amd64", "SrcName": "lcms2", "SrcVersion": "2.16", "SrcRelease": "2+deb13u2", "Licenses": [ "MIT", "GPL-3.0-only", "IJG", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Thomas Weber \u003ctweber@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblcms2.so.2.0.16", "/usr/share/doc/liblcms2-2/changelog.Debian.gz", "/usr/share/doc/liblcms2-2/changelog.gz", "/usr/share/doc/liblcms2-2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libldap2@2.6.10+dfsg-1", "Name": "libldap2", "Identifier": { "PURL": "pkg:deb/debian/libldap2@2.6.10%2Bdfsg-1?arch=amd64\u0026distro=debian-13.6", "UID": "abd34073af05c346" }, "Version": "2.6.10+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "openldap", "SrcVersion": "2.6.10+dfsg", "SrcRelease": "1", "Licenses": [ "OpenLDAP-2.8", "FSF-unlimited", "GPL-2.0-with-autoconf-exception+", "GPL-3.0-with-autoconf-exception+", "GPL-2+ with Libtool exception", "GPL-3+ with Libtool exception", "GPL-3.0-or-later", "GPL-2.0-or-later", "UMich", "F5", "JCG", "MIT-XC", "NeoSoft-permissive", "BSD-3-Clause", "Beerware", "public-domain", "BSD-4-clause-California", "BSD-3-clause-variant", "Expat-ISC", "Expat-UNM", "MIT", "BSD-3-clause-California", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian OpenLDAP Maintainers \u003cpkg-openldap-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libsasl2-2@2.1.28+dfsg1-9", "libssl3t64@3.5.7-1~deb13u2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblber.so.2.0.200", "/usr/lib/x86_64-linux-gnu/libldap.so.2.0.200", "/usr/share/doc/libldap2/NEWS.Debian.gz", "/usr/share/doc/libldap2/changelog.Debian.gz", "/usr/share/doc/libldap2/changelog.gz", "/usr/share/doc/libldap2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblerc4@4.0.0+ds-5", "Name": "liblerc4", "Identifier": { "PURL": "pkg:deb/debian/liblerc4@4.0.0%2Bds-5?arch=amd64\u0026distro=debian-13.6", "UID": "a321cbf9ebbe4db9" }, "Version": "4.0.0+ds", "Release": "5", "Arch": "amd64", "SrcName": "lerc", "SrcVersion": "4.0.0+ds", "SrcRelease": "5", "Licenses": [ "Apache-2.0" ], "Maintainer": "Debian GIS Project \u003cpkg-grass-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libLerc.so.4", "/usr/share/doc/liblerc4/NOTICE", "/usr/share/doc/liblerc4/changelog.Debian.gz", "/usr/share/doc/liblerc4/changelog.gz", "/usr/share/doc/liblerc4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblilv-0-0@0.24.26-1", "Name": "liblilv-0-0", "Identifier": { "PURL": "pkg:deb/debian/liblilv-0-0@0.24.26-1?arch=amd64\u0026distro=debian-13.6", "UID": "11fbf75abfeee2da" }, "Version": "0.24.26", "Release": "1", "Arch": "amd64", "SrcName": "lilv", "SrcVersion": "0.24.26", "SrcRelease": "1", "Licenses": [ "ISC", "0BSD" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libserd-0-0@0.32.4-1", "libsord-0-0@0.16.18-1", "libsratom-0-0@0.6.18-1", "libzix-0-0@0.6.2-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblilv-0.so.0.24.26", "/usr/share/doc/liblilv-0-0/changelog.Debian.gz", "/usr/share/doc/liblilv-0-0/changelog.gz", "/usr/share/doc/liblilv-0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libllvm19@1:19.1.7-3+b1", "Name": "libllvm19", "Identifier": { "PURL": "pkg:deb/debian/libllvm19@19.1.7-3%2Bb1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "6c91aa49d114a969" }, "Version": "19.1.7", "Release": "3+b1", "Epoch": 1, "Arch": "amd64", "SrcName": "llvm-toolchain-19", "SrcVersion": "19.1.7", "SrcRelease": "3", "SrcEpoch": 1, "Licenses": [ "APACHE-2-LLVM-EXCEPTIONS", "Apache-2.0", "MIT", "BSD-3-Clause", "solar-public-domain", "Python-2.0" ], "Maintainer": "LLVM Packaging Team \u003cpkg-llvm-team@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libedit2@3.1-20250104-1", "libffi8@3.4.8-2", "libgcc-s1@14.2.0-19", "libstdc++6@14.2.0-19", "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3", "libz3-4@4.13.3-1", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libLLVM.so.19.1", "/usr/share/doc/libllvm19/changelog.Debian.amd64.gz", "/usr/share/doc/libllvm19/changelog.Debian.gz", "/usr/share/doc/libllvm19/copyright", "/usr/share/lintian/overrides/libllvm19" ], "AnalyzedBy": "dpkg" }, { "ID": "liblz4-1@1.10.0-4", "Name": "liblz4-1", "Identifier": { "PURL": "pkg:deb/debian/liblz4-1@1.10.0-4?arch=amd64\u0026distro=debian-13.6", "UID": "c31b43410c927de" }, "Version": "1.10.0", "Release": "4", "Arch": "amd64", "SrcName": "lz4", "SrcVersion": "1.10.0", "SrcRelease": "4", "Licenses": [ "GPL-2.0-or-later", "BSD-2-Clause", "GPL-2.0-only" ], "Maintainer": "Nobuhiro Iwamatsu \u003ciwamatsu@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libxxhash0@0.8.3-2" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblz4.so.1.10.0", "/usr/share/doc/liblz4-1/changelog.Debian.gz", "/usr/share/doc/liblz4-1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblzma5@5.8.1-1+deb13u1", "Name": "liblzma5", "Identifier": { "PURL": "pkg:deb/debian/liblzma5@5.8.1-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "7c14fea99fdaf77" }, "Version": "5.8.1", "Release": "1+deb13u1", "Arch": "amd64", "SrcName": "xz-utils", "SrcVersion": "5.8.1", "SrcRelease": "1+deb13u1", "Licenses": [ "0BSD", "GPL-2.0-or-later", "LGPL-2.1-or-later", "FSFULLR", "GPL-3.0-or-later-WITH-Autoconf-exception-macro", "none", "PD", "permissive-nowarranty", "FSFUL", "noderivs", "PD-debian", "LGPL-2.1-only", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Sebastian Andrzej Siewior \u003csebastian@breakpoint.cc\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblzma.so.5.8.1", "/usr/share/doc/liblzma5/AUTHORS", "/usr/share/doc/liblzma5/NEWS.gz", "/usr/share/doc/liblzma5/THANKS.gz", "/usr/share/doc/liblzma5/changelog.Debian.gz", "/usr/share/doc/liblzma5/changelog.gz", "/usr/share/doc/liblzma5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmbedcrypto16@3.6.6-0.1~deb13u1", "Name": "libmbedcrypto16", "Identifier": { "PURL": "pkg:deb/debian/libmbedcrypto16@3.6.6-0.1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "69a4f926e90f06a4" }, "Version": "3.6.6", "Release": "0.1~deb13u1", "Arch": "amd64", "SrcName": "mbedtls", "SrcVersion": "3.6.6", "SrcRelease": "0.1~deb13u1", "Licenses": [ "Apache-2.0", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian IoT Maintainers \u003cdebian-iot-maintainers@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmbedcrypto.so.3.6.6", "/usr/share/doc/libmbedcrypto16/changelog.Debian.gz", "/usr/share/doc/libmbedcrypto16/changelog.gz", "/usr/share/doc/libmbedcrypto16/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmd0@1.1.0-2+b1", "Name": "libmd0", "Identifier": { "PURL": "pkg:deb/debian/libmd0@1.1.0-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "f3971c5b48c68b3c" }, "Version": "1.1.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libmd", "SrcVersion": "1.1.0", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-Aaron-D-Gifford", "BSD-2-Clause", "BSD-2-Clause-NetBSD", "ISC", "Beerware", "public-domain-md4", "public-domain-md5", "public-domain-sha1" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmd.so.0.1.0", "/usr/share/doc/libmd0/changelog.Debian.amd64.gz", "/usr/share/doc/libmd0/changelog.Debian.gz", "/usr/share/doc/libmd0/changelog.gz", "/usr/share/doc/libmd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmount1@2.41.5-0+deb13u1", "Name": "libmount1", "Identifier": { "PURL": "pkg:deb/debian/libmount1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "b26c2651b95c08c5" }, "Version": "2.41.5", "Release": "0+deb13u1", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41.5", "SrcRelease": "0+deb13u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libblkid1@2.41.5-0+deb13u1", "libc6@2.41-12+deb13u3", "libselinux1@3.8.1-1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmount.so.1.1.0", "/usr/share/doc/libmount1/NEWS.Debian.gz", "/usr/share/doc/libmount1/changelog.Debian.gz", "/usr/share/doc/libmount1/changelog.gz", "/usr/share/doc/libmount1/copyright", "/usr/share/lintian/overrides/libmount1" ], "AnalyzedBy": "dpkg" }, { "ID": "libmp3lame0@3.100-6+b3", "Name": "libmp3lame0", "Identifier": { "PURL": "pkg:deb/debian/libmp3lame0@3.100-6%2Bb3?arch=amd64\u0026distro=debian-13.6", "UID": "ce50faa824039251" }, "Version": "3.100", "Release": "6+b3", "Arch": "amd64", "SrcName": "lame", "SrcVersion": "3.100", "SrcRelease": "6", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "zlib-acknowledgement", "BSD-3-Clause", "GPL-1.0-or-later", "GPL-1.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmp3lame.so.0.0.0", "/usr/share/doc/libmp3lame0/changelog.Debian.amd64.gz", "/usr/share/doc/libmp3lame0/changelog.Debian.gz", "/usr/share/doc/libmp3lame0/changelog.gz", "/usr/share/doc/libmp3lame0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmpg123-0t64@1.32.10-1+deb13u1", "Name": "libmpg123-0t64", "Identifier": { "PURL": "pkg:deb/debian/libmpg123-0t64@1.32.10-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "707a1ade6c9e288b" }, "Version": "1.32.10", "Release": "1+deb13u1", "Arch": "amd64", "SrcName": "mpg123", "SrcVersion": "1.32.10", "SrcRelease": "1+deb13u1", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmpg123.so.0.48.3", "/usr/share/doc/libmpg123-0t64/changelog.Debian.gz", "/usr/share/doc/libmpg123-0t64/changelog.gz", "/usr/share/doc/libmpg123-0t64/copyright", "/usr/share/lintian/overrides/libmpg123-0t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libmysofa1@1.3.3+dfsg-1", "Name": "libmysofa1", "Identifier": { "PURL": "pkg:deb/debian/libmysofa1@1.3.3%2Bdfsg-1?arch=amd64\u0026distro=debian-13.6", "UID": "e6ef238f2f88b940" }, "Version": "1.3.3+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "libmysofa", "SrcVersion": "1.3.3+dfsg", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "public-domain", "listen-ircam", "mit-kemar", "CC-BY-SA-3.0", "CC-BY-4.0", "cipic" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmysofa.so.1.3.3", "/usr/share/doc/libmysofa1/changelog.Debian.gz", "/usr/share/doc/libmysofa1/copyright", "/usr/share/libmysofa/MIT_KEMAR_normal_pinna.sofa" ], "AnalyzedBy": "dpkg" }, { "ID": "libncursesw6@6.5+20250216-2", "Name": "libncursesw6", "Identifier": { "PURL": "pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.6", "UID": "c7a5d333a8ad931e" }, "Version": "6.5+20250216", "Release": "2", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libtinfo6@6.5+20250216-2" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libformw.so.6.5", "/usr/lib/x86_64-linux-gnu/libmenuw.so.6.5", "/usr/lib/x86_64-linux-gnu/libncursesw.so.6.5", "/usr/lib/x86_64-linux-gnu/libpanelw.so.6.5" ], "AnalyzedBy": "dpkg" }, { "ID": "libnettle8t64@3.10.1-1", "Name": "libnettle8t64", "Identifier": { "PURL": "pkg:deb/debian/libnettle8t64@3.10.1-1?arch=amd64\u0026distro=debian-13.6", "UID": "fd78e15d23b25c1f" }, "Version": "3.10.1", "Release": "1", "Arch": "amd64", "SrcName": "nettle", "SrcVersion": "3.10.1", "SrcRelease": "1", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "MIT", "GPL-3.0-with-autoconf-exception+", "public-domain", "GPL-2.0-only", "GAP" ], "Maintainer": "Magnus Holmgren \u003cholmgren@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnettle.so.8.10", "/usr/share/doc/libnettle8t64/NEWS.gz", "/usr/share/doc/libnettle8t64/README", "/usr/share/doc/libnettle8t64/changelog.Debian.gz", "/usr/share/doc/libnettle8t64/changelog.gz", "/usr/share/doc/libnettle8t64/copyright", "/usr/share/lintian/overrides/libnettle8t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libnghttp2-14@1.64.0-1.1+deb13u1", "Name": "libnghttp2-14", "Identifier": { "PURL": "pkg:deb/debian/libnghttp2-14@1.64.0-1.1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "a7ff7fecdde3e964" }, "Version": "1.64.0", "Release": "1.1+deb13u1", "Arch": "amd64", "SrcName": "nghttp2", "SrcVersion": "1.64.0", "SrcRelease": "1.1+deb13u1", "Licenses": [ "MIT", "all-permissive", "GPL-3.0-with-autoconf-exception+", "BSD-2-Clause", "GPL-3.0-only" ], "Maintainer": "Tomasz Buchert \u003ctomasz@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnghttp2.so.14.28.3", "/usr/share/doc/libnghttp2-14/AUTHORS", "/usr/share/doc/libnghttp2-14/README.rst.gz", "/usr/share/doc/libnghttp2-14/changelog.Debian.gz", "/usr/share/doc/libnghttp2-14/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libnghttp3-9@1.8.0-1", "Name": "libnghttp3-9", "Identifier": { "PURL": "pkg:deb/debian/libnghttp3-9@1.8.0-1?arch=amd64\u0026distro=debian-13.6", "UID": "aee3592d5bb90e6b" }, "Version": "1.8.0", "Release": "1", "Arch": "amd64", "SrcName": "nghttp3", "SrcVersion": "1.8.0", "SrcRelease": "1", "Licenses": [ "MIT", "FSFULLR", "GPL-3+ with Autoconf generic exception", "FSFUL", "GPL-2+ with Autoconf generic exception", "FSFAP", "GPL-2+ with Libtool Exception", "GPL-3.0-or-later", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Curl Maintainers \u003cteam+curl@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnghttp3.so.9.2.6", "/usr/share/doc/libnghttp3-9/changelog.Debian.gz", "/usr/share/doc/libnghttp3-9/changelog.gz", "/usr/share/doc/libnghttp3-9/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libnorm1t64@1.5.9+dfsg-3.1+b2", "Name": "libnorm1t64", "Identifier": { "PURL": "pkg:deb/debian/libnorm1t64@1.5.9%2Bdfsg-3.1%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "ed4b5e8dcc4d3dbd" }, "Version": "1.5.9+dfsg", "Release": "3.1+b2", "Arch": "amd64", "SrcName": "norm", "SrcVersion": "1.5.9+dfsg", "SrcRelease": "3.1", "Licenses": [ "NRL-2-clause", "NRL-3-clause", "BSD-2-Clause", "BSD-4-Clause-UC", "BSD-3-Clause" ], "Maintainer": "Luca Boccassi \u003cbluca@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnorm.so.1", "/usr/share/doc/libnorm1t64/changelog.Debian.amd64.gz", "/usr/share/doc/libnorm1t64/changelog.Debian.gz", "/usr/share/doc/libnorm1t64/copyright", "/usr/share/lintian/overrides/libnorm1t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libnuma1@2.0.19-1", "Name": "libnuma1", "Identifier": { "PURL": "pkg:deb/debian/libnuma1@2.0.19-1?arch=amd64\u0026distro=debian-13.6", "UID": "1187b4ecd4652de9" }, "Version": "2.0.19", "Release": "1", "Arch": "amd64", "SrcName": "numactl", "SrcVersion": "2.0.19", "SrcRelease": "1", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later" ], "Maintainer": "Ian Wienand \u003cianw@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0", "/usr/share/doc/libnuma1/changelog.Debian.gz", "/usr/share/doc/libnuma1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libogg0@1.3.5-3+b2", "Name": "libogg0", "Identifier": { "PURL": "pkg:deb/debian/libogg0@1.3.5-3%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "742f216eeb946c61" }, "Version": "1.3.5", "Release": "3+b2", "Arch": "amd64", "SrcName": "libogg", "SrcVersion": "1.3.5", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause", "rfc3533-license", "rfc5334-license" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libogg.so.0.8.5", "/usr/share/doc/libogg0/changelog.Debian.amd64.gz", "/usr/share/doc/libogg0/changelog.Debian.gz", "/usr/share/doc/libogg0/changelog.gz", "/usr/share/doc/libogg0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libopenal-data@1:1.24.2-1", "Name": "libopenal-data", "Identifier": { "PURL": "pkg:deb/debian/libopenal-data@1.24.2-1?arch=all\u0026distro=debian-13.6\u0026epoch=1", "UID": "bf5d0095512bf5f3" }, "Version": "1.24.2", "Release": "1", "Epoch": 1, "Arch": "all", "SrcName": "openal-soft", "SrcVersion": "1.24.2", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "LGPL-2.0-or-later", "Apache-2.0", "MIT", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-3-Clause", "GPL-2.0-or-later" ], "Maintainer": "Debian Games Team \u003cpkg-games-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/doc/libopenal-data/changelog.Debian.gz", "/usr/share/doc/libopenal-data/changelog.gz", "/usr/share/doc/libopenal-data/copyright", "/usr/share/openal/alsoftrc.sample", "/usr/share/openal/hrtf/Default HRTF.mhr", "/usr/share/openal/presets/3D7.1.ambdec", "/usr/share/openal/presets/hex-quad.ambdec", "/usr/share/openal/presets/hexagon.ambdec", "/usr/share/openal/presets/itu5.1-nocenter.ambdec", "/usr/share/openal/presets/itu5.1.ambdec", "/usr/share/openal/presets/presets.txt", "/usr/share/openal/presets/rectangle.ambdec", "/usr/share/openal/presets/square.ambdec" ], "AnalyzedBy": "dpkg" }, { "ID": "libopenal1@1:1.24.2-1", "Name": "libopenal1", "Identifier": { "PURL": "pkg:deb/debian/libopenal1@1.24.2-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "31be684d4b523628" }, "Version": "1.24.2", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "openal-soft", "SrcVersion": "1.24.2", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "LGPL-2.0-or-later", "Apache-2.0", "MIT", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-3-Clause", "GPL-2.0-or-later" ], "Maintainer": "Debian Games Team \u003cpkg-games-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libopenal-data@1:1.24.2-1", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libopenal.so.1.24.2", "/usr/share/doc/libopenal1/changelog.Debian.gz", "/usr/share/doc/libopenal1/changelog.gz", "/usr/share/doc/libopenal1/copyright", "/usr/share/doc/libopenal1/examples/alsoftrc.sample" ], "AnalyzedBy": "dpkg" }, { "ID": "libopenjp2-7@2.5.3-2.1~deb13u2", "Name": "libopenjp2-7", "Identifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64\u0026distro=debian-13.6", "UID": "192adc141fa74821" }, "Version": "2.5.3", "Release": "2.1~deb13u2", "Arch": "amd64", "SrcName": "openjpeg2", "SrcVersion": "2.5.3", "SrcRelease": "2.1~deb13u2", "Licenses": [ "BSD-2-Clause", "MIT", "BSD-3-Clause", "Libpng", "Zlib", "libtiff", "LIBTIFF-PIXAR", "LIBTIFF-GLARSON" ], "Maintainer": "Debian PhotoTools Maintainers \u003cpkg-phototools-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libopenjp2.so.2.5.3", "/usr/share/doc/libopenjp2-7/changelog.Debian.gz", "/usr/share/doc/libopenjp2-7/changelog.gz", "/usr/share/doc/libopenjp2-7/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libopenmpt0t64@0.7.13-1+b1", "Name": "libopenmpt0t64", "Identifier": { "PURL": "pkg:deb/debian/libopenmpt0t64@0.7.13-1%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "4b0b244b26da3cab" }, "Version": "0.7.13", "Release": "1+b1", "Arch": "amd64", "SrcName": "libopenmpt", "SrcVersion": "0.7.13", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-with-autoconf-exception+", "GPL-3.0-with-autoconf-exception+", "X11", "GPL-2+ with LibTool exception", "GPL-3+ with Autoconf Macros exception", "GNU-All-Permissive-License", "GNU-All-Permissive-License-FSF", "BSL-1.0", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libmpg123-0t64@1.32.10-1+deb13u1", "libstdc++6@14.2.0-19", "libvorbis0a@1.3.7-3", "libvorbisfile3@1.3.7-3", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libopenmpt.so.0.4.4", "/usr/share/doc/libopenmpt0t64/changelog.Debian.amd64.gz", "/usr/share/doc/libopenmpt0t64/changelog.Debian.gz", "/usr/share/doc/libopenmpt0t64/changelog.gz", "/usr/share/doc/libopenmpt0t64/copyright", "/usr/share/lintian/overrides/libopenmpt0t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libopus0@1.5.2-2", "Name": "libopus0", "Identifier": { "PURL": "pkg:deb/debian/libopus0@1.5.2-2?arch=amd64\u0026distro=debian-13.6", "UID": "8d3f2856634b6dee" }, "Version": "1.5.2", "Release": "2", "Arch": "amd64", "SrcName": "opus", "SrcVersion": "1.5.2", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-2-Clause" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libopus.so.0.10.1", "/usr/share/doc/libopus0/changelog.Debian.gz", "/usr/share/doc/libopus0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libp11-kit0@0.25.5-3", "Name": "libp11-kit0", "Identifier": { "PURL": "pkg:deb/debian/libp11-kit0@0.25.5-3?arch=amd64\u0026distro=debian-13.6", "UID": "f2b2270e59ecccd9" }, "Version": "0.25.5", "Release": "3", "Arch": "amd64", "SrcName": "p11-kit", "SrcVersion": "0.25.5", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause", "FSFULLR", "GPL-2+ with Autoconf-data exception", "GPL-3+ with Autoconf-data exception", "X11", "ISC", "customFSFULLRWD", "LGPL-2.1-or-later", "Apache-2.0", "customFSFUL", "FSFAP", "LGPL-2.1-only" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libffi8@3.4.8-2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libp11-kit.so.0.4.1", "/usr/share/doc/libp11-kit0/changelog.Debian.gz", "/usr/share/doc/libp11-kit0/changelog.gz", "/usr/share/doc/libp11-kit0/copyright", "/usr/share/doc/libp11-kit0/examples/pkcs11.conf.example" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-modules@1.7.0-5", "Name": "libpam-modules", "Identifier": { "PURL": "pkg:deb/debian/libpam-modules@1.7.0-5?arch=amd64\u0026distro=debian-13.6", "UID": "274a704398461ef0" }, "Version": "1.7.0", "Release": "5", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/security/pam_access.so", "/usr/lib/x86_64-linux-gnu/security/pam_canonicalize_user.so", "/usr/lib/x86_64-linux-gnu/security/pam_debug.so", "/usr/lib/x86_64-linux-gnu/security/pam_deny.so", "/usr/lib/x86_64-linux-gnu/security/pam_echo.so", "/usr/lib/x86_64-linux-gnu/security/pam_env.so", "/usr/lib/x86_64-linux-gnu/security/pam_exec.so", "/usr/lib/x86_64-linux-gnu/security/pam_faildelay.so", "/usr/lib/x86_64-linux-gnu/security/pam_faillock.so", "/usr/lib/x86_64-linux-gnu/security/pam_filter.so", "/usr/lib/x86_64-linux-gnu/security/pam_ftp.so", "/usr/lib/x86_64-linux-gnu/security/pam_group.so", "/usr/lib/x86_64-linux-gnu/security/pam_issue.so", "/usr/lib/x86_64-linux-gnu/security/pam_keyinit.so", "/usr/lib/x86_64-linux-gnu/security/pam_limits.so", "/usr/lib/x86_64-linux-gnu/security/pam_listfile.so", "/usr/lib/x86_64-linux-gnu/security/pam_localuser.so", "/usr/lib/x86_64-linux-gnu/security/pam_loginuid.so", "/usr/lib/x86_64-linux-gnu/security/pam_mail.so", "/usr/lib/x86_64-linux-gnu/security/pam_mkhomedir.so", "/usr/lib/x86_64-linux-gnu/security/pam_motd.so", "/usr/lib/x86_64-linux-gnu/security/pam_namespace.so", "/usr/lib/x86_64-linux-gnu/security/pam_nologin.so", "/usr/lib/x86_64-linux-gnu/security/pam_permit.so", "/usr/lib/x86_64-linux-gnu/security/pam_pwhistory.so", "/usr/lib/x86_64-linux-gnu/security/pam_rhosts.so", "/usr/lib/x86_64-linux-gnu/security/pam_rootok.so", "/usr/lib/x86_64-linux-gnu/security/pam_securetty.so", "/usr/lib/x86_64-linux-gnu/security/pam_selinux.so", "/usr/lib/x86_64-linux-gnu/security/pam_sepermit.so", "/usr/lib/x86_64-linux-gnu/security/pam_setquota.so", "/usr/lib/x86_64-linux-gnu/security/pam_shells.so", "/usr/lib/x86_64-linux-gnu/security/pam_stress.so", "/usr/lib/x86_64-linux-gnu/security/pam_succeed_if.so", "/usr/lib/x86_64-linux-gnu/security/pam_time.so", "/usr/lib/x86_64-linux-gnu/security/pam_timestamp.so", "/usr/lib/x86_64-linux-gnu/security/pam_tty_audit.so", "/usr/lib/x86_64-linux-gnu/security/pam_umask.so", "/usr/lib/x86_64-linux-gnu/security/pam_unix.so", "/usr/lib/x86_64-linux-gnu/security/pam_userdb.so", "/usr/lib/x86_64-linux-gnu/security/pam_usertype.so", "/usr/lib/x86_64-linux-gnu/security/pam_warn.so", "/usr/lib/x86_64-linux-gnu/security/pam_wheel.so", "/usr/lib/x86_64-linux-gnu/security/pam_xauth.so", "/usr/share/doc/libpam-modules/NEWS.Debian.gz", "/usr/share/doc/libpam-modules/changelog.Debian.gz", "/usr/share/doc/libpam-modules/changelog.gz", "/usr/share/doc/libpam-modules/copyright", "/usr/share/doc/libpam-modules/examples/upperLOWER.c", "/usr/share/lintian/overrides/libpam-modules", "/usr/share/pam-configs/mkhomedir" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-modules-bin@1.7.0-5", "Name": "libpam-modules-bin", "Identifier": { "PURL": "pkg:deb/debian/libpam-modules-bin@1.7.0-5?arch=amd64\u0026distro=debian-13.6", "UID": "c9cbae9084b28bae" }, "Version": "1.7.0", "Release": "5", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:4.0.2-2+b2", "libc6@2.41-12+deb13u3", "libcrypt1@1:4.4.38-1", "libpam0g@1.7.0-5", "libselinux1@3.8.1-1", "libsystemd0@257.13-1~deb13u1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/systemd/system/pam_namespace.service", "/usr/sbin/faillock", "/usr/sbin/mkhomedir_helper", "/usr/sbin/pam_namespace_helper", "/usr/sbin/pam_timestamp_check", "/usr/sbin/pwhistory_helper", "/usr/sbin/unix_chkpwd", "/usr/sbin/unix_update", "/usr/share/doc/libpam-modules-bin/changelog.Debian.gz", "/usr/share/doc/libpam-modules-bin/changelog.gz", "/usr/share/doc/libpam-modules-bin/copyright", "/usr/share/lintian/overrides/libpam-modules-bin" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-runtime@1.7.0-5", "Name": "libpam-runtime", "Identifier": { "PURL": "pkg:deb/debian/libpam-runtime@1.7.0-5?arch=all\u0026distro=debian-13.6", "UID": "1d4f3eaf1c0f9548" }, "Version": "1.7.0", "Release": "5", "Arch": "all", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "libpam-modules@1.7.0-5" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/sbin/pam-auth-update", "/usr/sbin/pam_getenv", "/usr/share/doc/libpam-runtime/changelog.Debian.gz", "/usr/share/doc/libpam-runtime/changelog.gz", "/usr/share/doc/libpam-runtime/copyright", "/usr/share/lintian/overrides/libpam-runtime", "/usr/share/locale/af/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/am/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ar/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/as/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/az/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/be/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bg/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bn_IN/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bs/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ca/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/cs/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/cy/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/da/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/de/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/de_CH/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/el/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/eo/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/es/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/et/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/eu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fa/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ga/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/gl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/gu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/he/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ia/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/id/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/is/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/it/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ja/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ka/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/km/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ko/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kw_GB/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ky/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/lt/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/lv/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ml/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ms/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/my/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nb/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ne/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/or/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pa/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pt/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ro/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ru/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/si/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sq/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sr@latin/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sv/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ta/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/te/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/tg/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/th/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/tr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/uk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ur/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/vi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/yo/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_HK/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/man/man5/access.conf.5.gz", "/usr/share/man/man5/faillock.conf.5.gz", "/usr/share/man/man5/group.conf.5.gz", "/usr/share/man/man5/limits.conf.5.gz", "/usr/share/man/man5/namespace.conf.5.gz", "/usr/share/man/man5/pam.conf.5.gz", "/usr/share/man/man5/pam_env.conf.5.gz", "/usr/share/man/man5/pwhistory.conf.5.gz", "/usr/share/man/man5/sepermit.conf.5.gz", "/usr/share/man/man5/time.conf.5.gz", "/usr/share/man/man7/PAM.7.gz", "/usr/share/man/man8/faillock.8.gz", "/usr/share/man/man8/mkhomedir_helper.8.gz", "/usr/share/man/man8/pam-auth-update.8.gz", "/usr/share/man/man8/pam_access.8.gz", "/usr/share/man/man8/pam_canonicalize_user.8.gz", "/usr/share/man/man8/pam_debug.8.gz", "/usr/share/man/man8/pam_deny.8.gz", "/usr/share/man/man8/pam_echo.8.gz", "/usr/share/man/man8/pam_env.8.gz", "/usr/share/man/man8/pam_exec.8.gz", "/usr/share/man/man8/pam_faildelay.8.gz", "/usr/share/man/man8/pam_faillock.8.gz", "/usr/share/man/man8/pam_filter.8.gz", "/usr/share/man/man8/pam_ftp.8.gz", "/usr/share/man/man8/pam_getenv.8.gz", "/usr/share/man/man8/pam_group.8.gz", "/usr/share/man/man8/pam_issue.8.gz", "/usr/share/man/man8/pam_keyinit.8.gz", "/usr/share/man/man8/pam_limits.8.gz", "/usr/share/man/man8/pam_listfile.8.gz", "/usr/share/man/man8/pam_localuser.8.gz", "/usr/share/man/man8/pam_loginuid.8.gz", "/usr/share/man/man8/pam_mail.8.gz", "/usr/share/man/man8/pam_mkhomedir.8.gz", "/usr/share/man/man8/pam_motd.8.gz", "/usr/share/man/man8/pam_namespace.8.gz", "/usr/share/man/man8/pam_namespace_helper.8.gz", "/usr/share/man/man8/pam_nologin.8.gz", "/usr/share/man/man8/pam_permit.8.gz", "/usr/share/man/man8/pam_pwhistory.8.gz", "/usr/share/man/man8/pam_rhosts.8.gz", "/usr/share/man/man8/pam_rootok.8.gz", "/usr/share/man/man8/pam_securetty.8.gz", "/usr/share/man/man8/pam_selinux.8.gz", "/usr/share/man/man8/pam_sepermit.8.gz", "/usr/share/man/man8/pam_setquota.8.gz", "/usr/share/man/man8/pam_shells.8.gz", "/usr/share/man/man8/pam_stress.8.gz", "/usr/share/man/man8/pam_succeed_if.8.gz", "/usr/share/man/man8/pam_time.8.gz", "/usr/share/man/man8/pam_timestamp.8.gz", "/usr/share/man/man8/pam_timestamp_check.8.gz", "/usr/share/man/man8/pam_tty_audit.8.gz", "/usr/share/man/man8/pam_umask.8.gz", "/usr/share/man/man8/pam_unix.8.gz", "/usr/share/man/man8/pam_userdb.8.gz", "/usr/share/man/man8/pam_usertype.8.gz", "/usr/share/man/man8/pam_warn.8.gz", "/usr/share/man/man8/pam_wheel.8.gz", "/usr/share/man/man8/pam_xauth.8.gz", "/usr/share/man/man8/pwhistory_helper.8.gz", "/usr/share/man/man8/unix_chkpwd.8.gz", "/usr/share/man/man8/unix_update.8.gz", "/usr/share/pam-configs/unix", "/usr/share/pam/common-account", "/usr/share/pam/common-account.md5sums", "/usr/share/pam/common-auth", "/usr/share/pam/common-auth.md5sums", "/usr/share/pam/common-password", "/usr/share/pam/common-password.md5sums", "/usr/share/pam/common-session", "/usr/share/pam/common-session-noninteractive", "/usr/share/pam/common-session-noninteractive.md5sums", "/usr/share/pam/common-session.md5sums" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam0g@1.7.0-5", "Name": "libpam0g", "Identifier": { "PURL": "pkg:deb/debian/libpam0g@1.7.0-5?arch=amd64\u0026distro=debian-13.6", "UID": "50a3886f7361785c" }, "Version": "1.7.0", "Release": "5", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.7.0", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91", "libaudit1@1:4.0.2-2+b2", "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1", "/usr/lib/x86_64-linux-gnu/libpam_misc.so.0.82.1", "/usr/lib/x86_64-linux-gnu/libpamc.so.0.82.1", "/usr/share/doc/libpam0g/Debian-PAM-MiniPolicy.gz", "/usr/share/doc/libpam0g/README", "/usr/share/doc/libpam0g/README.Debian", "/usr/share/doc/libpam0g/TODO.Debian", "/usr/share/doc/libpam0g/changelog.Debian.gz", "/usr/share/doc/libpam0g/changelog.gz", "/usr/share/doc/libpam0g/copyright", "/usr/share/lintian/overrides/libpam0g" ], "AnalyzedBy": "dpkg" }, { "ID": "libpango-1.0-0@1.56.3-1", "Name": "libpango-1.0-0", "Identifier": { "PURL": "pkg:deb/debian/libpango-1.0-0@1.56.3-1?arch=amd64\u0026distro=debian-13.6", "UID": "83cd2eceea96c800" }, "Version": "1.56.3", "Release": "1", "Arch": "amd64", "SrcName": "pango1.0", "SrcVersion": "1.56.3", "SrcRelease": "1", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "Example", "TCL", "Unicode", "ICU", "Chromium-BSD-style", "Apache-2.0", "Bitstream-Vera", "OFL-1.1", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "fontconfig@2.15.0-2.3", "libc6@2.41-12+deb13u3", "libfribidi0@1.0.16-1", "libglib2.0-0t64@2.84.4-3~deb13u5", "libharfbuzz0b@10.2.0-1+deb13u1", "libthai0@0.1.29-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpango-1.0.so.0.5600.3", "/usr/share/doc/libpango-1.0-0/NEWS.gz", "/usr/share/doc/libpango-1.0-0/README.md", "/usr/share/doc/libpango-1.0-0/THANKS", "/usr/share/doc/libpango-1.0-0/changelog.Debian.gz", "/usr/share/doc/libpango-1.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpangocairo-1.0-0@1.56.3-1", "Name": "libpangocairo-1.0-0", "Identifier": { "PURL": "pkg:deb/debian/libpangocairo-1.0-0@1.56.3-1?arch=amd64\u0026distro=debian-13.6", "UID": "99257b67131604a0" }, "Version": "1.56.3", "Release": "1", "Arch": "amd64", "SrcName": "pango1.0", "SrcVersion": "1.56.3", "SrcRelease": "1", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "Example", "TCL", "Unicode", "ICU", "Chromium-BSD-style", "Apache-2.0", "Bitstream-Vera", "OFL-1.1", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcairo2@1.18.4-1+b1", "libfontconfig1@2.15.0-2.3", "libglib2.0-0t64@2.84.4-3~deb13u5", "libharfbuzz0b@10.2.0-1+deb13u1", "libpango-1.0-0@1.56.3-1", "libpangoft2-1.0-0@1.56.3-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpangocairo-1.0.so.0.5600.3", "/usr/share/doc/libpangocairo-1.0-0/changelog.Debian.gz", "/usr/share/doc/libpangocairo-1.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpangoft2-1.0-0@1.56.3-1", "Name": "libpangoft2-1.0-0", "Identifier": { "PURL": "pkg:deb/debian/libpangoft2-1.0-0@1.56.3-1?arch=amd64\u0026distro=debian-13.6", "UID": "e01a8db138dbccd" }, "Version": "1.56.3", "Release": "1", "Arch": "amd64", "SrcName": "pango1.0", "SrcVersion": "1.56.3", "SrcRelease": "1", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "Example", "TCL", "Unicode", "ICU", "Chromium-BSD-style", "Apache-2.0", "Bitstream-Vera", "OFL-1.1", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libfontconfig1@2.15.0-2.3", "libfreetype6@2.13.3+dfsg-1+deb13u1", "libglib2.0-0t64@2.84.4-3~deb13u5", "libharfbuzz0b@10.2.0-1+deb13u1", "libpango-1.0-0@1.56.3-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpangoft2-1.0.so.0.5600.3", "/usr/share/doc/libpangoft2-1.0-0/changelog.Debian.gz", "/usr/share/doc/libpangoft2-1.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpciaccess0@0.17-3+b3", "Name": "libpciaccess0", "Identifier": { "PURL": "pkg:deb/debian/libpciaccess0@0.17-3%2Bb3?arch=amd64\u0026distro=debian-13.6", "UID": "ef25192b4bc308f2" }, "Version": "0.17", "Release": "3+b3", "Arch": "amd64", "SrcName": "libpciaccess", "SrcVersion": "0.17", "SrcRelease": "3", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpciaccess.so.0.11.1", "/usr/share/doc/libpciaccess0/changelog.Debian.amd64.gz", "/usr/share/doc/libpciaccess0/changelog.Debian.gz", "/usr/share/doc/libpciaccess0/changelog.gz", "/usr/share/doc/libpciaccess0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpcre2-8-0@10.46-1~deb13u1", "Name": "libpcre2-8-0", "Identifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "aa7e3a6ab471d889" }, "Version": "10.46", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "pcre2", "SrcVersion": "10.46", "SrcRelease": "1~deb13u1", "Licenses": [ "BSD-3-clause-Cambridge with BINARY LIBRARY-LIKE PACKAGES exception", "BSD-3-Clause", "X11", "BSD-2-Clause", "public-domain" ], "Maintainer": "Matthew Vernon \u003cmatthew@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.14.0", "/usr/share/doc/libpcre2-8-0/README.Debian", "/usr/share/doc/libpcre2-8-0/changelog.Debian.gz", "/usr/share/doc/libpcre2-8-0/changelog.gz", "/usr/share/doc/libpcre2-8-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpgm-5.3-0t64@5.3.128~dfsg-2.1+b1", "Name": "libpgm-5.3-0t64", "Identifier": { "PURL": "pkg:deb/debian/libpgm-5.3-0t64@5.3.128~dfsg-2.1%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "5f321779978713e0" }, "Version": "5.3.128~dfsg", "Release": "2.1+b1", "Arch": "amd64", "SrcName": "libpgm", "SrcVersion": "5.3.128~dfsg", "SrcRelease": "2.1", "Licenses": [ "LGPL-2.1-only", "LGPL-2.0-or-later", "LGPL-2.0-only", "BSD-3-Clause", "ISC" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpgm-5.3.so.0.0.128", "/usr/share/doc/libpgm-5.3-0t64/changelog.Debian.amd64.gz", "/usr/share/doc/libpgm-5.3-0t64/changelog.Debian.gz", "/usr/share/doc/libpgm-5.3-0t64/copyright", "/usr/share/lintian/overrides/libpgm-5.3-0t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libpixman-1-0@0.44.0-3", "Name": "libpixman-1-0", "Identifier": { "PURL": "pkg:deb/debian/libpixman-1-0@0.44.0-3?arch=amd64\u0026distro=debian-13.6", "UID": "3687cf466ed4bf76" }, "Version": "0.44.0", "Release": "3", "Arch": "amd64", "SrcName": "pixman", "SrcVersion": "0.44.0", "SrcRelease": "3", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpixman-1.so.0.44.0", "/usr/share/doc/libpixman-1-0/changelog.Debian.gz", "/usr/share/doc/libpixman-1-0/copyright", "/usr/share/lintian/overrides/libpixman-1-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libplacebo349@7.349.0-3", "Name": "libplacebo349", "Identifier": { "PURL": "pkg:deb/debian/libplacebo349@7.349.0-3?arch=amd64\u0026distro=debian-13.6", "UID": "9f6590fb7435e4db" }, "Version": "7.349.0", "Release": "3", "Arch": "amd64", "SrcName": "libplacebo", "SrcVersion": "7.349.0", "SrcRelease": "3", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "MIT", "Zlib", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "liblcms2-2@2.16-2+deb13u2", "libstdc++6@14.2.0-19", "libvulkan1@1.4.309.0-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libplacebo.so.349", "/usr/share/doc/libplacebo349/changelog.Debian.gz", "/usr/share/doc/libplacebo349/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpng16-16t64@1.6.48-1+deb13u5", "Name": "libpng16-16t64", "Identifier": { "PURL": "pkg:deb/debian/libpng16-16t64@1.6.48-1%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "6044b14d8c08383a" }, "Version": "1.6.48", "Release": "1+deb13u5", "Arch": "amd64", "SrcName": "libpng1.6", "SrcVersion": "1.6.48", "SrcRelease": "1+deb13u5", "Licenses": [ "Libpng", "MIT", "GPL-2.0-or-later", "BSD-like-with-advertising-clause", "libpng OR Apache-2.0 OR BSD-3-clause", "Apache-2.0", "GPL-2.0-only", "BSD-3-Clause" ], "Maintainer": "Maintainers of libpng1.6 packages \u003clibpng1.6@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpng16.so.16.48.0", "/usr/share/doc-base/libpng16-16t64.libpng16", "/usr/share/doc/libpng16-16t64/ANNOUNCE", "/usr/share/doc/libpng16-16t64/README.gz", "/usr/share/doc/libpng16-16t64/TODO", "/usr/share/doc/libpng16-16t64/changelog.Debian.gz", "/usr/share/doc/libpng16-16t64/changelog.gz", "/usr/share/doc/libpng16-16t64/copyright", "/usr/share/doc/libpng16-16t64/libpng-manual.txt.gz", "/usr/share/lintian/overrides/libpng16-16t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libpocketsphinx3@0.8+5prealpha+1-15+b4", "Name": "libpocketsphinx3", "Identifier": { "PURL": "pkg:deb/debian/libpocketsphinx3@0.8%2B5prealpha%2B1-15%2Bb4?arch=amd64\u0026distro=debian-13.6", "UID": "ade4986fadb56d81" }, "Version": "0.8+5prealpha+1", "Release": "15+b4", "Arch": "amd64", "SrcName": "pocketsphinx", "SrcVersion": "0.8+5prealpha+1", "SrcRelease": "15", "Licenses": [ "BSD-2-Clause", "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Accessibility Team \u003cpkg-a11y-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libsphinxbase3t64@0.8+5prealpha+1-21+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpocketsphinx.so.3.0.0", "/usr/share/doc/libpocketsphinx3/changelog.Debian.amd64.gz", "/usr/share/doc/libpocketsphinx3/changelog.Debian.gz", "/usr/share/doc/libpocketsphinx3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpostproc58@7:7.1.5-0+deb13u1", "Name": "libpostproc58", "Identifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "Version": "7.1.5", "Release": "0+deb13u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "7.1.5", "SrcRelease": "0+deb13u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavutil59@7:7.1.5-0+deb13u1", "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpostproc.so.58.3.100", "/usr/share/doc/libpostproc58/changelog.Debian.gz", "/usr/share/doc/libpostproc58/changelog.gz", "/usr/share/doc/libpostproc58/copyright", "/usr/share/lintian/overrides/libpostproc58" ], "AnalyzedBy": "dpkg" }, { "ID": "libpsl5t64@0.21.2-1.1+b1", "Name": "libpsl5t64", "Identifier": { "PURL": "pkg:deb/debian/libpsl5t64@0.21.2-1.1%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "819cc502d1118c2a" }, "Version": "0.21.2", "Release": "1.1+b1", "Arch": "amd64", "SrcName": "libpsl", "SrcVersion": "0.21.2", "SrcRelease": "1.1", "Licenses": [ "MIT", "gnulib", "Chromium" ], "Maintainer": "Tim Rühsen \u003ctim.ruehsen@gmx.de\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libidn2-0@2.3.8-2", "libunistring5@1.3-2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpsl.so.5.3.4", "/usr/share/doc/libpsl5t64/changelog.Debian.amd64.gz", "/usr/share/doc/libpsl5t64/changelog.Debian.gz", "/usr/share/doc/libpsl5t64/changelog.gz", "/usr/share/doc/libpsl5t64/copyright", "/usr/share/lintian/overrides/libpsl5t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libpulse0@17.0+dfsg1-2+b1", "Name": "libpulse0", "Identifier": { "PURL": "pkg:deb/debian/libpulse0@17.0%2Bdfsg1-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "ad8e57da99e3ea16" }, "Version": "17.0+dfsg1", "Release": "2+b1", "Arch": "amd64", "SrcName": "pulseaudio", "SrcVersion": "17.0+dfsg1", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "other", "LGPL-2.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later" ], "Maintainer": "Pulseaudio maintenance team \u003cpkg-pulseaudio-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasyncns0@0.8-6+b5", "libc6@2.41-12+deb13u3", "libdbus-1-3@1.16.2-2", "libsndfile1@1.2.2-2+deb13u1", "libsystemd0@257.13-1~deb13u1", "libx11-6@2:1.8.12-1", "libx11-xcb1@2:1.8.12-1", "libxcb1@1.17.0-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpulse-simple.so.0.1.1", "/usr/lib/x86_64-linux-gnu/libpulse.so.0.24.3", "/usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-17.0.so", "/usr/share/doc/libpulse0/NEWS.gz", "/usr/share/doc/libpulse0/README", "/usr/share/doc/libpulse0/changelog.Debian.amd64.gz", "/usr/share/doc/libpulse0/changelog.Debian.gz", "/usr/share/doc/libpulse0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "librabbitmq4@0.15.0-1+deb13u2", "Name": "librabbitmq4", "Identifier": { "PURL": "pkg:deb/debian/librabbitmq4@0.15.0-1%2Bdeb13u2?arch=amd64\u0026distro=debian-13.6", "UID": "8667aebb8778b75b" }, "Version": "0.15.0", "Release": "1+deb13u2", "Arch": "amd64", "SrcName": "librabbitmq", "SrcVersion": "0.15.0", "SrcRelease": "1+deb13u2", "Licenses": [ "MIT" ], "Maintainer": "Florian Ernst \u003cflorian@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libssl3t64@3.5.7-1~deb13u2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librabbitmq.so.0.15.0", "/usr/share/doc/librabbitmq4/changelog.Debian.gz", "/usr/share/doc/librabbitmq4/changelog.gz", "/usr/share/doc/librabbitmq4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "librav1e0.7@0.7.1-9+b2", "Name": "librav1e0.7", "Identifier": { "PURL": "pkg:deb/debian/librav1e0.7@0.7.1-9%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "8bbf046c0a6f5d24" }, "Version": "0.7.1", "Release": "9+b2", "Arch": "amd64", "SrcName": "rust-rav1e", "SrcVersion": "0.7.1", "SrcRelease": "9", "Licenses": [ "BSD-2-Clause", "ISC" ], "Maintainer": "Debian Rust Maintainers \u003cpkg-rust-maintainers@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librav1e.so.0.7.2", "/usr/share/doc/librav1e0.7/changelog.Debian.amd64.gz", "/usr/share/doc/librav1e0.7/changelog.Debian.gz", "/usr/share/doc/librav1e0.7/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libraw1394-11@2.1.2-2+b2", "Name": "libraw1394-11", "Identifier": { "PURL": "pkg:deb/debian/libraw1394-11@2.1.2-2%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "f64cafc0718d963a" }, "Version": "2.1.2", "Release": "2+b2", "Arch": "amd64", "SrcName": "libraw1394", "SrcVersion": "2.1.2", "SrcRelease": "2", "Licenses": [ "LGPL-2.0-or-later", "GPL-2.0-or-later" ], "Maintainer": "Guus Sliepen \u003cguus@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libraw1394.so.11.1.0", "/usr/share/doc/libraw1394-11/changelog.Debian.amd64.gz", "/usr/share/doc/libraw1394-11/changelog.Debian.gz", "/usr/share/doc/libraw1394-11/changelog.gz", "/usr/share/doc/libraw1394-11/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libreadline8t64@8.2-6", "Name": "libreadline8t64", "Identifier": { "PURL": "pkg:deb/debian/libreadline8t64@8.2-6?arch=amd64\u0026distro=debian-13.6", "UID": "50325e363223cfdc" }, "Version": "8.2", "Release": "6", "Arch": "amd64", "SrcName": "readline", "SrcVersion": "8.2", "SrcRelease": "6", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-or-later", "ISC-no-attribution" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libtinfo6@6.5+20250216-2", "readline-common@8.2-6" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhistory.so.8.2", "/usr/lib/x86_64-linux-gnu/libreadline.so.8.2", "/usr/share/doc/libreadline8t64/README.Debian", "/usr/share/doc/libreadline8t64/USAGE", "/usr/share/doc/libreadline8t64/changelog.Debian.gz", "/usr/share/doc/libreadline8t64/changelog.gz", "/usr/share/doc/libreadline8t64/copyright", "/usr/share/doc/libreadline8t64/examples/Inputrc", "/usr/share/doc/libreadline8t64/inputrc.arrows" ], "AnalyzedBy": "dpkg" }, { "ID": "librist4@0.2.11+dfsg-1", "Name": "librist4", "Identifier": { "PURL": "pkg:deb/debian/librist4@0.2.11%2Bdfsg-1?arch=amd64\u0026distro=debian-13.6", "UID": "51c35e8df2fcbd35" }, "Version": "0.2.11+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "librist", "SrcVersion": "0.2.11+dfsg", "SrcRelease": "1", "Licenses": [ "BSD-2-Clause", "BSD-1-Clause", "public-domain", "ISC" ], "Maintainer": "Florian Ernst \u003cflorian@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcjson1@1.7.18-3.1+deb13u1", "libmbedcrypto16@3.6.6-0.1~deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librist.so.4.4.0", "/usr/share/doc/librist4/changelog.Debian.gz", "/usr/share/doc/librist4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "librsvg2-2@2.60.0+dfsg-1", "Name": "librsvg2-2", "Identifier": { "PURL": "pkg:deb/debian/librsvg2-2@2.60.0%2Bdfsg-1?arch=amd64\u0026distro=debian-13.6", "UID": "8db0239d9634c1cf" }, "Version": "2.60.0+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "librsvg", "SrcVersion": "2.60.0+dfsg", "SrcRelease": "1", "Licenses": [ "LGPL-2.0-or-later", "FSFAP", "BSD-3-Clause", "MIT", "Apache-2.0", "BSD-2-Clause", "0BSD", "BSL-1.0", "Unlicense", "MPL-2.0", "Sun-permissive", "Zlib", "CC-zero-waive-1.0-us", "OFL-1.1", "LGPL-2.0-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcairo-gobject2@1.18.4-1+b1", "libcairo2@1.18.4-1+b1", "libdav1d7@1.5.1-1", "libgcc-s1@14.2.0-19", "libgdk-pixbuf-2.0-0@2.42.12+dfsg-4+deb13u1", "libglib2.0-0t64@2.84.4-3~deb13u5", "libpango-1.0-0@1.56.3-1", "libpangocairo-1.0-0@1.56.3-1", "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librsvg-2.so.2.60.0", "/usr/share/doc/librsvg2-2/AUTHORS", "/usr/share/doc/librsvg2-2/NEWS.gz", "/usr/share/doc/librsvg2-2/README.md.gz", "/usr/share/doc/librsvg2-2/changelog.Debian.gz", "/usr/share/doc/librsvg2-2/copyright", "/usr/share/lintian/overrides/librsvg2-2" ], "AnalyzedBy": "dpkg" }, { "ID": "librtmp1@2.4+20151223.gitfa8646d.1-2+b5", "Name": "librtmp1", "Identifier": { "PURL": "pkg:deb/debian/librtmp1@2.4%2B20151223.gitfa8646d.1-2%2Bb5?arch=amd64\u0026distro=debian-13.6", "UID": "5606cf7f9169aeeb" }, "Version": "2.4+20151223.gitfa8646d.1", "Release": "2+b5", "Arch": "amd64", "SrcName": "rtmpdump", "SrcVersion": "2.4+20151223.gitfa8646d.1", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgmp10@2:6.3.0+dfsg-3", "libgnutls30t64@3.8.9-3+deb13u4", "libhogweed6t64@3.10.1-1", "libnettle8t64@3.10.1-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librtmp.so.1", "/usr/share/doc/librtmp1/changelog.Debian.amd64.gz", "/usr/share/doc/librtmp1/changelog.Debian.gz", "/usr/share/doc/librtmp1/changelog.gz", "/usr/share/doc/librtmp1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "librubberband2@3.3.0+dfsg-2+b3", "Name": "librubberband2", "Identifier": { "PURL": "pkg:deb/debian/librubberband2@3.3.0%2Bdfsg-2%2Bb3?arch=amd64\u0026distro=debian-13.6", "UID": "93cb6f34debf0fb" }, "Version": "3.3.0+dfsg", "Release": "2+b3", "Arch": "amd64", "SrcName": "rubberband", "SrcVersion": "3.3.0+dfsg", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "MIT", "BSD-3-Clause", "Zlib", "other-1", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libfftw3-double3@3.3.10-2+b1", "libgcc-s1@14.2.0-19", "libsamplerate0@0.2.2-4+b2", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librubberband.so.2.3.0", "/usr/share/doc/librubberband2/changelog.Debian.amd64.gz", "/usr/share/doc/librubberband2/changelog.Debian.gz", "/usr/share/doc/librubberband2/changelog.gz", "/usr/share/doc/librubberband2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsamplerate0@0.2.2-4+b2", "Name": "libsamplerate0", "Identifier": { "PURL": "pkg:deb/debian/libsamplerate0@0.2.2-4%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "738287e15192a7b8" }, "Version": "0.2.2", "Release": "4+b2", "Arch": "amd64", "SrcName": "libsamplerate", "SrcVersion": "0.2.2", "SrcRelease": "4", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "FSFAP", "GPL-3.0-or-later", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsamplerate.so.0.2.2", "/usr/share/doc/libsamplerate0/changelog.Debian.amd64.gz", "/usr/share/doc/libsamplerate0/changelog.Debian.gz", "/usr/share/doc/libsamplerate0/changelog.gz", "/usr/share/doc/libsamplerate0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsasl2-2@2.1.28+dfsg1-9", "Name": "libsasl2-2", "Identifier": { "PURL": "pkg:deb/debian/libsasl2-2@2.1.28%2Bdfsg1-9?arch=amd64\u0026distro=debian-13.6", "UID": "47f9eb9e8acf1aa4" }, "Version": "2.1.28+dfsg1", "Release": "9", "Arch": "amd64", "SrcName": "cyrus-sasl2", "SrcVersion": "2.1.28+dfsg1", "SrcRelease": "9", "Licenses": [ "BSD-3-Clause-Attribution", "BSD-3-Clause", "BSD-2-Clause", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-4-Clause-UC", "RSA-MD", "text://BSD-3-Clause-Attribution and IBM-as-is", "BSD-3-clause-JANET", "BSD-3-clause-PADL", "MIT-OpenVision", "OpenLDAP", "FSFULLR", "MIT-CMU", "MIT-Export", "BSD-2.2-clause", "text://IBM-as-is" ], "Maintainer": "Debian Cyrus Team \u003cteam+cyrus@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libsasl2-modules-db@2.1.28+dfsg1-9", "libssl3t64@3.5.7-1~deb13u2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsasl2.so.2.0.25", "/usr/share/doc/libsasl2-2/README.Debian", "/usr/share/doc/libsasl2-2/changelog.Debian.gz", "/usr/share/doc/libsasl2-2/copyright", "/usr/share/man/man5/libsasl.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libsasl2-modules-db@2.1.28+dfsg1-9", "Name": "libsasl2-modules-db", "Identifier": { "PURL": "pkg:deb/debian/libsasl2-modules-db@2.1.28%2Bdfsg1-9?arch=amd64\u0026distro=debian-13.6", "UID": "5be604f52b393651" }, "Version": "2.1.28+dfsg1", "Release": "9", "Arch": "amd64", "SrcName": "cyrus-sasl2", "SrcVersion": "2.1.28+dfsg1", "SrcRelease": "9", "Licenses": [ "BSD-3-Clause-Attribution", "BSD-3-Clause", "BSD-2-Clause", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-4-Clause-UC", "RSA-MD", "text://BSD-3-Clause-Attribution and IBM-as-is", "BSD-3-clause-JANET", "BSD-3-clause-PADL", "MIT-OpenVision", "OpenLDAP", "FSFULLR", "MIT-CMU", "MIT-Export", "BSD-2.2-clause", "text://IBM-as-is" ], "Maintainer": "Debian Cyrus Team \u003cteam+cyrus@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdb5.3t64@5.3.28+dfsg2-9" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/sasl2/libsasldb.so.2.0.25", "/usr/share/doc/libsasl2-modules-db/changelog.Debian.gz", "/usr/share/doc/libsasl2-modules-db/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsdl2-2.0-0@2.32.4+dfsg-1", "Name": "libsdl2-2.0-0", "Identifier": { "PURL": "pkg:deb/debian/libsdl2-2.0-0@2.32.4%2Bdfsg-1?arch=amd64\u0026distro=debian-13.6", "UID": "3915d742a5d193bf" }, "Version": "2.32.4+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "libsdl2", "SrcVersion": "2.32.4+dfsg", "SrcRelease": "1", "Licenses": [ "zlib-acknowledgement", "zlib-libpng-like-permissive", "Expat-like", "Apache-2.0", "SGI-Free-Software-License-B", "BSD-3-Clause", "GPL-3.0-only", "hidapi-orig", "SunPro", "PublicDomain_Sam_Lantinga", "PublicDomain_David_Ludwig", "BrownUn_UnCalifornia_ErikCorry", "Gareth_McCaughan", "RSA_Data_Security", "Mozilla-permissive", "MIT", "LGPL-2.1-or-later", "PublicDomain_Edgar_Simo", "BSD-3-clause-chromium", "MIT-open-group", "BSD-3-clause-kitware", "LGPL-2.1-only" ], "Maintainer": "Debian SDL packages maintainers \u003cpkg-sdl-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasound2t64@1.2.14-1+deb13u1", "libc6@2.41-12+deb13u3", "libdecor-0-0@0.2.2-2", "libdrm2@2.4.124-2", "libgbm1@25.0.7-2+deb13u1", "libpulse0@17.0+dfsg1-2+b1", "libsamplerate0@0.2.2-4+b2", "libwayland-client0@1.23.1-3", "libwayland-cursor0@1.23.1-3", "libwayland-egl1@1.23.1-3", "libx11-6@2:1.8.12-1", "libxcursor1@1:1.2.3-1", "libxext6@2:1.3.4-1+b3", "libxfixes3@1:6.0.0-2+b4", "libxi6@2:1.8.2-1", "libxkbcommon0@1.7.0-2", "libxrandr2@2:1.5.4-1+b3", "libxss1@1:1.2.3-1+b3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libSDL2-2.0.so.0.3200.4", "/usr/share/doc/libsdl2-2.0-0/BUGS.txt", "/usr/share/doc/libsdl2-2.0-0/CREDITS.txt", "/usr/share/doc/libsdl2-2.0-0/README-SDL.txt", "/usr/share/doc/libsdl2-2.0-0/README.md", "/usr/share/doc/libsdl2-2.0-0/changelog.Debian.gz", "/usr/share/doc/libsdl2-2.0-0/changelog.gz", "/usr/share/doc/libsdl2-2.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libseccomp2@2.6.0-2", "Name": "libseccomp2", "Identifier": { "PURL": "pkg:deb/debian/libseccomp2@2.6.0-2?arch=amd64\u0026distro=debian-13.6", "UID": "97e0ed663a98e78b" }, "Version": "2.6.0", "Release": "2", "Arch": "amd64", "SrcName": "libseccomp", "SrcVersion": "2.6.0", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Kees Cook \u003ckees@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libseccomp.so.2.6.0", "/usr/share/doc/libseccomp2/changelog.Debian.gz", "/usr/share/doc/libseccomp2/changelog.gz", "/usr/share/doc/libseccomp2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libselinux1@3.8.1-1", "Name": "libselinux1", "Identifier": { "PURL": "pkg:deb/debian/libselinux1@3.8.1-1?arch=amd64\u0026distro=debian-13.6", "UID": "f7d3a23ad693e5cb" }, "Version": "3.8.1", "Release": "1", "Arch": "amd64", "SrcName": "libselinux", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "public-domain", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libpcre2-8-0@10.46-1~deb13u1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/tmpfiles.d/libselinux1.conf", "/usr/lib/x86_64-linux-gnu/libselinux.so.1", "/usr/share/doc/libselinux1/changelog.Debian.gz", "/usr/share/doc/libselinux1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsemanage-common@3.8.1-1", "Name": "libsemanage-common", "Identifier": { "PURL": "pkg:deb/debian/libsemanage-common@3.8.1-1?arch=all\u0026distro=debian-13.6", "UID": "ecc6b54d8bc6318c" }, "Version": "3.8.1", "Release": "1", "Arch": "all", "SrcName": "libsemanage", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/share/doc/libsemanage-common/changelog.Debian.gz", "/usr/share/doc/libsemanage-common/copyright", "/usr/share/man/man5/semanage.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libsemanage2@3.8.1-1", "Name": "libsemanage2", "Identifier": { "PURL": "pkg:deb/debian/libsemanage2@3.8.1-1?arch=amd64\u0026distro=debian-13.6", "UID": "5684bd063761ddb3" }, "Version": "3.8.1", "Release": "1", "Arch": "amd64", "SrcName": "libsemanage", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:4.0.2-2+b2", "libbz2-1.0@1.0.8-6", "libc6@2.41-12+deb13u3", "libselinux1@3.8.1-1", "libsemanage-common@3.8.1-1", "libsepol2@3.8.1-1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsemanage.so.2", "/usr/share/doc/libsemanage2/changelog.Debian.gz", "/usr/share/doc/libsemanage2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsensors-config@1:3.6.2-2", "Name": "libsensors-config", "Identifier": { "PURL": "pkg:deb/debian/libsensors-config@3.6.2-2?arch=all\u0026distro=debian-13.6\u0026epoch=1", "UID": "404c6b57e32e0309" }, "Version": "3.6.2", "Release": "2", "Epoch": 1, "Arch": "all", "SrcName": "lm-sensors", "SrcVersion": "3.6.2", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "GPL-2.0-only", "Linux-man-pages-copyleft", "LGPL-2.1-only" ], "Maintainer": "Aurelien Jarno \u003caurel32@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/doc/libsensors-config/changelog.Debian.gz", "/usr/share/doc/libsensors-config/changelog.gz", "/usr/share/doc/libsensors-config/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsensors5@1:3.6.2-2", "Name": "libsensors5", "Identifier": { "PURL": "pkg:deb/debian/libsensors5@3.6.2-2?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "d7543a22fafd1433" }, "Version": "3.6.2", "Release": "2", "Epoch": 1, "Arch": "amd64", "SrcName": "lm-sensors", "SrcVersion": "3.6.2", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "GPL-2.0-only", "Linux-man-pages-copyleft", "LGPL-2.1-only" ], "Maintainer": "Aurelien Jarno \u003caurel32@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libsensors-config@1:3.6.2-2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsensors.so.5.0.0", "/usr/share/doc/libsensors5/README.Debian", "/usr/share/doc/libsensors5/changelog.Debian.gz", "/usr/share/doc/libsensors5/changelog.gz", "/usr/share/doc/libsensors5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsepol2@3.8.1-1", "Name": "libsepol2", "Identifier": { "PURL": "pkg:deb/debian/libsepol2@3.8.1-1?arch=amd64\u0026distro=debian-13.6", "UID": "9990a97d658e13ae" }, "Version": "3.8.1", "Release": "1", "Arch": "amd64", "SrcName": "libsepol", "SrcVersion": "3.8.1", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "Zlib", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsepol.so.2", "/usr/share/doc/libsepol2/changelog.Debian.gz", "/usr/share/doc/libsepol2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libserd-0-0@0.32.4-1", "Name": "libserd-0-0", "Identifier": { "PURL": "pkg:deb/debian/libserd-0-0@0.32.4-1?arch=amd64\u0026distro=debian-13.6", "UID": "ca9ff75cb617b579" }, "Version": "0.32.4", "Release": "1", "Arch": "amd64", "SrcName": "serd", "SrcVersion": "0.32.4", "SrcRelease": "1", "Licenses": [ "ISC", "BSD-3-Clause", "0BSD" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libserd-0.so.0.32.4", "/usr/share/doc/libserd-0-0/changelog.Debian.gz", "/usr/share/doc/libserd-0-0/changelog.gz", "/usr/share/doc/libserd-0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsharpyuv0@1.5.0-0.1", "Name": "libsharpyuv0", "Identifier": { "PURL": "pkg:deb/debian/libsharpyuv0@1.5.0-0.1?arch=amd64\u0026distro=debian-13.6", "UID": "2bde3baf0f9c9cb9" }, "Version": "1.5.0", "Release": "0.1", "Arch": "amd64", "SrcName": "libwebp", "SrcVersion": "1.5.0", "SrcRelease": "0.1", "Licenses": [ "BSD-3-Clause", "Apache-2.0" ], "Maintainer": "Jeff Breidenbach \u003cjab@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsharpyuv.so.0.1.1", "/usr/share/doc/libsharpyuv0/changelog.Debian.gz", "/usr/share/doc/libsharpyuv0/changelog.gz", "/usr/share/doc/libsharpyuv0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libshine3@3.1.1-2+b2", "Name": "libshine3", "Identifier": { "PURL": "pkg:deb/debian/libshine3@3.1.1-2%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "d6e84b6b046f15f6" }, "Version": "3.1.1", "Release": "2+b2", "Arch": "amd64", "SrcName": "shine", "SrcVersion": "3.1.1", "SrcRelease": "2", "Licenses": [ "LGPL-2.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libshine.so.3.0.1", "/usr/share/doc/libshine3/changelog.Debian.amd64.gz", "/usr/share/doc/libshine3/changelog.Debian.gz", "/usr/share/doc/libshine3/changelog.gz", "/usr/share/doc/libshine3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libslang2@2.3.3-5+b2", "Name": "libslang2", "Identifier": { "PURL": "pkg:deb/debian/libslang2@2.3.3-5%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "b80fcdb39e83ca00" }, "Version": "2.3.3", "Release": "5+b2", "Arch": "amd64", "SrcName": "slang2", "SrcVersion": "2.3.3", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Alastair McKinstry \u003cmckinstry@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libslang.so.2.3.3", "/usr/share/doc/libslang2/NEWS.gz", "/usr/share/doc/libslang2/README", "/usr/share/doc/libslang2/changelog.Debian.amd64.gz", "/usr/share/doc/libslang2/changelog.Debian.gz", "/usr/share/doc/libslang2/changelog.gz", "/usr/share/doc/libslang2/copyright", "/usr/share/doc/libslang2/slang.txt.gz", "/usr/share/doc/libslang2/slangfun.txt.gz", "/usr/share/lintian/overrides/libslang2" ], "AnalyzedBy": "dpkg" }, { "ID": "libsmartcols1@2.41.5-0+deb13u1", "Name": "libsmartcols1", "Identifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "20af24e636963c71" }, "Version": "2.41.5", "Release": "0+deb13u1", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41.5", "SrcRelease": "0+deb13u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsmartcols.so.1.1.0", "/usr/share/doc/libsmartcols1/NEWS.Debian.gz", "/usr/share/doc/libsmartcols1/changelog.Debian.gz", "/usr/share/doc/libsmartcols1/changelog.gz", "/usr/share/doc/libsmartcols1/copyright", "/usr/share/lintian/overrides/libsmartcols1" ], "AnalyzedBy": "dpkg" }, { "ID": "libsnappy1v5@1.2.2-1", "Name": "libsnappy1v5", "Identifier": { "PURL": "pkg:deb/debian/libsnappy1v5@1.2.2-1?arch=amd64\u0026distro=debian-13.6", "UID": "a3646e014d89bd71" }, "Version": "1.2.2", "Release": "1", "Arch": "amd64", "SrcName": "snappy", "SrcVersion": "1.2.2", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "CC-BY-3.0", "MIT", "CC-BY-4.0", "public-domain" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsnappy.so.1.2.2", "/usr/share/doc/libsnappy1v5/changelog.Debian.gz", "/usr/share/doc/libsnappy1v5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsndfile1@1.2.2-2+deb13u1", "Name": "libsndfile1", "Identifier": { "PURL": "pkg:deb/debian/libsndfile1@1.2.2-2%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "c2487b43deba7765" }, "Version": "1.2.2", "Release": "2+deb13u1", "Arch": "amd64", "SrcName": "libsndfile", "SrcVersion": "1.2.2", "SrcRelease": "2+deb13u1", "Licenses": [ "LGPL-2.1-or-later", "gsm", "Apache-2.0", "sun", "GPL-2.0-or-later", "LGPL-2.0-or-later", "BSD-3-Clause", "BSD-2-Clause", "FSFAP", "GPL-3.0-or-later", "NTP", "LGPL-2.1-only", "LGPL-2.0-only", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libflac14@1.5.0+ds-2", "libmp3lame0@3.100-6+b3", "libmpg123-0t64@1.32.10-1+deb13u1", "libogg0@1.3.5-3+b2", "libopus0@1.5.2-2", "libvorbis0a@1.3.7-3", "libvorbisenc2@1.3.7-3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsndfile.so.1.0.37", "/usr/share/doc/libsndfile1/changelog.Debian.gz", "/usr/share/doc/libsndfile1/changelog.gz", "/usr/share/doc/libsndfile1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsodium23@1.0.18-1+deb13u1", "Name": "libsodium23", "Identifier": { "PURL": "pkg:deb/debian/libsodium23@1.0.18-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "7f6946390b3edd69" }, "Version": "1.0.18", "Release": "1+deb13u1", "Arch": "amd64", "SrcName": "libsodium", "SrcVersion": "1.0.18", "SrcRelease": "1+deb13u1", "Licenses": [ "ISC", "BSD-2-Clause", "public-domain", "CC0-1.0", "MIT", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsodium.so.23.3.0", "/usr/share/doc/libsodium23/AUTHORS.gz", "/usr/share/doc/libsodium23/README.markdown", "/usr/share/doc/libsodium23/THANKS", "/usr/share/doc/libsodium23/changelog.Debian.gz", "/usr/share/doc/libsodium23/changelog.gz", "/usr/share/doc/libsodium23/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsord-0-0@0.16.18-1", "Name": "libsord-0-0", "Identifier": { "PURL": "pkg:deb/debian/libsord-0-0@0.16.18-1?arch=amd64\u0026distro=debian-13.6", "UID": "451e87d1e852211c" }, "Version": "0.16.18", "Release": "1", "Arch": "amd64", "SrcName": "sord", "SrcVersion": "0.16.18", "SrcRelease": "1", "Licenses": [ "ISC" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libserd-0-0@0.32.4-1", "libzix-0-0@0.6.2-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsord-0.so.0.16.18", "/usr/share/doc/libsord-0-0/changelog.Debian.gz", "/usr/share/doc/libsord-0-0/changelog.gz", "/usr/share/doc/libsord-0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsoxr0@0.1.3-4+b2", "Name": "libsoxr0", "Identifier": { "PURL": "pkg:deb/debian/libsoxr0@0.1.3-4%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "e97d8c7ede87c4ea" }, "Version": "0.1.3", "Release": "4+b2", "Arch": "amd64", "SrcName": "libsoxr", "SrcVersion": "0.1.3", "SrcRelease": "4", "Licenses": [ "LGPL-2.1-or-later", "Spherepack", "permissive1", "permissive2", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgomp1@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsoxr.so.0.1.2", "/usr/share/doc/libsoxr0/changelog.Debian.amd64.gz", "/usr/share/doc/libsoxr0/changelog.Debian.gz", "/usr/share/doc/libsoxr0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libspeex1@1.2.1-3", "Name": "libspeex1", "Identifier": { "PURL": "pkg:deb/debian/libspeex1@1.2.1-3?arch=amd64\u0026distro=debian-13.6", "UID": "d374d02884418a0b" }, "Version": "1.2.1", "Release": "3", "Arch": "amd64", "SrcName": "speex", "SrcVersion": "1.2.1", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause", "GFDL-1.1-or-later", "custom-1", "LGPL-2.0-or-later", "LGPL-2.0-only", "GFDL-1.2-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libspeex.so.1.5.2", "/usr/share/doc/libspeex1/changelog.Debian.gz", "/usr/share/doc/libspeex1/changelog.gz", "/usr/share/doc/libspeex1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsphinxbase3t64@0.8+5prealpha+1-21+b1", "Name": "libsphinxbase3t64", "Identifier": { "PURL": "pkg:deb/debian/libsphinxbase3t64@0.8%2B5prealpha%2B1-21%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "8e20de12491cbe75" }, "Version": "0.8+5prealpha+1", "Release": "21+b1", "Arch": "amd64", "SrcName": "sphinxbase", "SrcVersion": "0.8+5prealpha+1", "SrcRelease": "21", "Licenses": [ "BSD-2-Clause", "BSD-3-clause-carnegie", "BSD-2-clause-beyond", "u-o-tennesee", "lucent", "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Accessibility Team \u003cpkg-a11y-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libblas3@3.12.1-6", "libc6@2.41-12+deb13u3", "liblapack3@3.12.1-6", "libpulse0@17.0+dfsg1-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsphinxad.so.3.0.0", "/usr/lib/x86_64-linux-gnu/libsphinxbase.so.3.0.0", "/usr/share/doc/libsphinxbase3t64/changelog.Debian.amd64.gz", "/usr/share/doc/libsphinxbase3t64/changelog.Debian.gz", "/usr/share/doc/libsphinxbase3t64/copyright", "/usr/share/lintian/overrides/libsphinxbase3t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libsqlite3-0@3.46.1-7+deb13u1", "Name": "libsqlite3-0", "Identifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "c7da287e696e8198" }, "Version": "3.46.1", "Release": "7+deb13u1", "Arch": "amd64", "SrcName": "sqlite3", "SrcVersion": "3.46.1", "SrcRelease": "7+deb13u1", "Licenses": [ "public-domain", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6", "/usr/share/doc/libsqlite3-0/README.Debian", "/usr/share/doc/libsqlite3-0/changelog.Debian.gz", "/usr/share/doc/libsqlite3-0/changelog.gz", "/usr/share/doc/libsqlite3-0/changelog.html.gz", "/usr/share/doc/libsqlite3-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsratom-0-0@0.6.18-1", "Name": "libsratom-0-0", "Identifier": { "PURL": "pkg:deb/debian/libsratom-0-0@0.6.18-1?arch=amd64\u0026distro=debian-13.6", "UID": "1be66eedd302363d" }, "Version": "0.6.18", "Release": "1", "Arch": "amd64", "SrcName": "sratom", "SrcVersion": "0.6.18", "SrcRelease": "1", "Licenses": [ "ISC", "0BSD" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libserd-0-0@0.32.4-1", "libsord-0-0@0.16.18-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsratom-0.so.0.6.18", "/usr/share/doc/libsratom-0-0/changelog.Debian.gz", "/usr/share/doc/libsratom-0-0/changelog.gz", "/usr/share/doc/libsratom-0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsrt1.5-gnutls@1.5.4-1+deb13u1", "Name": "libsrt1.5-gnutls", "Identifier": { "PURL": "pkg:deb/debian/libsrt1.5-gnutls@1.5.4-1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "ac6c1eeea34fabe6" }, "Version": "1.5.4", "Release": "1+deb13u1", "Arch": "amd64", "SrcName": "srt", "SrcVersion": "1.5.4", "SrcRelease": "1+deb13u1", "Licenses": [ "MPL-2.0", "BSD-3-Clause", "Zlib", "Unlicense", "LGPL-2.1-or-later", "LGPL-2.1-only" ], "Maintainer": "Florian Ernst \u003cflorian@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libgnutls30t64@3.8.9-3+deb13u4", "libnettle8t64@3.10.1-1", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsrt-gnutls.so.1.5.4", "/usr/share/doc/libsrt1.5-gnutls/changelog.Debian.gz", "/usr/share/doc/libsrt1.5-gnutls/copyright", "/usr/share/lintian/overrides/libsrt1.5-gnutls" ], "AnalyzedBy": "dpkg" }, { "ID": "libssh-4@0.11.5-0+deb13u1", "Name": "libssh-4", "Identifier": { "PURL": "pkg:deb/debian/libssh-4@0.11.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "3b69ae222409336f" }, "Version": "0.11.5", "Release": "0+deb13u1", "Arch": "amd64", "SrcName": "libssh", "SrcVersion": "0.11.5", "SrcRelease": "0+deb13u1", "Licenses": [ "LGPL-2.1+~OpenSSL", "public-domain", "ISC", "LGPL-2.1-only", "BSD-2-Clause", "BSD-3-Clause" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgssapi-krb5-2@1.21.3-5+deb13u1", "libssl3t64@3.5.7-1~deb13u2", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libssh.so.4.10.5", "/usr/share/doc/libssh-4/README.Debian", "/usr/share/doc/libssh-4/changelog.Debian.gz", "/usr/share/doc/libssh-4/changelog.gz", "/usr/share/doc/libssh-4/copyright", "/usr/share/lintian/overrides/libssh-4" ], "AnalyzedBy": "dpkg" }, { "ID": "libssh2-1t64@1.11.1-1+deb13u2", "Name": "libssh2-1t64", "Identifier": { "PURL": "pkg:deb/debian/libssh2-1t64@1.11.1-1%2Bdeb13u2?arch=amd64\u0026distro=debian-13.6", "UID": "e8cee59da9b8e4bd" }, "Version": "1.11.1", "Release": "1+deb13u2", "Arch": "amd64", "SrcName": "libssh2", "SrcVersion": "1.11.1", "SrcRelease": "1+deb13u2", "Licenses": [ "BSD-3-Clause", "ISC" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libssl3t64@3.5.7-1~deb13u2", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libssh2.so.1.0.1", "/usr/share/doc/libssh2-1t64/AUTHORS", "/usr/share/doc/libssh2-1t64/RELEASE-NOTES.gz", "/usr/share/doc/libssh2-1t64/changelog.Debian.gz", "/usr/share/doc/libssh2-1t64/changelog.gz", "/usr/share/doc/libssh2-1t64/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libssl3t64@3.5.7-1~deb13u2", "Name": "libssl3t64", "Identifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.7-1~deb13u2?arch=amd64\u0026distro=debian-13.6", "UID": "ef6621757ca9b535" }, "Version": "3.5.7", "Release": "1~deb13u2", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.5.7", "SrcRelease": "1~deb13u2", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libzstd1@1.5.7+dfsg-1", "openssl-provider-legacy@3.5.7-1~deb13u2", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:4d43b7f98e4c38fd2d37f37f1bf9965d2c4018b01453d3b29d924653c3275f4b" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/engines-3/afalg.so", "/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so", "/usr/lib/x86_64-linux-gnu/engines-3/padlock.so", "/usr/lib/x86_64-linux-gnu/libcrypto.so.3", "/usr/lib/x86_64-linux-gnu/libssl.so.3", "/usr/share/doc/libssl3t64/NEWS.Debian.gz", "/usr/share/doc/libssl3t64/changelog.Debian.gz", "/usr/share/doc/libssl3t64/changelog.gz", "/usr/share/doc/libssl3t64/copyright", "/usr/share/lintian/overrides/libssl3t64" ], "AnalyzedBy": "dpkg" }, { "ID": "libstdc++6@14.2.0-19", "Name": "libstdc++6", "Identifier": { "PURL": "pkg:deb/debian/libstdc%2B%2B6@14.2.0-19?arch=amd64\u0026distro=debian-13.6", "UID": "1b384a6346513d7c" }, "Version": "14.2.0", "Release": "19", "Arch": "amd64", "SrcName": "gcc-14", "SrcVersion": "14.2.0", "SrcRelease": "19", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-14-base@14.2.0-19", "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.33", "/usr/share/gcc/python/libstdcxx/__init__.py", "/usr/share/gcc/python/libstdcxx/v6/__init__.py", "/usr/share/gcc/python/libstdcxx/v6/printers.py", "/usr/share/gcc/python/libstdcxx/v6/xmethods.py", "/usr/share/gdb/auto-load/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.33-gdb.py" ], "AnalyzedBy": "dpkg" }, { "ID": "libsvtav1enc2@2.3.0+dfsg-1", "Name": "libsvtav1enc2", "Identifier": { "PURL": "pkg:deb/debian/libsvtav1enc2@2.3.0%2Bdfsg-1?arch=amd64\u0026distro=debian-13.6", "UID": "7681c41a6e97472" }, "Version": "2.3.0+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "svt-av1", "SrcVersion": "2.3.0+dfsg", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause-Clear", "LGPL-2.1-or-later", "BSD-2-Clause", "ISC", "MIT", "BSD-3-Clause", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libSvtAv1Enc.so.2.3.0", "/usr/share/doc/libsvtav1enc2/changelog.Debian.gz", "/usr/share/doc/libsvtav1enc2/changelog.gz", "/usr/share/doc/libsvtav1enc2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libswresample5@7:7.1.5-0+deb13u1", "Name": "libswresample5", "Identifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "Version": "7.1.5", "Release": "0+deb13u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "7.1.5", "SrcRelease": "0+deb13u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavutil59@7:7.1.5-0+deb13u1", "libc6@2.41-12+deb13u3", "libsoxr0@0.1.3-4+b2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libswresample.so.5.3.100", "/usr/share/doc/libswresample5/changelog.Debian.gz", "/usr/share/doc/libswresample5/changelog.gz", "/usr/share/doc/libswresample5/copyright", "/usr/share/lintian/overrides/libswresample5" ], "AnalyzedBy": "dpkg" }, { "ID": "libswscale8@7:7.1.5-0+deb13u1", "Name": "libswscale8", "Identifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "Version": "7.1.5", "Release": "0+deb13u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "7.1.5", "SrcRelease": "0+deb13u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavutil59@7:7.1.5-0+deb13u1", "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libswscale.so.8.3.100", "/usr/share/doc/libswscale8/changelog.Debian.gz", "/usr/share/doc/libswscale8/changelog.gz", "/usr/share/doc/libswscale8/copyright", "/usr/share/lintian/overrides/libswscale8" ], "AnalyzedBy": "dpkg" }, { "ID": "libsystemd0@257.13-1~deb13u1", "Name": "libsystemd0", "Identifier": { "PURL": "pkg:deb/debian/libsystemd0@257.13-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "a2b4ba47389f858e" }, "Version": "257.13", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "systemd", "SrcVersion": "257.13", "SrcRelease": "1~deb13u1", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "GPL-2 with Linux-syscall-note exception", "MIT", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcap2@1:2.75-10+deb13u1+b1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsystemd.so.0.40.0", "/usr/share/doc/libsystemd0/NEWS.Debian.gz", "/usr/share/doc/libsystemd0/changelog.Debian.gz", "/usr/share/doc/libsystemd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtasn1-6@4.20.0-2+deb13u1", "Name": "libtasn1-6", "Identifier": { "PURL": "pkg:deb/debian/libtasn1-6@4.20.0-2%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "915bcc39941cbb33" }, "Version": "4.20.0", "Release": "2+deb13u1", "Arch": "amd64", "SrcName": "libtasn1-6", "SrcVersion": "4.20.0", "SrcRelease": "2+deb13u1", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-only", "GPL-3.0-only", "GFDL-1.3-only" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtasn1.so.6.6.4", "/usr/share/doc/libtasn1-6/AUTHORS", "/usr/share/doc/libtasn1-6/README.md", "/usr/share/doc/libtasn1-6/THANKS", "/usr/share/doc/libtasn1-6/changelog.Debian.gz", "/usr/share/doc/libtasn1-6/changelog.gz", "/usr/share/doc/libtasn1-6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libthai-data@0.1.29-2", "Name": "libthai-data", "Identifier": { "PURL": "pkg:deb/debian/libthai-data@0.1.29-2?arch=all\u0026distro=debian-13.6", "UID": "d36b032d8ddab6b2" }, "Version": "0.1.29", "Release": "2", "Arch": "all", "SrcName": "libthai", "SrcVersion": "0.1.29", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Theppitak Karoonboonyanan \u003cthep@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/doc/libthai-data/changelog.Debian.gz", "/usr/share/doc/libthai-data/changelog.gz", "/usr/share/doc/libthai-data/copyright", "/usr/share/libthai/thbrk.tri" ], "AnalyzedBy": "dpkg" }, { "ID": "libthai0@0.1.29-2+b1", "Name": "libthai0", "Identifier": { "PURL": "pkg:deb/debian/libthai0@0.1.29-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "dd252ce97eb1c4ff" }, "Version": "0.1.29", "Release": "2+b1", "Arch": "amd64", "SrcName": "libthai", "SrcVersion": "0.1.29", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Theppitak Karoonboonyanan \u003cthep@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdatrie1@0.2.13-3+b1", "libthai-data@0.1.29-2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libthai.so.0.3.1", "/usr/share/doc/libthai0/changelog.Debian.amd64.gz", "/usr/share/doc/libthai0/changelog.Debian.gz", "/usr/share/doc/libthai0/changelog.gz", "/usr/share/doc/libthai0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtheoradec1@1.2.0~alpha1+dfsg-6", "Name": "libtheoradec1", "Identifier": { "PURL": "pkg:deb/debian/libtheoradec1@1.2.0~alpha1%2Bdfsg-6?arch=amd64\u0026distro=debian-13.6", "UID": "6bfc0e83b6445bd2" }, "Version": "1.2.0~alpha1+dfsg", "Release": "6", "Arch": "amd64", "SrcName": "libtheora", "SrcVersion": "1.2.0~alpha1+dfsg", "SrcRelease": "6", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.0-only", "BSD-4-Clause" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcairo2@1.18.4-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtheoradec.so.1.1.5", "/usr/share/doc/libtheoradec1/changelog.Debian.gz", "/usr/share/doc/libtheoradec1/changelog.gz", "/usr/share/doc/libtheoradec1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtheoraenc1@1.2.0~alpha1+dfsg-6", "Name": "libtheoraenc1", "Identifier": { "PURL": "pkg:deb/debian/libtheoraenc1@1.2.0~alpha1%2Bdfsg-6?arch=amd64\u0026distro=debian-13.6", "UID": "9500ded96ce19f6d" }, "Version": "1.2.0~alpha1+dfsg", "Release": "6", "Arch": "amd64", "SrcName": "libtheora", "SrcVersion": "1.2.0~alpha1+dfsg", "SrcRelease": "6", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.0-only", "BSD-4-Clause" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libogg0@1.3.5-3+b2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtheoraenc.so.1.2.0", "/usr/share/doc/libtheoraenc1/changelog.Debian.gz", "/usr/share/doc/libtheoraenc1/changelog.gz", "/usr/share/doc/libtheoraenc1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtiff6@4.7.0-3+deb13u3", "Name": "libtiff6", "Identifier": { "PURL": "pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "9dd8411c2ec5ec7c" }, "Version": "4.7.0", "Release": "3+deb13u3", "Arch": "amd64", "SrcName": "tiff", "SrcVersion": "4.7.0", "SrcRelease": "3+deb13u3", "Licenses": [ "Hylafax" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdeflate0@1.23-2", "libjbig0@2.1-6.1+b2", "libjpeg62-turbo@1:2.1.5-4", "liblerc4@4.0.0+ds-5", "liblzma5@5.8.1-1+deb13u1", "libwebp7@1.5.0-0.1", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtiff.so.6.1.0", "/usr/share/doc/libtiff6/changelog.Debian.gz", "/usr/share/doc/libtiff6/changelog.gz", "/usr/share/doc/libtiff6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtinfo6@6.5+20250216-2", "Name": "libtinfo6", "Identifier": { "PURL": "pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.6", "UID": "ba2c2b464f07108a" }, "Version": "6.5+20250216", "Release": "2", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtic.so.6.5", "/usr/lib/x86_64-linux-gnu/libtinfo.so.6.5", "/usr/share/doc/libtinfo6/changelog.Debian.gz", "/usr/share/doc/libtinfo6/changelog.gz", "/usr/share/doc/libtinfo6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtwolame0@0.4.0-2+b2", "Name": "libtwolame0", "Identifier": { "PURL": "pkg:deb/debian/libtwolame0@0.4.0-2%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "231b488593c62a6e" }, "Version": "0.4.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "twolame", "SrcVersion": "0.4.0", "SrcRelease": "2", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtwolame.so.0.0.0", "/usr/share/doc/libtwolame0/changelog.Debian.amd64.gz", "/usr/share/doc/libtwolame0/changelog.Debian.gz", "/usr/share/doc/libtwolame0/changelog.gz", "/usr/share/doc/libtwolame0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libudev1@257.13-1~deb13u1", "Name": "libudev1", "Identifier": { "PURL": "pkg:deb/debian/libudev1@257.13-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "3b7a2f1a9ab169b" }, "Version": "257.13", "Release": "1~deb13u1", "Arch": "amd64", "SrcName": "systemd", "SrcVersion": "257.13", "SrcRelease": "1~deb13u1", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "GPL-2 with Linux-syscall-note exception", "MIT", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libcap2@1:2.75-10+deb13u1+b1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libudev.so.1.7.10", "/usr/share/doc/libudev1/NEWS.Debian.gz", "/usr/share/doc/libudev1/changelog.Debian.gz", "/usr/share/doc/libudev1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libudfread0@1.1.2-1+b2", "Name": "libudfread0", "Identifier": { "PURL": "pkg:deb/debian/libudfread0@1.1.2-1%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "89fe779561cce993" }, "Version": "1.1.2", "Release": "1+b2", "Arch": "amd64", "SrcName": "libudfread", "SrcVersion": "1.1.2", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "GPL-2+ with autoconf-macro exception", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libudfread.so.0.1.0", "/usr/share/doc/libudfread0/changelog.Debian.amd64.gz", "/usr/share/doc/libudfread0/changelog.Debian.gz", "/usr/share/doc/libudfread0/changelog.gz", "/usr/share/doc/libudfread0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libunibreak6@6.1-3", "Name": "libunibreak6", "Identifier": { "PURL": "pkg:deb/debian/libunibreak6@6.1-3?arch=amd64\u0026distro=debian-13.6", "UID": "3f6a8d4119ad8080" }, "Version": "6.1", "Release": "3", "Arch": "amd64", "SrcName": "libunibreak", "SrcVersion": "6.1", "SrcRelease": "3", "Licenses": [ "Zlib", "unicode-data" ], "Maintainer": "Debian Qt/KDE Maintainers \u003cdebian-qt-kde@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libunibreak.so.6.0.1", "/usr/share/doc/libunibreak6/changelog.Debian.gz", "/usr/share/doc/libunibreak6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libunistring5@1.3-2", "Name": "libunistring5", "Identifier": { "PURL": "pkg:deb/debian/libunistring5@1.3-2?arch=amd64\u0026distro=debian-13.6", "UID": "ff12343cd2297c69" }, "Version": "1.3", "Release": "2", "Arch": "amd64", "SrcName": "libunistring", "SrcVersion": "1.3", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "LGPL-3.0-or-later", "LGPL-2.0-or-later", "GFDL-1.3-or-later", "GFDL-1.2-or-later", "LGPL-3.0-only", "LGPL-2.1-or-later", "BSD-3-Clause", "ISC", "Unicode-DFS-2016", "public-domain", "FreeSoftware", "GPL-2.0-or-later", "GPL-2+ with distribution exception", "MIT", "X11", "GPL-3.0-only", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Jörg Frings-Fürst \u003cdebian@jff.email\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libunistring.so.5.2.0", "/usr/share/doc/libunistring5/changelog.Debian.gz", "/usr/share/doc/libunistring5/changelog.gz", "/usr/share/doc/libunistring5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libusb-1.0-0@2:1.0.28-1", "Name": "libusb-1.0-0", "Identifier": { "PURL": "pkg:deb/debian/libusb-1.0-0@1.0.28-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "dce8626196501f3f" }, "Version": "1.0.28", "Release": "1", "Epoch": 2, "Arch": "amd64", "SrcName": "libusb-1.0", "SrcVersion": "1.0.28", "SrcRelease": "1", "SrcEpoch": 2, "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-or-later", "GPL-2.0-only", "MIT", "FSFAP" ], "Maintainer": "Aurelien Jarno \u003caurel32@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libudev1@257.13-1~deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libusb-1.0.so.0.5.0", "/usr/share/doc/libusb-1.0-0/README", "/usr/share/doc/libusb-1.0-0/changelog.Debian.gz", "/usr/share/doc/libusb-1.0-0/changelog.gz", "/usr/share/doc/libusb-1.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libuuid1@2.41.5-0+deb13u1", "Name": "libuuid1", "Identifier": { "PURL": "pkg:deb/debian/libuuid1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "67cba3b022acab2f" }, "Version": "2.41.5", "Release": "0+deb13u1", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41.5", "SrcRelease": "0+deb13u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0", "/usr/share/doc/libuuid1/NEWS.Debian.gz", "/usr/share/doc/libuuid1/changelog.Debian.gz", "/usr/share/doc/libuuid1/changelog.gz", "/usr/share/doc/libuuid1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libva-drm2@2.22.0-3", "Name": "libva-drm2", "Identifier": { "PURL": "pkg:deb/debian/libva-drm2@2.22.0-3?arch=amd64\u0026distro=debian-13.6", "UID": "e2640dfccbc95ec" }, "Version": "2.22.0", "Release": "3", "Arch": "amd64", "SrcName": "libva", "SrcVersion": "2.22.0", "SrcRelease": "3", "Licenses": [ "MIT", "Expat-advertising", "other", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdrm2@2.4.124-2", "libva2@2.22.0-3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libva-drm.so.2.2200.0", "/usr/share/doc/libva-drm2/changelog.Debian.gz", "/usr/share/doc/libva-drm2/changelog.gz", "/usr/share/doc/libva-drm2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libva-x11-2@2.22.0-3", "Name": "libva-x11-2", "Identifier": { "PURL": "pkg:deb/debian/libva-x11-2@2.22.0-3?arch=amd64\u0026distro=debian-13.6", "UID": "7fde578bfd75547a" }, "Version": "2.22.0", "Release": "3", "Arch": "amd64", "SrcName": "libva", "SrcVersion": "2.22.0", "SrcRelease": "3", "Licenses": [ "MIT", "Expat-advertising", "other", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdrm2@2.4.124-2", "libva2@2.22.0-3", "libx11-6@2:1.8.12-1", "libx11-xcb1@2:1.8.12-1", "libxcb-dri3-0@1.17.0-2+b1", "libxcb1@1.17.0-2+b1", "libxext6@2:1.3.4-1+b3", "libxfixes3@1:6.0.0-2+b4" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libva-x11.so.2.2200.0", "/usr/share/doc/libva-x11-2/changelog.Debian.gz", "/usr/share/doc/libva-x11-2/changelog.gz", "/usr/share/doc/libva-x11-2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libva2@2.22.0-3", "Name": "libva2", "Identifier": { "PURL": "pkg:deb/debian/libva2@2.22.0-3?arch=amd64\u0026distro=debian-13.6", "UID": "3466f7d5ce81d0cc" }, "Version": "2.22.0", "Release": "3", "Arch": "amd64", "SrcName": "libva", "SrcVersion": "2.22.0", "SrcRelease": "3", "Licenses": [ "MIT", "Expat-advertising", "other", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libva.so.2.2200.0", "/usr/share/doc/libva2/changelog.Debian.gz", "/usr/share/doc/libva2/changelog.gz", "/usr/share/doc/libva2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvdpau1@1.5-3+b1", "Name": "libvdpau1", "Identifier": { "PURL": "pkg:deb/debian/libvdpau1@1.5-3%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "a64e4cad43939a1c" }, "Version": "1.5", "Release": "3+b1", "Arch": "amd64", "SrcName": "libvdpau", "SrcVersion": "1.5", "SrcRelease": "3", "Licenses": [ "MIT", "other" ], "Maintainer": "Debian NVIDIA Maintainers \u003cpkg-nvidia-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libx11-6@2:1.8.12-1", "libxext6@2:1.3.4-1+b3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvdpau.so.1.0.0", "/usr/lib/x86_64-linux-gnu/vdpau/libvdpau_trace.so.1.0.0", "/usr/share/bug/libvdpau1", "/usr/share/doc/libvdpau1/changelog.Debian.amd64.gz", "/usr/share/doc/libvdpau1/changelog.Debian.gz", "/usr/share/doc/libvdpau1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvidstab1.1@1.1.0-2+b2", "Name": "libvidstab1.1", "Identifier": { "PURL": "pkg:deb/debian/libvidstab1.1@1.1.0-2%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "2790d316ed25a0ce" }, "Version": "1.1.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "libvidstab", "SrcVersion": "1.1.0", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Keng-Yu Lin \u003ckengyu@lexical.tw\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgomp1@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvidstab.so.1.1", "/usr/share/doc/libvidstab1.1/changelog.Debian.amd64.gz", "/usr/share/doc/libvidstab1.1/changelog.Debian.gz", "/usr/share/doc/libvidstab1.1/changelog.gz", "/usr/share/doc/libvidstab1.1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvorbis0a@1.3.7-3", "Name": "libvorbis0a", "Identifier": { "PURL": "pkg:deb/debian/libvorbis0a@1.3.7-3?arch=amd64\u0026distro=debian-13.6", "UID": "6c85e42a81f62dc8" }, "Version": "1.3.7", "Release": "3", "Arch": "amd64", "SrcName": "libvorbis", "SrcVersion": "1.3.7", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause", "RFC-special" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libogg0@1.3.5-3+b2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvorbis.so.0.4.9", "/usr/share/doc/libvorbis0a/changelog.Debian.gz", "/usr/share/doc/libvorbis0a/changelog.gz", "/usr/share/doc/libvorbis0a/copyright", "/usr/share/lintian/overrides/libvorbis0a" ], "AnalyzedBy": "dpkg" }, { "ID": "libvorbisenc2@1.3.7-3", "Name": "libvorbisenc2", "Identifier": { "PURL": "pkg:deb/debian/libvorbisenc2@1.3.7-3?arch=amd64\u0026distro=debian-13.6", "UID": "690d73afa98cd40f" }, "Version": "1.3.7", "Release": "3", "Arch": "amd64", "SrcName": "libvorbis", "SrcVersion": "1.3.7", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause", "RFC-special" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libvorbis0a@1.3.7-3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvorbisenc.so.2.0.12", "/usr/share/doc/libvorbisenc2/changelog.Debian.gz", "/usr/share/doc/libvorbisenc2/changelog.gz", "/usr/share/doc/libvorbisenc2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvorbisfile3@1.3.7-3", "Name": "libvorbisfile3", "Identifier": { "PURL": "pkg:deb/debian/libvorbisfile3@1.3.7-3?arch=amd64\u0026distro=debian-13.6", "UID": "6e49101cfe5e153f" }, "Version": "1.3.7", "Release": "3", "Arch": "amd64", "SrcName": "libvorbis", "SrcVersion": "1.3.7", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause", "RFC-special" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libogg0@1.3.5-3+b2", "libvorbis0a@1.3.7-3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvorbisfile.so.3.3.8", "/usr/share/doc/libvorbisfile3/changelog.Debian.gz", "/usr/share/doc/libvorbisfile3/changelog.gz", "/usr/share/doc/libvorbisfile3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvpl2@1:2.14.0-1+b1", "Name": "libvpl2", "Identifier": { "PURL": "pkg:deb/debian/libvpl2@2.14.0-1%2Bb1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "a89550d13105b204" }, "Version": "2.14.0", "Release": "1+b1", "Epoch": 1, "Arch": "amd64", "SrcName": "libvpl", "SrcVersion": "2.14.0", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "MIT", "BSD-3-Clause", "Apache-2.0" ], "Maintainer": "Timo Aaltonen \u003ctjaalton@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvpl.so.2.14", "/usr/share/doc/libvpl2/changelog.Debian.amd64.gz", "/usr/share/doc/libvpl2/changelog.Debian.gz", "/usr/share/doc/libvpl2/changelog.gz", "/usr/share/doc/libvpl2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvpx9@1.15.0-2.1+deb13u1", "Name": "libvpx9", "Identifier": { "PURL": "pkg:deb/debian/libvpx9@1.15.0-2.1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "3f7380537aff915b" }, "Version": "1.15.0", "Release": "2.1+deb13u1", "Arch": "amd64", "SrcName": "libvpx", "SrcVersion": "1.15.0", "SrcRelease": "2.1+deb13u1", "Licenses": [ "BSD-3-Clause", "public-domain", "ISC" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvpx.so.9.1.0", "/usr/share/doc/libvpx9/changelog.Debian.gz", "/usr/share/doc/libvpx9/changelog.gz", "/usr/share/doc/libvpx9/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvulkan1@1.4.309.0-1", "Name": "libvulkan1", "Identifier": { "PURL": "pkg:deb/debian/libvulkan1@1.4.309.0-1?arch=amd64\u0026distro=debian-13.6", "UID": "52e098c0f87bcdb2" }, "Version": "1.4.309.0", "Release": "1", "Arch": "amd64", "SrcName": "vulkan-loader", "SrcVersion": "1.4.309.0", "SrcRelease": "1", "Licenses": [ "Apache-2.0", "MIT" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvulkan.so.1.4.309", "/usr/share/doc/libvulkan1/changelog.Debian.gz", "/usr/share/doc/libvulkan1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwayland-client0@1.23.1-3", "Name": "libwayland-client0", "Identifier": { "PURL": "pkg:deb/debian/libwayland-client0@1.23.1-3?arch=amd64\u0026distro=debian-13.6", "UID": "36848a6868430594" }, "Version": "1.23.1", "Release": "3", "Arch": "amd64", "SrcName": "wayland", "SrcVersion": "1.23.1", "SrcRelease": "3", "Licenses": [ "X11" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libffi8@3.4.8-2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwayland-client.so.0.23.1", "/usr/share/doc/libwayland-client0/changelog.Debian.gz", "/usr/share/doc/libwayland-client0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwayland-cursor0@1.23.1-3", "Name": "libwayland-cursor0", "Identifier": { "PURL": "pkg:deb/debian/libwayland-cursor0@1.23.1-3?arch=amd64\u0026distro=debian-13.6", "UID": "36c0c45fde980678" }, "Version": "1.23.1", "Release": "3", "Arch": "amd64", "SrcName": "wayland", "SrcVersion": "1.23.1", "SrcRelease": "3", "Licenses": [ "X11" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libwayland-client0@1.23.1-3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwayland-cursor.so.0.23.1", "/usr/share/doc/libwayland-cursor0/changelog.Debian.gz", "/usr/share/doc/libwayland-cursor0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwayland-egl1@1.23.1-3", "Name": "libwayland-egl1", "Identifier": { "PURL": "pkg:deb/debian/libwayland-egl1@1.23.1-3?arch=amd64\u0026distro=debian-13.6", "UID": "49e4b940c4bda878" }, "Version": "1.23.1", "Release": "3", "Arch": "amd64", "SrcName": "wayland", "SrcVersion": "1.23.1", "SrcRelease": "3", "Licenses": [ "X11" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwayland-egl.so.1.23.1", "/usr/share/doc/libwayland-egl1/changelog.Debian.gz", "/usr/share/doc/libwayland-egl1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwayland-server0@1.23.1-3", "Name": "libwayland-server0", "Identifier": { "PURL": "pkg:deb/debian/libwayland-server0@1.23.1-3?arch=amd64\u0026distro=debian-13.6", "UID": "17e2bec8a7a4531a" }, "Version": "1.23.1", "Release": "3", "Arch": "amd64", "SrcName": "wayland", "SrcVersion": "1.23.1", "SrcRelease": "3", "Licenses": [ "X11" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libffi8@3.4.8-2" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwayland-server.so.0.23.1", "/usr/share/doc/libwayland-server0/changelog.Debian.gz", "/usr/share/doc/libwayland-server0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwebp7@1.5.0-0.1", "Name": "libwebp7", "Identifier": { "PURL": "pkg:deb/debian/libwebp7@1.5.0-0.1?arch=amd64\u0026distro=debian-13.6", "UID": "72a7df873cb97601" }, "Version": "1.5.0", "Release": "0.1", "Arch": "amd64", "SrcName": "libwebp", "SrcVersion": "1.5.0", "SrcRelease": "0.1", "Licenses": [ "BSD-3-Clause", "Apache-2.0" ], "Maintainer": "Jeff Breidenbach \u003cjab@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libsharpyuv0@1.5.0-0.1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwebp.so.7.1.10", "/usr/share/doc/libwebp7/changelog.Debian.gz", "/usr/share/doc/libwebp7/changelog.gz", "/usr/share/doc/libwebp7/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwebpmux3@1.5.0-0.1", "Name": "libwebpmux3", "Identifier": { "PURL": "pkg:deb/debian/libwebpmux3@1.5.0-0.1?arch=amd64\u0026distro=debian-13.6", "UID": "eae3c64595cdccd3" }, "Version": "1.5.0", "Release": "0.1", "Arch": "amd64", "SrcName": "libwebp", "SrcVersion": "1.5.0", "SrcRelease": "0.1", "Licenses": [ "BSD-3-Clause", "Apache-2.0" ], "Maintainer": "Jeff Breidenbach \u003cjab@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libwebp7@1.5.0-0.1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwebpmux.so.3.1.1", "/usr/share/doc/libwebpmux3/changelog.Debian.gz", "/usr/share/doc/libwebpmux3/changelog.gz", "/usr/share/doc/libwebpmux3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libx11-6@2:1.8.12-1", "Name": "libx11-6", "Identifier": { "PURL": "pkg:deb/debian/libx11-6@1.8.12-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "3d1913efb366978c" }, "Version": "1.8.12", "Release": "1", "Epoch": 2, "Arch": "amd64", "SrcName": "libx11", "SrcVersion": "1.8.12", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libx11-data@2:1.8.12-1", "libxcb1@1.17.0-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libX11.so.6.4.0", "/usr/share/doc/libx11-6/changelog.Debian.gz", "/usr/share/doc/libx11-6/changelog.gz", "/usr/share/doc/libx11-6/copyright", "/usr/share/lintian/overrides/libx11-6" ], "AnalyzedBy": "dpkg" }, { "ID": "libx11-data@2:1.8.12-1", "Name": "libx11-data", "Identifier": { "PURL": "pkg:deb/debian/libx11-data@1.8.12-1?arch=all\u0026distro=debian-13.6\u0026epoch=2", "UID": "e6b7a201b95ba699" }, "Version": "1.8.12", "Release": "1", "Epoch": 2, "Arch": "all", "SrcName": "libx11", "SrcVersion": "1.8.12", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/X11/XErrorDB", "/usr/share/X11/locale/C/Compose", "/usr/share/X11/locale/C/XI18N_OBJS", "/usr/share/X11/locale/C/XLC_LOCALE", "/usr/share/X11/locale/am_ET.UTF-8/Compose", "/usr/share/X11/locale/am_ET.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/am_ET.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/armscii-8/Compose", "/usr/share/X11/locale/armscii-8/XI18N_OBJS", "/usr/share/X11/locale/armscii-8/XLC_LOCALE", "/usr/share/X11/locale/compose.dir", "/usr/share/X11/locale/cs_CZ.UTF-8/Compose", "/usr/share/X11/locale/cs_CZ.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/cs_CZ.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/el_GR.UTF-8/Compose", "/usr/share/X11/locale/el_GR.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/el_GR.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/en_US.UTF-8/Compose", "/usr/share/X11/locale/en_US.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/en_US.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/fi_FI.UTF-8/Compose", "/usr/share/X11/locale/fi_FI.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/fi_FI.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/georgian-academy/Compose", "/usr/share/X11/locale/georgian-academy/XI18N_OBJS", "/usr/share/X11/locale/georgian-academy/XLC_LOCALE", "/usr/share/X11/locale/georgian-ps/Compose", "/usr/share/X11/locale/georgian-ps/XI18N_OBJS", "/usr/share/X11/locale/georgian-ps/XLC_LOCALE", "/usr/share/X11/locale/ibm-cp1133/Compose", "/usr/share/X11/locale/ibm-cp1133/XI18N_OBJS", "/usr/share/X11/locale/ibm-cp1133/XLC_LOCALE", "/usr/share/X11/locale/iscii-dev/Compose", "/usr/share/X11/locale/iscii-dev/XI18N_OBJS", "/usr/share/X11/locale/iscii-dev/XLC_LOCALE", "/usr/share/X11/locale/isiri-3342/Compose", "/usr/share/X11/locale/isiri-3342/XI18N_OBJS", "/usr/share/X11/locale/isiri-3342/XLC_LOCALE", "/usr/share/X11/locale/iso8859-1/Compose", "/usr/share/X11/locale/iso8859-1/XI18N_OBJS", "/usr/share/X11/locale/iso8859-1/XLC_LOCALE", "/usr/share/X11/locale/iso8859-10/Compose", "/usr/share/X11/locale/iso8859-10/XI18N_OBJS", "/usr/share/X11/locale/iso8859-10/XLC_LOCALE", "/usr/share/X11/locale/iso8859-11/Compose", "/usr/share/X11/locale/iso8859-11/XI18N_OBJS", "/usr/share/X11/locale/iso8859-11/XLC_LOCALE", "/usr/share/X11/locale/iso8859-13/Compose", "/usr/share/X11/locale/iso8859-13/XI18N_OBJS", "/usr/share/X11/locale/iso8859-13/XLC_LOCALE", "/usr/share/X11/locale/iso8859-14/Compose", "/usr/share/X11/locale/iso8859-14/XI18N_OBJS", "/usr/share/X11/locale/iso8859-14/XLC_LOCALE", "/usr/share/X11/locale/iso8859-15/Compose", "/usr/share/X11/locale/iso8859-15/XI18N_OBJS", "/usr/share/X11/locale/iso8859-15/XLC_LOCALE", "/usr/share/X11/locale/iso8859-2/Compose", "/usr/share/X11/locale/iso8859-2/XI18N_OBJS", "/usr/share/X11/locale/iso8859-2/XLC_LOCALE", "/usr/share/X11/locale/iso8859-3/Compose", "/usr/share/X11/locale/iso8859-3/XI18N_OBJS", "/usr/share/X11/locale/iso8859-3/XLC_LOCALE", "/usr/share/X11/locale/iso8859-4/Compose", "/usr/share/X11/locale/iso8859-4/XI18N_OBJS", "/usr/share/X11/locale/iso8859-4/XLC_LOCALE", "/usr/share/X11/locale/iso8859-5/Compose", "/usr/share/X11/locale/iso8859-5/XI18N_OBJS", "/usr/share/X11/locale/iso8859-5/XLC_LOCALE", "/usr/share/X11/locale/iso8859-6/Compose", "/usr/share/X11/locale/iso8859-6/XI18N_OBJS", "/usr/share/X11/locale/iso8859-6/XLC_LOCALE", "/usr/share/X11/locale/iso8859-7/Compose", "/usr/share/X11/locale/iso8859-7/XI18N_OBJS", "/usr/share/X11/locale/iso8859-7/XLC_LOCALE", "/usr/share/X11/locale/iso8859-8/Compose", "/usr/share/X11/locale/iso8859-8/XI18N_OBJS", "/usr/share/X11/locale/iso8859-8/XLC_LOCALE", "/usr/share/X11/locale/iso8859-9/Compose", "/usr/share/X11/locale/iso8859-9/XI18N_OBJS", "/usr/share/X11/locale/iso8859-9/XLC_LOCALE", "/usr/share/X11/locale/iso8859-9e/Compose", "/usr/share/X11/locale/iso8859-9e/XI18N_OBJS", "/usr/share/X11/locale/iso8859-9e/XLC_LOCALE", "/usr/share/X11/locale/ja.JIS/Compose", "/usr/share/X11/locale/ja.JIS/XI18N_OBJS", "/usr/share/X11/locale/ja.JIS/XLC_LOCALE", "/usr/share/X11/locale/ja.SJIS/Compose", "/usr/share/X11/locale/ja.SJIS/XI18N_OBJS", "/usr/share/X11/locale/ja.SJIS/XLC_LOCALE", "/usr/share/X11/locale/ja/Compose", "/usr/share/X11/locale/ja/XI18N_OBJS", "/usr/share/X11/locale/ja/XLC_LOCALE", "/usr/share/X11/locale/ja_JP.UTF-8/Compose", "/usr/share/X11/locale/ja_JP.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/ja_JP.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/km_KH.UTF-8/Compose", "/usr/share/X11/locale/km_KH.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/km_KH.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/ko/Compose", "/usr/share/X11/locale/ko/XI18N_OBJS", "/usr/share/X11/locale/ko/XLC_LOCALE", "/usr/share/X11/locale/ko_KR.UTF-8/Compose", "/usr/share/X11/locale/ko_KR.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/ko_KR.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/koi8-c/Compose", "/usr/share/X11/locale/koi8-c/XI18N_OBJS", "/usr/share/X11/locale/koi8-c/XLC_LOCALE", "/usr/share/X11/locale/koi8-r/Compose", "/usr/share/X11/locale/koi8-r/XI18N_OBJS", "/usr/share/X11/locale/koi8-r/XLC_LOCALE", "/usr/share/X11/locale/koi8-u/Compose", "/usr/share/X11/locale/koi8-u/XI18N_OBJS", "/usr/share/X11/locale/koi8-u/XLC_LOCALE", "/usr/share/X11/locale/locale.alias", "/usr/share/X11/locale/locale.dir", "/usr/share/X11/locale/microsoft-cp1251/Compose", "/usr/share/X11/locale/microsoft-cp1251/XI18N_OBJS", "/usr/share/X11/locale/microsoft-cp1251/XLC_LOCALE", "/usr/share/X11/locale/microsoft-cp1255/Compose", "/usr/share/X11/locale/microsoft-cp1255/XI18N_OBJS", "/usr/share/X11/locale/microsoft-cp1255/XLC_LOCALE", "/usr/share/X11/locale/microsoft-cp1256/Compose", "/usr/share/X11/locale/microsoft-cp1256/XI18N_OBJS", "/usr/share/X11/locale/microsoft-cp1256/XLC_LOCALE", "/usr/share/X11/locale/mulelao-1/Compose", "/usr/share/X11/locale/mulelao-1/XI18N_OBJS", "/usr/share/X11/locale/mulelao-1/XLC_LOCALE", "/usr/share/X11/locale/nokhchi-1/Compose", "/usr/share/X11/locale/nokhchi-1/XI18N_OBJS", "/usr/share/X11/locale/nokhchi-1/XLC_LOCALE", "/usr/share/X11/locale/pt_BR.UTF-8/Compose", "/usr/share/X11/locale/pt_BR.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/pt_BR.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/pt_PT.UTF-8/Compose", "/usr/share/X11/locale/pt_PT.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/pt_PT.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/ru_RU.UTF-8/Compose", "/usr/share/X11/locale/ru_RU.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/ru_RU.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/sr_RS.UTF-8/Compose", "/usr/share/X11/locale/sr_RS.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/sr_RS.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/tatar-cyr/Compose", "/usr/share/X11/locale/tatar-cyr/XI18N_OBJS", "/usr/share/X11/locale/tatar-cyr/XLC_LOCALE", "/usr/share/X11/locale/th_TH.UTF-8/Compose", "/usr/share/X11/locale/th_TH.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/th_TH.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/th_TH/Compose", "/usr/share/X11/locale/th_TH/XI18N_OBJS", "/usr/share/X11/locale/th_TH/XLC_LOCALE", "/usr/share/X11/locale/tscii-0/Compose", "/usr/share/X11/locale/tscii-0/XI18N_OBJS", "/usr/share/X11/locale/tscii-0/XLC_LOCALE", "/usr/share/X11/locale/vi_VN.tcvn/Compose", "/usr/share/X11/locale/vi_VN.tcvn/XI18N_OBJS", "/usr/share/X11/locale/vi_VN.tcvn/XLC_LOCALE", "/usr/share/X11/locale/vi_VN.viscii/Compose", "/usr/share/X11/locale/vi_VN.viscii/XI18N_OBJS", "/usr/share/X11/locale/vi_VN.viscii/XLC_LOCALE", "/usr/share/X11/locale/zh_CN.UTF-8/Compose", "/usr/share/X11/locale/zh_CN.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/zh_CN.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/zh_CN.gb18030/Compose", "/usr/share/X11/locale/zh_CN.gb18030/XI18N_OBJS", "/usr/share/X11/locale/zh_CN.gb18030/XLC_LOCALE", "/usr/share/X11/locale/zh_CN.gbk/Compose", "/usr/share/X11/locale/zh_CN.gbk/XI18N_OBJS", "/usr/share/X11/locale/zh_CN.gbk/XLC_LOCALE", "/usr/share/X11/locale/zh_CN/Compose", "/usr/share/X11/locale/zh_CN/XI18N_OBJS", "/usr/share/X11/locale/zh_CN/XLC_LOCALE", "/usr/share/X11/locale/zh_HK.UTF-8/Compose", "/usr/share/X11/locale/zh_HK.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/zh_HK.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/zh_HK.big5/Compose", "/usr/share/X11/locale/zh_HK.big5/XI18N_OBJS", "/usr/share/X11/locale/zh_HK.big5/XLC_LOCALE", "/usr/share/X11/locale/zh_HK.big5hkscs/Compose", "/usr/share/X11/locale/zh_HK.big5hkscs/XI18N_OBJS", "/usr/share/X11/locale/zh_HK.big5hkscs/XLC_LOCALE", "/usr/share/X11/locale/zh_TW.UTF-8/Compose", "/usr/share/X11/locale/zh_TW.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/zh_TW.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/zh_TW.big5/Compose", "/usr/share/X11/locale/zh_TW.big5/XI18N_OBJS", "/usr/share/X11/locale/zh_TW.big5/XLC_LOCALE", "/usr/share/X11/locale/zh_TW/Compose", "/usr/share/X11/locale/zh_TW/XI18N_OBJS", "/usr/share/X11/locale/zh_TW/XLC_LOCALE", "/usr/share/doc/libx11-data/changelog.Debian.gz", "/usr/share/doc/libx11-data/changelog.gz", "/usr/share/doc/libx11-data/copyright", "/usr/share/man/man5/Compose.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libx11-xcb1@2:1.8.12-1", "Name": "libx11-xcb1", "Identifier": { "PURL": "pkg:deb/debian/libx11-xcb1@1.8.12-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "fe2eb71291470eee" }, "Version": "1.8.12", "Release": "1", "Epoch": 2, "Arch": "amd64", "SrcName": "libx11", "SrcVersion": "1.8.12", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libx11-6@2:1.8.12-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libX11-xcb.so.1.0.0", "/usr/share/doc/libx11-xcb1/changelog.Debian.gz", "/usr/share/doc/libx11-xcb1/changelog.gz", "/usr/share/doc/libx11-xcb1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libx264-164@2:0.164.3108+git31e19f9-2+b1", "Name": "libx264-164", "Identifier": { "PURL": "pkg:deb/debian/libx264-164@0.164.3108%2Bgit31e19f9-2%2Bb1?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "ef99074dee8b3a50" }, "Version": "0.164.3108+git31e19f9", "Release": "2+b1", "Epoch": 2, "Arch": "amd64", "SrcName": "x264", "SrcVersion": "0.164.3108+git31e19f9", "SrcRelease": "2", "SrcEpoch": 2, "Licenses": [ "GPL-2.0-or-later", "ISC", "GPL-2+ with other exception", "LGPL-2.1-or-later", "BSD-3-Clause", "public-domain", "MIT", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libx264.so.164", "/usr/share/doc/libx264-164/changelog.Debian.amd64.gz", "/usr/share/doc/libx264-164/changelog.Debian.gz", "/usr/share/doc/libx264-164/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libx265-215@4.1-2", "Name": "libx265-215", "Identifier": { "PURL": "pkg:deb/debian/libx265-215@4.1-2?arch=amd64\u0026distro=debian-13.6", "UID": "4041453ec1e1f0e" }, "Version": "4.1", "Release": "2", "Arch": "amd64", "SrcName": "x265", "SrcVersion": "4.1", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "MIT", "LGPL-2.1-or-later", "ISC", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libnuma1@2.0.19-1", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libx265.so.215", "/usr/share/doc/libx265-215/changelog.Debian.gz", "/usr/share/doc/libx265-215/changelog.gz", "/usr/share/doc/libx265-215/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxau6@1:1.0.11-1", "Name": "libxau6", "Identifier": { "PURL": "pkg:deb/debian/libxau6@1.0.11-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "381e6882852a3ffd" }, "Version": "1.0.11", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxau", "SrcVersion": "1.0.11", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXau.so.6.0.0", "/usr/share/doc/libxau6/changelog.Debian.gz", "/usr/share/doc/libxau6/changelog.gz", "/usr/share/doc/libxau6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-dri3-0@1.17.0-2+b1", "Name": "libxcb-dri3-0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-dri3-0@1.17.0-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "3af6d2f037f89f3" }, "Version": "1.17.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.17.0", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libxcb1@1.17.0-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-dri3.so.0.1.0", "/usr/share/doc/libxcb-dri3-0/changelog.Debian.amd64.gz", "/usr/share/doc/libxcb-dri3-0/changelog.Debian.gz", "/usr/share/doc/libxcb-dri3-0/changelog.gz", "/usr/share/doc/libxcb-dri3-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-glx0@1.17.0-2+b1", "Name": "libxcb-glx0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-glx0@1.17.0-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "8763995fa8905a65" }, "Version": "1.17.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.17.0", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libxcb1@1.17.0-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-glx.so.0.0.0", "/usr/share/doc/libxcb-glx0/changelog.Debian.amd64.gz", "/usr/share/doc/libxcb-glx0/changelog.Debian.gz", "/usr/share/doc/libxcb-glx0/changelog.gz", "/usr/share/doc/libxcb-glx0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-present0@1.17.0-2+b1", "Name": "libxcb-present0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-present0@1.17.0-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "e886cc657b70735d" }, "Version": "1.17.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.17.0", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libxcb1@1.17.0-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-present.so.0.0.0", "/usr/share/doc/libxcb-present0/changelog.Debian.amd64.gz", "/usr/share/doc/libxcb-present0/changelog.Debian.gz", "/usr/share/doc/libxcb-present0/changelog.gz", "/usr/share/doc/libxcb-present0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-randr0@1.17.0-2+b1", "Name": "libxcb-randr0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-randr0@1.17.0-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "5f1920f0782a4bf5" }, "Version": "1.17.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.17.0", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libxcb1@1.17.0-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-randr.so.0.1.0", "/usr/share/doc/libxcb-randr0/changelog.Debian.amd64.gz", "/usr/share/doc/libxcb-randr0/changelog.Debian.gz", "/usr/share/doc/libxcb-randr0/changelog.gz", "/usr/share/doc/libxcb-randr0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-render0@1.17.0-2+b1", "Name": "libxcb-render0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-render0@1.17.0-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "afcb6748f1286bd6" }, "Version": "1.17.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.17.0", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libxcb1@1.17.0-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.0", "/usr/share/doc/libxcb-render0/changelog.Debian.amd64.gz", "/usr/share/doc/libxcb-render0/changelog.Debian.gz", "/usr/share/doc/libxcb-render0/changelog.gz", "/usr/share/doc/libxcb-render0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-shape0@1.17.0-2+b1", "Name": "libxcb-shape0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-shape0@1.17.0-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "a5af3ad983cd5559" }, "Version": "1.17.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.17.0", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libxcb1@1.17.0-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-shape.so.0.0.0", "/usr/share/doc/libxcb-shape0/changelog.Debian.amd64.gz", "/usr/share/doc/libxcb-shape0/changelog.Debian.gz", "/usr/share/doc/libxcb-shape0/changelog.gz", "/usr/share/doc/libxcb-shape0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-shm0@1.17.0-2+b1", "Name": "libxcb-shm0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-shm0@1.17.0-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "342f17531643ae12" }, "Version": "1.17.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.17.0", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libxcb1@1.17.0-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-shm.so.0.0.0", "/usr/share/doc/libxcb-shm0/changelog.Debian.amd64.gz", "/usr/share/doc/libxcb-shm0/changelog.Debian.gz", "/usr/share/doc/libxcb-shm0/changelog.gz", "/usr/share/doc/libxcb-shm0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-sync1@1.17.0-2+b1", "Name": "libxcb-sync1", "Identifier": { "PURL": "pkg:deb/debian/libxcb-sync1@1.17.0-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "67e9d80981126bba" }, "Version": "1.17.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.17.0", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libxcb1@1.17.0-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-sync.so.1.0.0", "/usr/share/doc/libxcb-sync1/changelog.Debian.amd64.gz", "/usr/share/doc/libxcb-sync1/changelog.Debian.gz", "/usr/share/doc/libxcb-sync1/changelog.gz", "/usr/share/doc/libxcb-sync1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-xfixes0@1.17.0-2+b1", "Name": "libxcb-xfixes0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-xfixes0@1.17.0-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "329a91f7ccecb7ed" }, "Version": "1.17.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.17.0", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libxcb1@1.17.0-2+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-xfixes.so.0.0.0", "/usr/share/doc/libxcb-xfixes0/changelog.Debian.amd64.gz", "/usr/share/doc/libxcb-xfixes0/changelog.Debian.gz", "/usr/share/doc/libxcb-xfixes0/changelog.gz", "/usr/share/doc/libxcb-xfixes0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb1@1.17.0-2+b1", "Name": "libxcb1", "Identifier": { "PURL": "pkg:deb/debian/libxcb1@1.17.0-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "2c3cbe2db6cc6f31" }, "Version": "1.17.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.17.0", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libxau6@1:1.0.11-1", "libxdmcp6@1:1.1.5-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb.so.1.1.0", "/usr/share/doc/libxcb1/changelog.Debian.amd64.gz", "/usr/share/doc/libxcb1/changelog.Debian.gz", "/usr/share/doc/libxcb1/changelog.gz", "/usr/share/doc/libxcb1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcursor1@1:1.2.3-1", "Name": "libxcursor1", "Identifier": { "PURL": "pkg:deb/debian/libxcursor1@1.2.3-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "eeec35f796418a01" }, "Version": "1.2.3", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxcursor", "SrcVersion": "1.2.3", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libx11-6@2:1.8.12-1", "libxfixes3@1:6.0.0-2+b4", "libxrender1@1:0.9.12-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2", "/usr/share/doc/libxcursor1/changelog.Debian.gz", "/usr/share/doc/libxcursor1/changelog.gz", "/usr/share/doc/libxcursor1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxdmcp6@1:1.1.5-1", "Name": "libxdmcp6", "Identifier": { "PURL": "pkg:deb/debian/libxdmcp6@1.1.5-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "c2eb4b4c749d0614" }, "Version": "1.1.5", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxdmcp", "SrcVersion": "1.1.5", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0", "/usr/share/doc/libxdmcp6/changelog.Debian.gz", "/usr/share/doc/libxdmcp6/changelog.gz", "/usr/share/doc/libxdmcp6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxext6@2:1.3.4-1+b3", "Name": "libxext6", "Identifier": { "PURL": "pkg:deb/debian/libxext6@1.3.4-1%2Bb3?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "6e49f35d579cde51" }, "Version": "1.3.4", "Release": "1+b3", "Epoch": 2, "Arch": "amd64", "SrcName": "libxext", "SrcVersion": "1.3.4", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libx11-6@2:1.8.12-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXext.so.6.4.0", "/usr/share/doc/libxext6/changelog.Debian.amd64.gz", "/usr/share/doc/libxext6/changelog.Debian.gz", "/usr/share/doc/libxext6/changelog.gz", "/usr/share/doc/libxext6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxfixes3@1:6.0.0-2+b4", "Name": "libxfixes3", "Identifier": { "PURL": "pkg:deb/debian/libxfixes3@6.0.0-2%2Bb4?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "21ad996cc1c7de56" }, "Version": "6.0.0", "Release": "2+b4", "Epoch": 1, "Arch": "amd64", "SrcName": "libxfixes", "SrcVersion": "6.0.0", "SrcRelease": "2", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libx11-6@2:1.8.12-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0", "/usr/share/doc/libxfixes3/changelog.Debian.amd64.gz", "/usr/share/doc/libxfixes3/changelog.Debian.gz", "/usr/share/doc/libxfixes3/changelog.gz", "/usr/share/doc/libxfixes3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxi6@2:1.8.2-1", "Name": "libxi6", "Identifier": { "PURL": "pkg:deb/debian/libxi6@1.8.2-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "f3f24dbe9be44454" }, "Version": "1.8.2", "Release": "1", "Epoch": 2, "Arch": "amd64", "SrcName": "libxi", "SrcVersion": "1.8.2", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libx11-6@2:1.8.12-1", "libxext6@2:1.3.4-1+b3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXi.so.6.1.0", "/usr/share/doc/libxi6/changelog.Debian.gz", "/usr/share/doc/libxi6/changelog.gz", "/usr/share/doc/libxi6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxkbcommon0@1.7.0-2", "Name": "libxkbcommon0", "Identifier": { "PURL": "pkg:deb/debian/libxkbcommon0@1.7.0-2?arch=amd64\u0026distro=debian-13.6", "UID": "f6530d0c7969789e" }, "Version": "1.7.0", "Release": "2", "Arch": "amd64", "SrcName": "libxkbcommon", "SrcVersion": "1.7.0", "SrcRelease": "2", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "xkb-data@2.42-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxkbcommon.so.0.0.0", "/usr/share/doc/libxkbcommon0/changelog.Debian.gz", "/usr/share/doc/libxkbcommon0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3", "Name": "libxml2", "Identifier": { "PURL": "pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "165365e2b028ae73" }, "Version": "2.12.7+dfsg+really2.9.14", "Release": "2.1+deb13u3", "Arch": "amd64", "SrcName": "libxml2", "SrcVersion": "2.12.7+dfsg+really2.9.14", "SrcRelease": "2.1+deb13u3", "Licenses": [ "MIT-1", "ISC" ], "Maintainer": "Debian XML/SGML Group \u003cdebian-xml-sgml-pkgs@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "liblzma5@5.8.1-1+deb13u1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxml2.so.2.9.14", "/usr/share/doc/libxml2/README.Debian", "/usr/share/doc/libxml2/README.md", "/usr/share/doc/libxml2/changelog.Debian.gz", "/usr/share/doc/libxml2/changelog.gz", "/usr/share/doc/libxml2/copyright", "/usr/share/lintian/overrides/libxml2" ], "AnalyzedBy": "dpkg" }, { "ID": "libxrandr2@2:1.5.4-1+b3", "Name": "libxrandr2", "Identifier": { "PURL": "pkg:deb/debian/libxrandr2@1.5.4-1%2Bb3?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "f41e8e15a475510e" }, "Version": "1.5.4", "Release": "1+b3", "Epoch": 2, "Arch": "amd64", "SrcName": "libxrandr", "SrcVersion": "1.5.4", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libx11-6@2:1.8.12-1", "libxext6@2:1.3.4-1+b3", "libxrender1@1:0.9.12-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXrandr.so.2.2.0", "/usr/share/doc/libxrandr2/changelog.Debian.amd64.gz", "/usr/share/doc/libxrandr2/changelog.Debian.gz", "/usr/share/doc/libxrandr2/changelog.gz", "/usr/share/doc/libxrandr2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxrender1@1:0.9.12-1", "Name": "libxrender1", "Identifier": { "PURL": "pkg:deb/debian/libxrender1@0.9.12-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "ff1f2940366224c0" }, "Version": "0.9.12", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxrender", "SrcVersion": "0.9.12", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libx11-6@2:1.8.12-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0", "/usr/share/doc/libxrender1/changelog.Debian.gz", "/usr/share/doc/libxrender1/changelog.gz", "/usr/share/doc/libxrender1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxshmfence1@1.3.3-1", "Name": "libxshmfence1", "Identifier": { "PURL": "pkg:deb/debian/libxshmfence1@1.3.3-1?arch=amd64\u0026distro=debian-13.6", "UID": "47cb7584fb0077bb" }, "Version": "1.3.3", "Release": "1", "Arch": "amd64", "SrcName": "libxshmfence", "SrcVersion": "1.3.3", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxshmfence.so.1.0.0", "/usr/share/doc/libxshmfence1/changelog.Debian.gz", "/usr/share/doc/libxshmfence1/changelog.gz", "/usr/share/doc/libxshmfence1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxss1@1:1.2.3-1+b3", "Name": "libxss1", "Identifier": { "PURL": "pkg:deb/debian/libxss1@1.2.3-1%2Bb3?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "35a0b86c67df49e1" }, "Version": "1.2.3", "Release": "1+b3", "Epoch": 1, "Arch": "amd64", "SrcName": "libxss", "SrcVersion": "1.2.3", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libx11-6@2:1.8.12-1", "libxext6@2:1.3.4-1+b3", "x11-common@1:7.7+24+deb13u1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXss.so.1.0.0", "/usr/share/doc/libxss1/changelog.Debian.amd64.gz", "/usr/share/doc/libxss1/changelog.Debian.gz", "/usr/share/doc/libxss1/changelog.gz", "/usr/share/doc/libxss1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxv1@2:1.0.11-1.1+b3", "Name": "libxv1", "Identifier": { "PURL": "pkg:deb/debian/libxv1@1.0.11-1.1%2Bb3?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "1bb0bb868a86790c" }, "Version": "1.0.11", "Release": "1.1+b3", "Epoch": 2, "Arch": "amd64", "SrcName": "libxv", "SrcVersion": "1.0.11", "SrcRelease": "1.1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libx11-6@2:1.8.12-1", "libxext6@2:1.3.4-1+b3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXv.so.1.0.0", "/usr/share/doc/libxv1/changelog.Debian.amd64.gz", "/usr/share/doc/libxv1/changelog.Debian.gz", "/usr/share/doc/libxv1/changelog.gz", "/usr/share/doc/libxv1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxvidcore4@2:1.3.7-1+b2", "Name": "libxvidcore4", "Identifier": { "PURL": "pkg:deb/debian/libxvidcore4@1.3.7-1%2Bb2?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "580ac2c2fc78454c" }, "Version": "1.3.7", "Release": "1+b2", "Epoch": 2, "Arch": "amd64", "SrcName": "xvidcore", "SrcVersion": "1.3.7", "SrcRelease": "1", "SrcEpoch": 2, "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxvidcore.so.4.3", "/usr/share/doc/libxvidcore4/changelog.Debian.amd64.gz", "/usr/share/doc/libxvidcore4/changelog.Debian.gz", "/usr/share/doc/libxvidcore4/changelog.gz", "/usr/share/doc/libxvidcore4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxxf86vm1@1:1.1.4-1+b4", "Name": "libxxf86vm1", "Identifier": { "PURL": "pkg:deb/debian/libxxf86vm1@1.1.4-1%2Bb4?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "26b2fc7f473c918" }, "Version": "1.1.4", "Release": "1+b4", "Epoch": 1, "Arch": "amd64", "SrcName": "libxxf86vm", "SrcVersion": "1.1.4", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libx11-6@2:1.8.12-1", "libxext6@2:1.3.4-1+b3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXxf86vm.so.1.0.0", "/usr/share/doc/libxxf86vm1/changelog.Debian.amd64.gz", "/usr/share/doc/libxxf86vm1/changelog.Debian.gz", "/usr/share/doc/libxxf86vm1/changelog.gz", "/usr/share/doc/libxxf86vm1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxxhash0@0.8.3-2", "Name": "libxxhash0", "Identifier": { "PURL": "pkg:deb/debian/libxxhash0@0.8.3-2?arch=amd64\u0026distro=debian-13.6", "UID": "d91110b5edcae2d8" }, "Version": "0.8.3", "Release": "2", "Arch": "amd64", "SrcName": "xxhash", "SrcVersion": "0.8.3", "SrcRelease": "2", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Josue Ortega \u003cjosue@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxxhash.so.0.8.3", "/usr/share/doc/libxxhash0/changelog.Debian.gz", "/usr/share/doc/libxxhash0/changelog.gz", "/usr/share/doc/libxxhash0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libz3-4@4.13.3-1", "Name": "libz3-4", "Identifier": { "PURL": "pkg:deb/debian/libz3-4@4.13.3-1?arch=amd64\u0026distro=debian-13.6", "UID": "87737ad7d72ca80a" }, "Version": "4.13.3", "Release": "1", "Arch": "amd64", "SrcName": "z3", "SrcVersion": "4.13.3", "SrcRelease": "1", "Licenses": [ "MIT", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "LLVM Packaging Team \u003cpkg-llvm-team@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libz3.so.4", "/usr/share/doc/libz3-4/changelog.Debian.gz", "/usr/share/doc/libz3-4/changelog.gz", "/usr/share/doc/libz3-4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzimg2@3.0.5+ds1-1+b2", "Name": "libzimg2", "Identifier": { "PURL": "pkg:deb/debian/libzimg2@3.0.5%2Bds1-1%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "1a0dfda951a264a1" }, "Version": "3.0.5+ds1", "Release": "1+b2", "Arch": "amd64", "SrcName": "zimg", "SrcVersion": "3.0.5+ds1", "SrcRelease": "1", "Licenses": [ "WTFPL-2", "GPL-3.0-with-autoconf-exception+", "GPL-3.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzimg.so.2.0.0", "/usr/share/doc/libzimg2/changelog.Debian.amd64.gz", "/usr/share/doc/libzimg2/changelog.Debian.gz", "/usr/share/doc/libzimg2/changelog.gz", "/usr/share/doc/libzimg2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzix-0-0@0.6.2-1", "Name": "libzix-0-0", "Identifier": { "PURL": "pkg:deb/debian/libzix-0-0@0.6.2-1?arch=amd64\u0026distro=debian-13.6", "UID": "a11c52c341bed501" }, "Version": "0.6.2", "Release": "1", "Arch": "amd64", "SrcName": "zix", "SrcVersion": "0.6.2", "SrcRelease": "1", "Licenses": [ "ISC", "0BSD" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzix-0.so.0.6.2", "/usr/share/doc/libzix-0-0/changelog.Debian.gz", "/usr/share/doc/libzix-0-0/changelog.gz", "/usr/share/doc/libzix-0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzmq5@4.3.5-1+b3", "Name": "libzmq5", "Identifier": { "PURL": "pkg:deb/debian/libzmq5@4.3.5-1%2Bb3?arch=amd64\u0026distro=debian-13.6", "UID": "81b11024107030af" }, "Version": "4.3.5", "Release": "1+b3", "Arch": "amd64", "SrcName": "zeromq3", "SrcVersion": "4.3.5", "SrcRelease": "1", "Licenses": [ "MPL-2.0", "MIT", "LGPL-2.0-or-later", "LGPL-2.0-only" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbsd0@0.12.2-2", "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libgssapi-krb5-2@1.21.3-5+deb13u1", "libnorm1t64@1.5.9+dfsg-3.1+b2", "libpgm-5.3-0t64@5.3.128~dfsg-2.1+b1", "libsodium23@1.0.18-1+deb13u1", "libstdc++6@14.2.0-19" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzmq.so.5.2.5", "/usr/share/doc/libzmq5/AUTHORS", "/usr/share/doc/libzmq5/NEWS.gz", "/usr/share/doc/libzmq5/changelog.Debian.amd64.gz", "/usr/share/doc/libzmq5/changelog.Debian.gz", "/usr/share/doc/libzmq5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzstd1@1.5.7+dfsg-1", "Name": "libzstd1", "Identifier": { "PURL": "pkg:deb/debian/libzstd1@1.5.7%2Bdfsg-1?arch=amd64\u0026distro=debian-13.6", "UID": "ca4814a2bfd07696" }, "Version": "1.5.7+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "libzstd", "SrcVersion": "1.5.7+dfsg", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "Zlib", "MIT" ], "Maintainer": "RPM packaging team \u003cteam+pkg-rpm@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzstd.so.1.5.7", "/usr/share/doc/libzstd1/changelog.Debian.gz", "/usr/share/doc/libzstd1/changelog.gz", "/usr/share/doc/libzstd1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzvbi-common@0.2.44-1", "Name": "libzvbi-common", "Identifier": { "PURL": "pkg:deb/debian/libzvbi-common@0.2.44-1?arch=all\u0026distro=debian-13.6", "UID": "917e87e40af6256d" }, "Version": "0.2.44", "Release": "1", "Arch": "all", "SrcName": "zvbi", "SrcVersion": "0.2.44", "SrcRelease": "1", "Licenses": [ "GPL-2.0-or-later", "BSD-2-Clause", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "GPL-2.0-only", "MIT", "BSD-3-Clause", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Ileana Dumitrescu \u003cileanadumitrescu95@gmail.com\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/doc/libzvbi-common/AUTHORS.gz", "/usr/share/doc/libzvbi-common/NEWS.gz", "/usr/share/doc/libzvbi-common/README.md.gz", "/usr/share/doc/libzvbi-common/TODO", "/usr/share/doc/libzvbi-common/changelog.Debian.gz", "/usr/share/doc/libzvbi-common/changelog.gz", "/usr/share/doc/libzvbi-common/copyright", "/usr/share/locale/de/LC_MESSAGES/zvbi.mo", "/usr/share/locale/en@boldquot/LC_MESSAGES/zvbi.mo", "/usr/share/locale/en@quot/LC_MESSAGES/zvbi.mo", "/usr/share/locale/es/LC_MESSAGES/zvbi.mo", "/usr/share/locale/fr/LC_MESSAGES/zvbi.mo", "/usr/share/locale/it/LC_MESSAGES/zvbi.mo", "/usr/share/locale/ka/LC_MESSAGES/zvbi.mo", "/usr/share/locale/nl/LC_MESSAGES/zvbi.mo", "/usr/share/locale/pl/LC_MESSAGES/zvbi.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libzvbi0t64@0.2.44-1", "Name": "libzvbi0t64", "Identifier": { "PURL": "pkg:deb/debian/libzvbi0t64@0.2.44-1?arch=amd64\u0026distro=debian-13.6", "UID": "6c3eaab30d9ff306" }, "Version": "0.2.44", "Release": "1", "Arch": "amd64", "SrcName": "zvbi", "SrcVersion": "0.2.44", "SrcRelease": "1", "Licenses": [ "GPL-2.0-or-later", "BSD-2-Clause", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "GPL-2.0-only", "MIT", "BSD-3-Clause", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Ileana Dumitrescu \u003cileanadumitrescu95@gmail.com\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libpng16-16t64@1.6.48-1+deb13u5", "libzvbi-common@0.2.44-1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzvbi-chains.so.0.0.0", "/usr/lib/x86_64-linux-gnu/libzvbi.so.0.13.2", "/usr/share/doc/libzvbi0t64/AUTHORS.gz", "/usr/share/doc/libzvbi0t64/NEWS.gz", "/usr/share/doc/libzvbi0t64/README.md.gz", "/usr/share/doc/libzvbi0t64/TODO", "/usr/share/doc/libzvbi0t64/changelog.Debian.gz", "/usr/share/doc/libzvbi0t64/changelog.gz", "/usr/share/doc/libzvbi0t64/copyright", "/usr/share/lintian/overrides/libzvbi0t64" ], "AnalyzedBy": "dpkg" }, { "ID": "login@1:4.16.0-2+really2.41.5-0+deb13u1", "Name": "login", "Identifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "10626ee86f1b653f" }, "Version": "4.16.0-2+really2.41.5", "Release": "0+deb13u1", "Epoch": 1, "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41.5", "SrcRelease": "0+deb13u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:4.0.2-2+b2", "libc6@2.41-12+deb13u3", "libcrypt1@1:4.4.38-1", "libpam-modules@1.7.0-5", "libpam-runtime@1.7.0-5", "libpam0g@1.7.0-5" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/login", "/usr/bin/newgrp", "/usr/sbin/nologin", "/usr/share/bash-completion/completions/newgrp", "/usr/share/doc/login/NEWS.Debian.gz", "/usr/share/doc/login/changelog.Debian.gz", "/usr/share/doc/login/changelog.gz", "/usr/share/doc/login/copyright", "/usr/share/lintian/overrides/login", "/usr/share/man/de/man1/login.1.gz", "/usr/share/man/de/man1/newgrp.1.gz", "/usr/share/man/de/man8/nologin.8.gz", "/usr/share/man/fr/man1/login.1.gz", "/usr/share/man/man1/login.1.gz", "/usr/share/man/man1/newgrp.1.gz", "/usr/share/man/man8/nologin.8.gz", "/usr/share/man/pl/man1/login.1.gz", "/usr/share/man/pl/man1/newgrp.1.gz", "/usr/share/man/pl/man8/nologin.8.gz", "/usr/share/man/ro/man1/login.1.gz", "/usr/share/man/ro/man1/newgrp.1.gz", "/usr/share/man/ro/man8/nologin.8.gz", "/usr/share/man/sr/man1/login.1.gz", "/usr/share/man/sr/man1/newgrp.1.gz", "/usr/share/man/sr/man8/nologin.8.gz", "/usr/share/man/uk/man1/login.1.gz", "/usr/share/man/uk/man1/newgrp.1.gz", "/usr/share/man/uk/man8/nologin.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "login.defs@1:4.17.4-2", "Name": "login.defs", "Identifier": { "PURL": "pkg:deb/debian/login.defs@4.17.4-2?arch=all\u0026distro=debian-13.6\u0026epoch=1", "UID": "b6a337588c67d5a3" }, "Version": "4.17.4", "Release": "2", "Epoch": 1, "Arch": "all", "SrcName": "shadow", "SrcVersion": "4.17.4", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-1.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/share/doc/login.defs/NEWS.Debian.gz", "/usr/share/doc/login.defs/changelog.Debian.gz", "/usr/share/doc/login.defs/changelog.gz", "/usr/share/doc/login.defs/copyright", "/usr/share/man/de/man5/login.defs.5.gz", "/usr/share/man/fr/man5/login.defs.5.gz", "/usr/share/man/it/man5/login.defs.5.gz", "/usr/share/man/ja/man5/login.defs.5.gz", "/usr/share/man/man5/login.defs.5.gz", "/usr/share/man/ru/man5/login.defs.5.gz", "/usr/share/man/uk/man5/login.defs.5.gz", "/usr/share/man/zh_CN/man5/login.defs.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "mawk@1.3.4.20250131-1", "Name": "mawk", "Identifier": { "PURL": "pkg:deb/debian/mawk@1.3.4.20250131-1?arch=amd64\u0026distro=debian-13.6", "UID": "a4460701c66e182d" }, "Version": "1.3.4.20250131", "Release": "1", "Arch": "amd64", "SrcName": "mawk", "SrcVersion": "1.3.4.20250131", "SrcRelease": "1", "Licenses": [ "GPL-2.0-only", "X11", "CC-BY-3.0" ], "Maintainer": "Boyuan Yang \u003cbyang@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/mawk", "/usr/share/doc/mawk/ACKNOWLEDGMENT", "/usr/share/doc/mawk/README", "/usr/share/doc/mawk/changelog.Debian.gz", "/usr/share/doc/mawk/changelog.gz", "/usr/share/doc/mawk/copyright", "/usr/share/doc/mawk/examples/ct_length.awk", "/usr/share/doc/mawk/examples/decl.awk", "/usr/share/doc/mawk/examples/deps.awk", "/usr/share/doc/mawk/examples/eatc.awk", "/usr/share/doc/mawk/examples/gdecl.awk", "/usr/share/doc/mawk/examples/hcal", "/usr/share/doc/mawk/examples/hical", "/usr/share/doc/mawk/examples/nocomment.awk", "/usr/share/doc/mawk/examples/primes.awk", "/usr/share/doc/mawk/examples/qsort.awk", "/usr/share/man/man1/mawk.1.gz", "/usr/share/man/man7/mawk-arrays.7.gz", "/usr/share/man/man7/mawk-code.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "mesa-libgallium@25.0.7-2+deb13u1", "Name": "mesa-libgallium", "Identifier": { "PURL": "pkg:deb/debian/mesa-libgallium@25.0.7-2%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "e99a9def45de3b4b" }, "Version": "25.0.7", "Release": "2+deb13u1", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "25.0.7", "SrcRelease": "2+deb13u1", "Licenses": [ "MIT", "GPL-2.0-only", "GPL-1.0-or-later", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libdrm-amdgpu1@2.4.124-2", "libdrm-intel1@2.4.124-2", "libdrm2@2.4.124-2", "libelf1t64@0.192-4", "libexpat1@2.8.3-1~deb13u1", "libgcc-s1@14.2.0-19", "libllvm19@1:19.1.7-3+b1", "libsensors5@1:3.6.2-2", "libstdc++6@14.2.0-19", "libx11-xcb1@2:1.8.12-1", "libxcb-dri3-0@1.17.0-2+b1", "libxcb-present0@1.17.0-2+b1", "libxcb-randr0@1.17.0-2+b1", "libxcb-sync1@1.17.0-2+b1", "libxcb-xfixes0@1.17.0-2+b1", "libxcb1@1.17.0-2+b1", "libxshmfence1@1.3.3-1", "libzstd1@1.5.7+dfsg-1", "zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgallium-25.0.7-2+deb13u1.so", "/usr/share/bug/mesa-libgallium/control", "/usr/share/bug/mesa-libgallium/script", "/usr/share/doc/mesa-libgallium/changelog.Debian.gz", "/usr/share/doc/mesa-libgallium/changelog.gz", "/usr/share/doc/mesa-libgallium/copyright", "/usr/share/lintian/overrides/mesa-libgallium" ], "AnalyzedBy": "dpkg" }, { "ID": "mount@2.41.5-0+deb13u1", "Name": "mount", "Identifier": { "PURL": "pkg:deb/debian/mount@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "d781ec5616a75c78" }, "Version": "2.41.5", "Release": "0+deb13u1", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41.5", "SrcRelease": "0+deb13u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/mount", "/usr/bin/umount", "/usr/sbin/losetup", "/usr/sbin/swapoff", "/usr/sbin/swapon", "/usr/share/bash-completion/completions/losetup", "/usr/share/bash-completion/completions/mount", "/usr/share/bash-completion/completions/swapoff", "/usr/share/bash-completion/completions/swapon", "/usr/share/bash-completion/completions/umount", "/usr/share/doc/mount/NEWS.Debian.gz", "/usr/share/doc/mount/changelog.Debian.gz", "/usr/share/doc/mount/changelog.gz", "/usr/share/doc/mount/copyright", "/usr/share/doc/mount/examples/filesystems", "/usr/share/doc/mount/examples/fstab", "/usr/share/doc/mount/examples/mount.fstab", "/usr/share/doc/mount/mount.txt", "/usr/share/lintian/overrides/mount", "/usr/share/man/man5/fstab.5.gz", "/usr/share/man/man8/losetup.8.gz", "/usr/share/man/man8/mount.8.gz", "/usr/share/man/man8/swapon.8.gz", "/usr/share/man/man8/umount.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ncurses-base@6.5+20250216-2", "Name": "ncurses-base", "Identifier": { "PURL": "pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all\u0026distro=debian-13.6", "UID": "767a0231348a5cb5" }, "Version": "6.5+20250216", "Release": "2", "Arch": "all", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/share/doc/ncurses-base/FAQ", "/usr/share/doc/ncurses-base/TODO.Debian", "/usr/share/doc/ncurses-base/changelog.Debian.gz", "/usr/share/doc/ncurses-base/changelog.gz", "/usr/share/doc/ncurses-base/copyright", "/usr/share/lintian/overrides/ncurses-base", "/usr/share/tabset/std", "/usr/share/tabset/stdcrt", "/usr/share/tabset/vt100", "/usr/share/tabset/vt300", "/usr/share/terminfo/E/Eterm", "/usr/share/terminfo/a/ansi", "/usr/share/terminfo/c/cons25", "/usr/share/terminfo/c/cygwin", "/usr/share/terminfo/d/dumb", "/usr/share/terminfo/h/hurd", "/usr/share/terminfo/l/linux", "/usr/share/terminfo/m/mach", "/usr/share/terminfo/m/mach-bold", "/usr/share/terminfo/m/mach-color", "/usr/share/terminfo/m/mach-gnu", "/usr/share/terminfo/m/mach-gnu-color", "/usr/share/terminfo/p/pcansi", "/usr/share/terminfo/r/rxvt", "/usr/share/terminfo/r/rxvt-basic", "/usr/share/terminfo/r/rxvt-unicode", "/usr/share/terminfo/r/rxvt-unicode-256color", "/usr/share/terminfo/s/screen", "/usr/share/terminfo/s/screen-256color", "/usr/share/terminfo/s/screen-256color-bce", "/usr/share/terminfo/s/screen-bce", "/usr/share/terminfo/s/screen-s", "/usr/share/terminfo/s/screen-w", "/usr/share/terminfo/s/screen.xterm-256color", "/usr/share/terminfo/s/sun", "/usr/share/terminfo/t/tmux", "/usr/share/terminfo/t/tmux-256color", "/usr/share/terminfo/v/vt100", "/usr/share/terminfo/v/vt102", "/usr/share/terminfo/v/vt220", "/usr/share/terminfo/v/vt52", "/usr/share/terminfo/w/wsvt25", "/usr/share/terminfo/w/wsvt25m", "/usr/share/terminfo/x/xterm", "/usr/share/terminfo/x/xterm-256color", "/usr/share/terminfo/x/xterm-color", "/usr/share/terminfo/x/xterm-mono", "/usr/share/terminfo/x/xterm-r5", "/usr/share/terminfo/x/xterm-r6", "/usr/share/terminfo/x/xterm-vt220", "/usr/share/terminfo/x/xterm-xfree86" ], "AnalyzedBy": "dpkg" }, { "ID": "ncurses-bin@6.5+20250216-2", "Name": "ncurses-bin", "Identifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.6", "UID": "5b541563cf6587e5" }, "Version": "6.5+20250216", "Release": "2", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.5+20250216", "SrcRelease": "2", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Ncurses Maintainers \u003cncurses@packages.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/clear", "/usr/bin/infocmp", "/usr/bin/tabs", "/usr/bin/tic", "/usr/bin/toe", "/usr/bin/tput", "/usr/bin/tset", "/usr/share/doc/ncurses-bin/changelog.Debian.gz", "/usr/share/doc/ncurses-bin/changelog.gz", "/usr/share/doc/ncurses-bin/copyright", "/usr/share/man/man1/captoinfo.1.gz", "/usr/share/man/man1/clear.1.gz", "/usr/share/man/man1/infocmp.1.gz", "/usr/share/man/man1/infotocap.1.gz", "/usr/share/man/man1/tabs.1.gz", "/usr/share/man/man1/tic.1.gz", "/usr/share/man/man1/toe.1.gz", "/usr/share/man/man1/tput.1.gz", "/usr/share/man/man1/tset.1.gz", "/usr/share/man/man5/scr_dump.5.gz", "/usr/share/man/man5/term.5.gz", "/usr/share/man/man5/terminfo.5.gz", "/usr/share/man/man5/user_caps.5.gz", "/usr/share/man/man7/term.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "netbase@6.5", "Name": "netbase", "Identifier": { "PURL": "pkg:deb/debian/netbase@6.5?arch=all\u0026distro=debian-13.6", "UID": "9929ff265179fc61" }, "Version": "6.5", "Arch": "all", "SrcName": "netbase", "SrcVersion": "6.5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:4d43b7f98e4c38fd2d37f37f1bf9965d2c4018b01453d3b29d924653c3275f4b" }, "InstalledFiles": [ "/usr/share/doc/netbase/changelog.gz", "/usr/share/doc/netbase/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "ocl-icd-libopencl1@2.3.3-1", "Name": "ocl-icd-libopencl1", "Identifier": { "PURL": "pkg:deb/debian/ocl-icd-libopencl1@2.3.3-1?arch=amd64\u0026distro=debian-13.6", "UID": "c6ba40f1559217d8" }, "Version": "2.3.3", "Release": "1", "Arch": "amd64", "SrcName": "ocl-icd", "SrcVersion": "2.3.3", "SrcRelease": "1", "Licenses": [ "BSD-2-Clause", "Apache-2.0" ], "Maintainer": "Debian OpenCL Maintainers \u003cpkg-opencl-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libOpenCL.so.1.0.0", "/usr/share/doc-base/ocl-icd-libopencl1.ocl-icd-libopencl1", "/usr/share/doc/ocl-icd-libopencl1/README", "/usr/share/doc/ocl-icd-libopencl1/README.Debian.gz", "/usr/share/doc/ocl-icd-libopencl1/changelog.Debian.gz", "/usr/share/doc/ocl-icd-libopencl1/changelog.gz", "/usr/share/doc/ocl-icd-libopencl1/copyright", "/usr/share/doc/ocl-icd-libopencl1/html/libOpenCL.html", "/usr/share/lintian/overrides/ocl-icd-libopencl1", "/usr/share/man/man7/libOpenCL.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "openssl@3.5.7-1~deb13u2", "Name": "openssl", "Identifier": { "PURL": "pkg:deb/debian/openssl@3.5.7-1~deb13u2?arch=amd64\u0026distro=debian-13.6", "UID": "4917554de562b1f6" }, "Version": "3.5.7", "Release": "1~deb13u2", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.5.7", "SrcRelease": "1~deb13u2", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libssl3t64@3.5.7-1~deb13u2" ], "Layer": { "DiffID": "sha256:4d43b7f98e4c38fd2d37f37f1bf9965d2c4018b01453d3b29d924653c3275f4b" }, "InstalledFiles": [ "/usr/bin/c_rehash", "/usr/bin/openssl", "/usr/lib/ssl/misc/CA.pl", "/usr/lib/ssl/misc/tsget.pl", "/usr/share/doc/openssl/HOWTO/certificates.txt.gz", "/usr/share/doc/openssl/HOWTO/documenting-functions-and-macros.md.gz", "/usr/share/doc/openssl/HOWTO/keys.txt.gz", "/usr/share/doc/openssl/NEWS.md.gz", "/usr/share/doc/openssl/README-ENGINES.md.gz", "/usr/share/doc/openssl/README-PROVIDERS.md.gz", "/usr/share/doc/openssl/README-QUIC.md.gz", "/usr/share/doc/openssl/README.Debian", "/usr/share/doc/openssl/README.md.gz", "/usr/share/doc/openssl/changelog.Debian.gz", "/usr/share/doc/openssl/changelog.gz", "/usr/share/doc/openssl/copyright", "/usr/share/doc/openssl/fingerprints.txt", "/usr/share/lintian/overrides/openssl", "/usr/share/man/man1/CA.pl.1ssl.gz", "/usr/share/man/man1/openssl-asn1parse.1ssl.gz", "/usr/share/man/man1/openssl-ca.1ssl.gz", "/usr/share/man/man1/openssl-ciphers.1ssl.gz", "/usr/share/man/man1/openssl-cmds.1ssl.gz", "/usr/share/man/man1/openssl-cmp.1ssl.gz", "/usr/share/man/man1/openssl-cms.1ssl.gz", "/usr/share/man/man1/openssl-crl.1ssl.gz", "/usr/share/man/man1/openssl-crl2pkcs7.1ssl.gz", "/usr/share/man/man1/openssl-dgst.1ssl.gz", "/usr/share/man/man1/openssl-dhparam.1ssl.gz", "/usr/share/man/man1/openssl-dsa.1ssl.gz", "/usr/share/man/man1/openssl-dsaparam.1ssl.gz", "/usr/share/man/man1/openssl-ec.1ssl.gz", "/usr/share/man/man1/openssl-ecparam.1ssl.gz", "/usr/share/man/man1/openssl-enc.1ssl.gz", "/usr/share/man/man1/openssl-engine.1ssl.gz", "/usr/share/man/man1/openssl-errstr.1ssl.gz", "/usr/share/man/man1/openssl-fipsinstall.1ssl.gz", "/usr/share/man/man1/openssl-format-options.1ssl.gz", "/usr/share/man/man1/openssl-gendsa.1ssl.gz", "/usr/share/man/man1/openssl-genpkey.1ssl.gz", "/usr/share/man/man1/openssl-genrsa.1ssl.gz", "/usr/share/man/man1/openssl-info.1ssl.gz", "/usr/share/man/man1/openssl-kdf.1ssl.gz", "/usr/share/man/man1/openssl-list.1ssl.gz", "/usr/share/man/man1/openssl-mac.1ssl.gz", "/usr/share/man/man1/openssl-namedisplay-options.1ssl.gz", "/usr/share/man/man1/openssl-nseq.1ssl.gz", "/usr/share/man/man1/openssl-ocsp.1ssl.gz", "/usr/share/man/man1/openssl-passphrase-options.1ssl.gz", "/usr/share/man/man1/openssl-passwd.1ssl.gz", "/usr/share/man/man1/openssl-pkcs12.1ssl.gz", "/usr/share/man/man1/openssl-pkcs7.1ssl.gz", "/usr/share/man/man1/openssl-pkcs8.1ssl.gz", "/usr/share/man/man1/openssl-pkey.1ssl.gz", "/usr/share/man/man1/openssl-pkeyparam.1ssl.gz", "/usr/share/man/man1/openssl-pkeyutl.1ssl.gz", "/usr/share/man/man1/openssl-prime.1ssl.gz", "/usr/share/man/man1/openssl-rand.1ssl.gz", "/usr/share/man/man1/openssl-rehash.1ssl.gz", "/usr/share/man/man1/openssl-req.1ssl.gz", "/usr/share/man/man1/openssl-rsa.1ssl.gz", "/usr/share/man/man1/openssl-rsautl.1ssl.gz", "/usr/share/man/man1/openssl-s_client.1ssl.gz", "/usr/share/man/man1/openssl-s_server.1ssl.gz", "/usr/share/man/man1/openssl-s_time.1ssl.gz", "/usr/share/man/man1/openssl-sess_id.1ssl.gz", "/usr/share/man/man1/openssl-skeyutl.1ssl.gz", "/usr/share/man/man1/openssl-smime.1ssl.gz", "/usr/share/man/man1/openssl-speed.1ssl.gz", "/usr/share/man/man1/openssl-spkac.1ssl.gz", "/usr/share/man/man1/openssl-srp.1ssl.gz", "/usr/share/man/man1/openssl-storeutl.1ssl.gz", "/usr/share/man/man1/openssl-ts.1ssl.gz", "/usr/share/man/man1/openssl-verification-options.1ssl.gz", "/usr/share/man/man1/openssl-verify.1ssl.gz", "/usr/share/man/man1/openssl-version.1ssl.gz", "/usr/share/man/man1/openssl-x509.1ssl.gz", "/usr/share/man/man1/openssl.1ssl.gz", "/usr/share/man/man1/tsget.1ssl.gz", "/usr/share/man/man5/config.5ssl.gz", "/usr/share/man/man5/fips_config.5ssl.gz", "/usr/share/man/man5/x509v3_config.5ssl.gz", "/usr/share/man/man7/EVP_ASYM_CIPHER-RSA.7ssl.gz", "/usr/share/man/man7/EVP_ASYM_CIPHER-SM2.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-AES.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-ARIA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-BLOWFISH.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CAMELLIA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CAST.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CHACHA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-DES.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-IDEA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-NULL.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC2.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC4.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC5.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-SEED.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-SM4.7ssl.gz", "/usr/share/man/man7/EVP_KDF-ARGON2.7ssl.gz", "/usr/share/man/man7/EVP_KDF-HKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-HMAC-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_KDF-KB.7ssl.gz", "/usr/share/man/man7/EVP_KDF-KRB5KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PBKDF1.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PBKDF2.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PKCS12KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PVKKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SCRYPT.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SS.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SSHKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-TLS13_KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-TLS1_PRF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X942-ASN1.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X942-CONCAT.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X963.7ssl.gz", "/usr/share/man/man7/EVP_KEM-EC.7ssl.gz", "/usr/share/man/man7/EVP_KEM-ML-KEM.7ssl.gz", "/usr/share/man/man7/EVP_KEM-RSA.7ssl.gz", "/usr/share/man/man7/EVP_KEM-X25519.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-DH.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-ECDH.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-X25519.7ssl.gz", "/usr/share/man/man7/EVP_MAC-BLAKE2.7ssl.gz", "/usr/share/man/man7/EVP_MAC-CMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-GMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-KMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-Poly1305.7ssl.gz", "/usr/share/man/man7/EVP_MAC-Siphash.7ssl.gz", "/usr/share/man/man7/EVP_MD-BLAKE2.7ssl.gz", "/usr/share/man/man7/EVP_MD-KECCAK.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD2.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD4.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD5-SHA1.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD5.7ssl.gz", "/usr/share/man/man7/EVP_MD-MDC2.7ssl.gz", "/usr/share/man/man7/EVP_MD-NULL.7ssl.gz", "/usr/share/man/man7/EVP_MD-RIPEMD160.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA1.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA2.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA3.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHAKE.7ssl.gz", "/usr/share/man/man7/EVP_MD-SM3.7ssl.gz", "/usr/share/man/man7/EVP_MD-WHIRLPOOL.7ssl.gz", "/usr/share/man/man7/EVP_MD-common.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-DH.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-EC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-FFC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-ML-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-ML-KEM.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-RSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-SLH-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-SM2.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-X25519.7ssl.gz", "/usr/share/man/man7/EVP_RAND-CRNG-TEST.7ssl.gz", "/usr/share/man/man7/EVP_RAND-CTR-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-HASH-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-HMAC-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-JITTER.7ssl.gz", "/usr/share/man/man7/EVP_RAND-SEED-SRC.7ssl.gz", "/usr/share/man/man7/EVP_RAND-TEST-RAND.7ssl.gz", "/usr/share/man/man7/EVP_RAND.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-DSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ECDSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ED25519.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ML-DSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-RSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-SLH-DSA.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-FIPS.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-base.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-default.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-legacy.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-null.7ssl.gz", "/usr/share/man/man7/OSSL_STORE-winstore.7ssl.gz", "/usr/share/man/man7/RAND.7ssl.gz", "/usr/share/man/man7/RSA-PSS.7ssl.gz", "/usr/share/man/man7/X25519.7ssl.gz", "/usr/share/man/man7/bio.7ssl.gz", "/usr/share/man/man7/ct.7ssl.gz", "/usr/share/man/man7/des_modes.7ssl.gz", "/usr/share/man/man7/evp.7ssl.gz", "/usr/share/man/man7/fips_module.7ssl.gz", "/usr/share/man/man7/life_cycle-cipher.7ssl.gz", "/usr/share/man/man7/life_cycle-digest.7ssl.gz", "/usr/share/man/man7/life_cycle-kdf.7ssl.gz", "/usr/share/man/man7/life_cycle-mac.7ssl.gz", "/usr/share/man/man7/life_cycle-pkey.7ssl.gz", "/usr/share/man/man7/life_cycle-rand.7ssl.gz", "/usr/share/man/man7/openssl-core.h.7ssl.gz", "/usr/share/man/man7/openssl-core_dispatch.h.7ssl.gz", "/usr/share/man/man7/openssl-core_names.h.7ssl.gz", "/usr/share/man/man7/openssl-env.7ssl.gz", "/usr/share/man/man7/openssl-glossary.7ssl.gz", "/usr/share/man/man7/openssl-qlog.7ssl.gz", "/usr/share/man/man7/openssl-quic-concurrency.7ssl.gz", "/usr/share/man/man7/openssl-quic.7ssl.gz", "/usr/share/man/man7/openssl-threads.7ssl.gz", "/usr/share/man/man7/openssl_user_macros.7ssl.gz", "/usr/share/man/man7/ossl-guide-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-libcrypto-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-libraries-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-libssl-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-migration.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-client-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-client-non-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-multi-stream.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-server-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-quic-server-non-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-client-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-client-non-block.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-introduction.7ssl.gz", "/usr/share/man/man7/ossl-guide-tls-server-block.7ssl.gz", "/usr/share/man/man7/ossl_store-file.7ssl.gz", "/usr/share/man/man7/ossl_store.7ssl.gz", "/usr/share/man/man7/passphrase-encoding.7ssl.gz", "/usr/share/man/man7/property.7ssl.gz", "/usr/share/man/man7/provider-asym_cipher.7ssl.gz", "/usr/share/man/man7/provider-base.7ssl.gz", "/usr/share/man/man7/provider-cipher.7ssl.gz", "/usr/share/man/man7/provider-decoder.7ssl.gz", "/usr/share/man/man7/provider-digest.7ssl.gz", "/usr/share/man/man7/provider-encoder.7ssl.gz", "/usr/share/man/man7/provider-kdf.7ssl.gz", "/usr/share/man/man7/provider-kem.7ssl.gz", "/usr/share/man/man7/provider-keyexch.7ssl.gz", "/usr/share/man/man7/provider-keymgmt.7ssl.gz", "/usr/share/man/man7/provider-mac.7ssl.gz", "/usr/share/man/man7/provider-object.7ssl.gz", "/usr/share/man/man7/provider-rand.7ssl.gz", "/usr/share/man/man7/provider-signature.7ssl.gz", "/usr/share/man/man7/provider-skeymgmt.7ssl.gz", "/usr/share/man/man7/provider-storemgmt.7ssl.gz", "/usr/share/man/man7/provider.7ssl.gz", "/usr/share/man/man7/proxy-certificates.7ssl.gz", "/usr/share/man/man7/x509.7ssl.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "openssl-provider-legacy@3.5.7-1~deb13u2", "Name": "openssl-provider-legacy", "Identifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.7-1~deb13u2?arch=amd64\u0026distro=debian-13.6", "UID": "9d3dbcbe1f7438f6" }, "Version": "3.5.7", "Release": "1~deb13u2", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.5.7", "SrcRelease": "1~deb13u2", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libssl3t64@3.5.7-1~deb13u2" ], "Layer": { "DiffID": "sha256:4d43b7f98e4c38fd2d37f37f1bf9965d2c4018b01453d3b29d924653c3275f4b" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so", "/usr/share/doc/openssl-provider-legacy/changelog.Debian.gz", "/usr/share/doc/openssl-provider-legacy/changelog.gz", "/usr/share/doc/openssl-provider-legacy/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "passwd@1:4.17.4-2", "Name": "passwd", "Identifier": { "PURL": "pkg:deb/debian/passwd@4.17.4-2?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "d93f813ae3092e32" }, "Version": "4.17.4", "Release": "2", "Epoch": 1, "Arch": "amd64", "SrcName": "shadow", "SrcVersion": "4.17.4", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-1.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "base-passwd@3.6.7", "libacl1@2.3.2-2+b1", "libattr1@1:2.5.2-3", "libaudit1@1:4.0.2-2+b2", "libbsd0@0.12.2-2", "libc6@2.41-12+deb13u3", "libcrypt1@1:4.4.38-1", "libpam-modules@1.7.0-5", "libpam0g@1.7.0-5", "libselinux1@3.8.1-1", "libsemanage2@3.8.1-1", "login.defs@1:4.17.4-2" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/chage", "/usr/bin/chfn", "/usr/bin/chsh", "/usr/bin/expiry", "/usr/bin/gpasswd", "/usr/bin/passwd", "/usr/lib/tmpfiles.d/passwd.conf", "/usr/sbin/chgpasswd", "/usr/sbin/chpasswd", "/usr/sbin/groupadd", "/usr/sbin/groupdel", "/usr/sbin/groupmod", "/usr/sbin/grpck", "/usr/sbin/grpconv", "/usr/sbin/grpunconv", "/usr/sbin/newusers", "/usr/sbin/pwck", "/usr/sbin/pwconv", "/usr/sbin/pwunconv", "/usr/sbin/shadowconfig", "/usr/sbin/useradd", "/usr/sbin/userdel", "/usr/sbin/usermod", "/usr/sbin/vipw", "/usr/share/doc/passwd/NEWS.Debian.gz", "/usr/share/doc/passwd/README.Debian", "/usr/share/doc/passwd/TODO.Debian", "/usr/share/doc/passwd/changelog.Debian.gz", "/usr/share/doc/passwd/changelog.gz", "/usr/share/doc/passwd/copyright", "/usr/share/doc/passwd/examples/passwd.expire.cron", "/usr/share/lintian/overrides/passwd", "/usr/share/locale/bs/LC_MESSAGES/shadow.mo", "/usr/share/locale/ca/LC_MESSAGES/shadow.mo", "/usr/share/locale/cs/LC_MESSAGES/shadow.mo", "/usr/share/locale/da/LC_MESSAGES/shadow.mo", "/usr/share/locale/de/LC_MESSAGES/shadow.mo", "/usr/share/locale/dz/LC_MESSAGES/shadow.mo", "/usr/share/locale/el/LC_MESSAGES/shadow.mo", "/usr/share/locale/es/LC_MESSAGES/shadow.mo", "/usr/share/locale/eu/LC_MESSAGES/shadow.mo", "/usr/share/locale/fi/LC_MESSAGES/shadow.mo", "/usr/share/locale/fr/LC_MESSAGES/shadow.mo", "/usr/share/locale/gl/LC_MESSAGES/shadow.mo", "/usr/share/locale/he/LC_MESSAGES/shadow.mo", "/usr/share/locale/hu/LC_MESSAGES/shadow.mo", "/usr/share/locale/id/LC_MESSAGES/shadow.mo", "/usr/share/locale/it/LC_MESSAGES/shadow.mo", "/usr/share/locale/ja/LC_MESSAGES/shadow.mo", "/usr/share/locale/ka/LC_MESSAGES/shadow.mo", "/usr/share/locale/kk/LC_MESSAGES/shadow.mo", "/usr/share/locale/km/LC_MESSAGES/shadow.mo", "/usr/share/locale/ko/LC_MESSAGES/shadow.mo", "/usr/share/locale/nb/LC_MESSAGES/shadow.mo", "/usr/share/locale/ne/LC_MESSAGES/shadow.mo", "/usr/share/locale/nl/LC_MESSAGES/shadow.mo", "/usr/share/locale/nn/LC_MESSAGES/shadow.mo", "/usr/share/locale/pl/LC_MESSAGES/shadow.mo", "/usr/share/locale/pt/LC_MESSAGES/shadow.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/shadow.mo", "/usr/share/locale/ro/LC_MESSAGES/shadow.mo", "/usr/share/locale/ru/LC_MESSAGES/shadow.mo", "/usr/share/locale/sk/LC_MESSAGES/shadow.mo", "/usr/share/locale/sq/LC_MESSAGES/shadow.mo", "/usr/share/locale/sv/LC_MESSAGES/shadow.mo", "/usr/share/locale/tl/LC_MESSAGES/shadow.mo", "/usr/share/locale/tr/LC_MESSAGES/shadow.mo", "/usr/share/locale/uk/LC_MESSAGES/shadow.mo", "/usr/share/locale/vi/LC_MESSAGES/shadow.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/shadow.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/shadow.mo", "/usr/share/man/cs/man1/expiry.1.gz", "/usr/share/man/cs/man1/gpasswd.1.gz", "/usr/share/man/cs/man5/gshadow.5.gz", "/usr/share/man/cs/man5/passwd.5.gz", "/usr/share/man/cs/man5/shadow.5.gz", "/usr/share/man/cs/man8/groupadd.8.gz", "/usr/share/man/cs/man8/groupdel.8.gz", "/usr/share/man/cs/man8/groupmod.8.gz", "/usr/share/man/cs/man8/grpck.8.gz", "/usr/share/man/cs/man8/vipw.8.gz", "/usr/share/man/da/man1/chfn.1.gz", "/usr/share/man/da/man5/gshadow.5.gz", "/usr/share/man/da/man8/groupdel.8.gz", "/usr/share/man/da/man8/vipw.8.gz", "/usr/share/man/de/man1/chage.1.gz", "/usr/share/man/de/man1/chfn.1.gz", "/usr/share/man/de/man1/chsh.1.gz", "/usr/share/man/de/man1/expiry.1.gz", "/usr/share/man/de/man1/gpasswd.1.gz", "/usr/share/man/de/man1/passwd.1.gz", "/usr/share/man/de/man5/gshadow.5.gz", "/usr/share/man/de/man5/passwd.5.gz", "/usr/share/man/de/man5/shadow.5.gz", "/usr/share/man/de/man8/chgpasswd.8.gz", "/usr/share/man/de/man8/chpasswd.8.gz", "/usr/share/man/de/man8/groupadd.8.gz", "/usr/share/man/de/man8/groupdel.8.gz", "/usr/share/man/de/man8/groupmod.8.gz", "/usr/share/man/de/man8/grpck.8.gz", "/usr/share/man/de/man8/newusers.8.gz", "/usr/share/man/de/man8/pwck.8.gz", "/usr/share/man/de/man8/pwconv.8.gz", "/usr/share/man/de/man8/useradd.8.gz", "/usr/share/man/de/man8/userdel.8.gz", "/usr/share/man/de/man8/usermod.8.gz", "/usr/share/man/de/man8/vipw.8.gz", "/usr/share/man/fi/man1/chfn.1.gz", "/usr/share/man/fi/man1/chsh.1.gz", "/usr/share/man/fr/man1/chage.1.gz", "/usr/share/man/fr/man1/chfn.1.gz", "/usr/share/man/fr/man1/chsh.1.gz", "/usr/share/man/fr/man1/expiry.1.gz", "/usr/share/man/fr/man1/gpasswd.1.gz", "/usr/share/man/fr/man1/passwd.1.gz", "/usr/share/man/fr/man5/gshadow.5.gz", "/usr/share/man/fr/man5/passwd.5.gz", "/usr/share/man/fr/man5/shadow.5.gz", "/usr/share/man/fr/man5/subgid.5.gz", "/usr/share/man/fr/man5/subuid.5.gz", "/usr/share/man/fr/man8/chgpasswd.8.gz", "/usr/share/man/fr/man8/chpasswd.8.gz", "/usr/share/man/fr/man8/groupadd.8.gz", "/usr/share/man/fr/man8/groupdel.8.gz", "/usr/share/man/fr/man8/groupmod.8.gz", "/usr/share/man/fr/man8/grpck.8.gz", "/usr/share/man/fr/man8/newusers.8.gz", "/usr/share/man/fr/man8/pwck.8.gz", "/usr/share/man/fr/man8/pwconv.8.gz", "/usr/share/man/fr/man8/useradd.8.gz", "/usr/share/man/fr/man8/userdel.8.gz", "/usr/share/man/fr/man8/usermod.8.gz", "/usr/share/man/fr/man8/vipw.8.gz", "/usr/share/man/hu/man1/chsh.1.gz", "/usr/share/man/hu/man1/gpasswd.1.gz", "/usr/share/man/hu/man1/passwd.1.gz", "/usr/share/man/hu/man5/passwd.5.gz", "/usr/share/man/id/man1/chsh.1.gz", "/usr/share/man/id/man8/useradd.8.gz", "/usr/share/man/it/man1/chage.1.gz", "/usr/share/man/it/man1/chfn.1.gz", "/usr/share/man/it/man1/chsh.1.gz", "/usr/share/man/it/man1/expiry.1.gz", "/usr/share/man/it/man1/gpasswd.1.gz", "/usr/share/man/it/man1/passwd.1.gz", "/usr/share/man/it/man5/gshadow.5.gz", "/usr/share/man/it/man5/passwd.5.gz", "/usr/share/man/it/man5/shadow.5.gz", "/usr/share/man/it/man8/chgpasswd.8.gz", "/usr/share/man/it/man8/chpasswd.8.gz", "/usr/share/man/it/man8/groupadd.8.gz", "/usr/share/man/it/man8/groupdel.8.gz", "/usr/share/man/it/man8/groupmod.8.gz", "/usr/share/man/it/man8/grpck.8.gz", "/usr/share/man/it/man8/newusers.8.gz", "/usr/share/man/it/man8/pwck.8.gz", "/usr/share/man/it/man8/pwconv.8.gz", "/usr/share/man/it/man8/useradd.8.gz", "/usr/share/man/it/man8/userdel.8.gz", "/usr/share/man/it/man8/usermod.8.gz", "/usr/share/man/it/man8/vipw.8.gz", "/usr/share/man/ja/man1/chage.1.gz", "/usr/share/man/ja/man1/chfn.1.gz", "/usr/share/man/ja/man1/chsh.1.gz", "/usr/share/man/ja/man1/expiry.1.gz", "/usr/share/man/ja/man1/gpasswd.1.gz", "/usr/share/man/ja/man1/passwd.1.gz", "/usr/share/man/ja/man5/passwd.5.gz", "/usr/share/man/ja/man5/shadow.5.gz", "/usr/share/man/ja/man8/chpasswd.8.gz", "/usr/share/man/ja/man8/groupadd.8.gz", "/usr/share/man/ja/man8/groupdel.8.gz", "/usr/share/man/ja/man8/groupmod.8.gz", "/usr/share/man/ja/man8/grpck.8.gz", "/usr/share/man/ja/man8/newusers.8.gz", "/usr/share/man/ja/man8/pwck.8.gz", "/usr/share/man/ja/man8/pwconv.8.gz", "/usr/share/man/ja/man8/useradd.8.gz", "/usr/share/man/ja/man8/userdel.8.gz", "/usr/share/man/ja/man8/usermod.8.gz", "/usr/share/man/ja/man8/vipw.8.gz", "/usr/share/man/ko/man1/chfn.1.gz", "/usr/share/man/ko/man1/chsh.1.gz", "/usr/share/man/ko/man5/passwd.5.gz", "/usr/share/man/ko/man8/vipw.8.gz", "/usr/share/man/man1/chage.1.gz", "/usr/share/man/man1/chfn.1.gz", "/usr/share/man/man1/chsh.1.gz", "/usr/share/man/man1/expiry.1.gz", "/usr/share/man/man1/gpasswd.1.gz", "/usr/share/man/man1/passwd.1.gz", "/usr/share/man/man5/gshadow.5.gz", "/usr/share/man/man5/passwd.5.gz", "/usr/share/man/man5/shadow.5.gz", "/usr/share/man/man5/subgid.5.gz", "/usr/share/man/man5/subuid.5.gz", "/usr/share/man/man8/chgpasswd.8.gz", "/usr/share/man/man8/chpasswd.8.gz", "/usr/share/man/man8/groupadd.8.gz", "/usr/share/man/man8/groupdel.8.gz", "/usr/share/man/man8/groupmod.8.gz", "/usr/share/man/man8/grpck.8.gz", "/usr/share/man/man8/newusers.8.gz", "/usr/share/man/man8/pwck.8.gz", "/usr/share/man/man8/pwconv.8.gz", "/usr/share/man/man8/shadowconfig.8.gz", "/usr/share/man/man8/useradd.8.gz", "/usr/share/man/man8/userdel.8.gz", "/usr/share/man/man8/usermod.8.gz", "/usr/share/man/man8/vipw.8.gz", "/usr/share/man/pl/man1/chage.1.gz", "/usr/share/man/pl/man1/chsh.1.gz", "/usr/share/man/pl/man1/expiry.1.gz", "/usr/share/man/pl/man8/groupadd.8.gz", "/usr/share/man/pl/man8/groupdel.8.gz", "/usr/share/man/pl/man8/groupmod.8.gz", "/usr/share/man/pl/man8/grpck.8.gz", "/usr/share/man/pl/man8/userdel.8.gz", "/usr/share/man/pl/man8/usermod.8.gz", "/usr/share/man/pl/man8/vipw.8.gz", "/usr/share/man/pt_BR/man1/gpasswd.1.gz", "/usr/share/man/pt_BR/man5/passwd.5.gz", "/usr/share/man/pt_BR/man5/shadow.5.gz", "/usr/share/man/pt_BR/man8/groupadd.8.gz", "/usr/share/man/pt_BR/man8/groupdel.8.gz", "/usr/share/man/pt_BR/man8/groupmod.8.gz", "/usr/share/man/ru/man1/chage.1.gz", "/usr/share/man/ru/man1/chfn.1.gz", "/usr/share/man/ru/man1/chsh.1.gz", "/usr/share/man/ru/man1/expiry.1.gz", "/usr/share/man/ru/man1/gpasswd.1.gz", "/usr/share/man/ru/man1/passwd.1.gz", "/usr/share/man/ru/man5/gshadow.5.gz", "/usr/share/man/ru/man5/passwd.5.gz", "/usr/share/man/ru/man5/shadow.5.gz", "/usr/share/man/ru/man8/chgpasswd.8.gz", "/usr/share/man/ru/man8/chpasswd.8.gz", "/usr/share/man/ru/man8/groupadd.8.gz", "/usr/share/man/ru/man8/groupdel.8.gz", "/usr/share/man/ru/man8/groupmod.8.gz", "/usr/share/man/ru/man8/grpck.8.gz", "/usr/share/man/ru/man8/newusers.8.gz", "/usr/share/man/ru/man8/pwck.8.gz", "/usr/share/man/ru/man8/pwconv.8.gz", "/usr/share/man/ru/man8/useradd.8.gz", "/usr/share/man/ru/man8/userdel.8.gz", "/usr/share/man/ru/man8/usermod.8.gz", "/usr/share/man/ru/man8/vipw.8.gz", "/usr/share/man/sv/man1/chage.1.gz", "/usr/share/man/sv/man1/chsh.1.gz", "/usr/share/man/sv/man1/expiry.1.gz", "/usr/share/man/sv/man1/passwd.1.gz", "/usr/share/man/sv/man5/gshadow.5.gz", "/usr/share/man/sv/man5/passwd.5.gz", "/usr/share/man/sv/man8/groupadd.8.gz", "/usr/share/man/sv/man8/groupdel.8.gz", "/usr/share/man/sv/man8/groupmod.8.gz", "/usr/share/man/sv/man8/grpck.8.gz", "/usr/share/man/sv/man8/pwck.8.gz", "/usr/share/man/sv/man8/userdel.8.gz", "/usr/share/man/sv/man8/vipw.8.gz", "/usr/share/man/tr/man1/chage.1.gz", "/usr/share/man/tr/man1/chfn.1.gz", "/usr/share/man/tr/man1/passwd.1.gz", "/usr/share/man/tr/man5/passwd.5.gz", "/usr/share/man/tr/man5/shadow.5.gz", "/usr/share/man/tr/man8/groupadd.8.gz", "/usr/share/man/tr/man8/groupdel.8.gz", "/usr/share/man/tr/man8/groupmod.8.gz", "/usr/share/man/tr/man8/useradd.8.gz", "/usr/share/man/tr/man8/userdel.8.gz", "/usr/share/man/tr/man8/usermod.8.gz", "/usr/share/man/uk/man1/chage.1.gz", "/usr/share/man/uk/man1/chfn.1.gz", "/usr/share/man/uk/man1/chsh.1.gz", "/usr/share/man/uk/man1/expiry.1.gz", "/usr/share/man/uk/man1/gpasswd.1.gz", "/usr/share/man/uk/man1/passwd.1.gz", "/usr/share/man/uk/man5/gshadow.5.gz", "/usr/share/man/uk/man5/passwd.5.gz", "/usr/share/man/uk/man5/shadow.5.gz", "/usr/share/man/uk/man8/chgpasswd.8.gz", "/usr/share/man/uk/man8/chpasswd.8.gz", "/usr/share/man/uk/man8/groupadd.8.gz", "/usr/share/man/uk/man8/groupdel.8.gz", "/usr/share/man/uk/man8/groupmod.8.gz", "/usr/share/man/uk/man8/grpck.8.gz", "/usr/share/man/uk/man8/newusers.8.gz", "/usr/share/man/uk/man8/pwck.8.gz", "/usr/share/man/uk/man8/pwconv.8.gz", "/usr/share/man/uk/man8/useradd.8.gz", "/usr/share/man/uk/man8/userdel.8.gz", "/usr/share/man/uk/man8/usermod.8.gz", "/usr/share/man/uk/man8/vipw.8.gz", "/usr/share/man/zh_CN/man1/chage.1.gz", "/usr/share/man/zh_CN/man1/chfn.1.gz", "/usr/share/man/zh_CN/man1/chsh.1.gz", "/usr/share/man/zh_CN/man1/expiry.1.gz", "/usr/share/man/zh_CN/man1/gpasswd.1.gz", "/usr/share/man/zh_CN/man1/passwd.1.gz", "/usr/share/man/zh_CN/man5/gshadow.5.gz", "/usr/share/man/zh_CN/man5/passwd.5.gz", "/usr/share/man/zh_CN/man5/shadow.5.gz", "/usr/share/man/zh_CN/man8/chgpasswd.8.gz", "/usr/share/man/zh_CN/man8/chpasswd.8.gz", "/usr/share/man/zh_CN/man8/groupadd.8.gz", "/usr/share/man/zh_CN/man8/groupdel.8.gz", "/usr/share/man/zh_CN/man8/groupmod.8.gz", "/usr/share/man/zh_CN/man8/grpck.8.gz", "/usr/share/man/zh_CN/man8/newusers.8.gz", "/usr/share/man/zh_CN/man8/pwck.8.gz", "/usr/share/man/zh_CN/man8/pwconv.8.gz", "/usr/share/man/zh_CN/man8/useradd.8.gz", "/usr/share/man/zh_CN/man8/userdel.8.gz", "/usr/share/man/zh_CN/man8/usermod.8.gz", "/usr/share/man/zh_CN/man8/vipw.8.gz", "/usr/share/man/zh_TW/man1/chfn.1.gz", "/usr/share/man/zh_TW/man1/chsh.1.gz", "/usr/share/man/zh_TW/man5/passwd.5.gz", "/usr/share/man/zh_TW/man8/chpasswd.8.gz", "/usr/share/man/zh_TW/man8/groupadd.8.gz", "/usr/share/man/zh_TW/man8/groupdel.8.gz", "/usr/share/man/zh_TW/man8/groupmod.8.gz", "/usr/share/man/zh_TW/man8/useradd.8.gz", "/usr/share/man/zh_TW/man8/userdel.8.gz", "/usr/share/man/zh_TW/man8/usermod.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "perl-base@5.40.1-6", "Name": "perl-base", "Identifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.6", "UID": "546ba1bdcd66d61" }, "Version": "5.40.1", "Release": "6", "Arch": "amd64", "SrcName": "perl", "SrcVersion": "5.40.1", "SrcRelease": "6", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "FSFAP", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/perl", "/usr/bin/perl5.40.1", "/usr/lib/x86_64-linux-gnu/perl-base/AutoLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Carp.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Carp/Heavy.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Config.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Config_git.pl", "/usr/lib/x86_64-linux-gnu/perl-base/Config_heavy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/Cwd.pm", "/usr/lib/x86_64-linux-gnu/perl-base/DynaLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Errno.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Exporter.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Exporter/Heavy.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Fcntl.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Basename.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Glob.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Path.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Spec.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Spec/Unix.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Temp.pm", "/usr/lib/x86_64-linux-gnu/perl-base/FileHandle.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Getopt/Long.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Getopt/Long/Parser.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Hash/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/File.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Handle.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Pipe.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Seekable.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Select.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/INET.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/IP.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/UNIX.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open2.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm", "/usr/lib/x86_64-linux-gnu/perl-base/List/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/POSIX.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Scalar/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/SelectSaver.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Symbol.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/ParseWords.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/Tabs.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/Wrap.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Tie/Hash.pm", "/usr/lib/x86_64-linux-gnu/perl-base/XSLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/attributes.pm", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Cwd/Cwd.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Fcntl/Fcntl.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/File/Glob/Glob.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Hash/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/IO/IO.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/List/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/POSIX/POSIX.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Socket/Socket.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/attributes/attributes.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/re/re.so", "/usr/lib/x86_64-linux-gnu/perl-base/base.pm", "/usr/lib/x86_64-linux-gnu/perl-base/builtin.pm", "/usr/lib/x86_64-linux-gnu/perl-base/bytes.pm", "/usr/lib/x86_64-linux-gnu/perl-base/constant.pm", "/usr/lib/x86_64-linux-gnu/perl-base/feature.pm", "/usr/lib/x86_64-linux-gnu/perl-base/fields.pm", "/usr/lib/x86_64-linux-gnu/perl-base/integer.pm", "/usr/lib/x86_64-linux-gnu/perl-base/lib.pm", "/usr/lib/x86_64-linux-gnu/perl-base/locale.pm", "/usr/lib/x86_64-linux-gnu/perl-base/overload.pm", "/usr/lib/x86_64-linux-gnu/perl-base/overloading.pm", "/usr/lib/x86_64-linux-gnu/perl-base/parent.pm", "/usr/lib/x86_64-linux-gnu/perl-base/re.pm", "/usr/lib/x86_64-linux-gnu/perl-base/strict.pm", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Age.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bmg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bpb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bpt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Cf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Ea.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/EqUIdeo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/GCB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Gc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Hst.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Identif2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Identifi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/InPC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/InSC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Isc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Jg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Jt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Lb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Lc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFCQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFDQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKCCF.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKCQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKDQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Na1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NameAlia.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Nt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Nv.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/PerlDeci.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/SB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Sc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Scx.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Tc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Uc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Vo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/WB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/_PerlLB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/_PerlSCX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V100.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V11.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V110.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V120.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V130.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V140.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V150.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V20.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V30.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V31.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V32.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V40.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V41.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V50.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V51.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V52.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V60.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V61.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V70.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V80.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V90.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Alpha/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/AN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/B.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/BN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/CS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/EN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ES.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ET.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/NSM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ON.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/WS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/BidiC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/BidiM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Blk/NB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/O.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CE/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CI/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWCF/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWCM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWKCF/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWL/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWT/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWU/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Cased/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/A.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/AR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/ATAR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/B.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/BR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/DB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/NK.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/NR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/OV.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/VR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CompEx/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/DI/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dash/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dep/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dia/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Com.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Enc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Fin.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Font.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Init.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Iso.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Med.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Nar.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Nb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/NonCanon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sqr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sub.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sup.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Vert.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EBase/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EComp/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EPres/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/A.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/H.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/Na.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/W.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Emoji/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ext/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/ExtPict/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/CN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/LV.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/LVT.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/PP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/SM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Cf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Cn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/LC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Ll.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/M.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Mc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Me.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Mn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Nd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Nl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/No.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/P.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pe.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Po.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Ps.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/S.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sk.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/So.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Z.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Zs.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GrBase/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GrExt/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hex/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hst/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hyphen/T.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IDC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IDS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdStatus/Allowed.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdStatus/Restrict.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/DefaultI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Exclusio.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Inclusio.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/LimitedU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotChara.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotNFKC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotXID.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Obsolete.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Recommen.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Technica.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Uncommon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ideo/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/10_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/11_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/12_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/12_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/13_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/14_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/15_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/2_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/2_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/4_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/4_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/7_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/8_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/9_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Bottom.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/BottomAn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Left.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/LeftAndR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Overstru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Right.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Top.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndBo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndL2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndLe.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndRi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/VisualOr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Avagraha.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Bindu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Cantilla.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona5.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona7.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona9.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consonan.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Geminati.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Invisibl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Nukta.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Number.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Other.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/PureKill.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Syllable.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/ToneMark.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Virama.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Visarga.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Vowel.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/VowelDep.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/VowelInd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Ain.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Alef.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Beh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Dal.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/FarsiYeh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Feh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Gaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Hah.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/HanifiRo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Kaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Lam.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/NoJoinin.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Noon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Qaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Reh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Sad.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Seen.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Tah.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Waw.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Yeh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/D.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/T.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/U.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/AI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/BA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/BB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CJ.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/GL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/ID.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/IN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/IS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/NS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/OP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/PO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/PR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/QU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/SA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lower/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Math/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFCQC/M.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFCQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFDQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFDQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKCQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKCQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKDQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKDQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/Di.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/None.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/Nu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/10.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/100.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/10000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/100000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/11.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/12.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/13.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/14.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/15.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/17.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/18.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/19.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/20.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/200.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/20000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/30.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/300.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/30000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3_16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3_4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/40.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/400.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/4000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/40000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/5.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/50.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/500.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/5000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/50000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/60.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/600.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/6000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/60000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/7.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/70.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/700.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/7000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/70000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/80.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/800.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/8000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/80000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/9.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/90.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/900.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/9000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/90000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/PCM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/PatSyn/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Alnum.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Assigned.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Blank.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Graph.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/PerlWord.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/PosixPun.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Print.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/SpacePer.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Title.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Word.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/XPosixPu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlAny.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlCh2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlCha.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlFol.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIDC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIDS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIsI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlNch.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPat.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPr2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPro.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlQuo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/QMark/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/AT.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/CL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/FO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/LE.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/LO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/SC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/ST.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/Sp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/UP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SD/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/STerm/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Arab.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Beng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Cprt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Cyrl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Deva.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Dupl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Geor.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Glag.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gonm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gran.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Grek.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gujr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Guru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Han.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Hang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Hira.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Kana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Knda.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Latn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Limb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Linb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mlym.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mult.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Orya.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Sinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Syrc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Taml.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Telu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Zinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Zyyy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Adlm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Arab.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Armn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Beng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Bhks.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Bopo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cakm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cham.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Copt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cprt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cyrl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Deva.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Diak.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Dupl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Ethi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Geor.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Glag.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gonm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gran.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Grek.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gujr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Guru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Han.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hebr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hira.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hmng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hmnp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Kana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khar.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khmr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khoj.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Knda.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Kthi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lao.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Latn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Limb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lina.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Linb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mlym.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mult.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mymr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Nand.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Nko.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Orya.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Phlp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Rohg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Shrd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Sind.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Sinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Syrc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tagb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Takr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Talu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Taml.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Telu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Thaa.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tibt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tirh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Vith.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Xsux.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Yezi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Yi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zyyy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zzzz.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Term/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/UIdeo/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Upper/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/VS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/Tr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/Tu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/U.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/Extend.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/FO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/HL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/KA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/LE.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/MB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/ML.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/MN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/WSegSpac.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/XIDC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/XIDS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/utf8.pm", "/usr/lib/x86_64-linux-gnu/perl-base/vars.pm", "/usr/lib/x86_64-linux-gnu/perl-base/warnings.pm", "/usr/lib/x86_64-linux-gnu/perl-base/warnings/register.pm", "/usr/share/doc/perl-base/changelog.Debian.gz", "/usr/share/doc/perl-base/changelog.gz", "/usr/share/doc/perl-base/copyright", "/usr/share/doc/perl/AUTHORS.gz", "/usr/share/doc/perl/Documentation", "/usr/share/lintian/overrides/perl-base", "/usr/share/man/man1/perl.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "readline-common@8.2-6", "Name": "readline-common", "Identifier": { "PURL": "pkg:deb/debian/readline-common@8.2-6?arch=all\u0026distro=debian-13.6", "UID": "c4beab42d2a9a634" }, "Version": "8.2", "Release": "6", "Arch": "all", "SrcName": "readline", "SrcVersion": "8.2", "SrcRelease": "6", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-or-later", "ISC-no-attribution" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "InstalledFiles": [ "/usr/share/doc/readline-common/changelog.Debian.gz", "/usr/share/doc/readline-common/changelog.gz", "/usr/share/doc/readline-common/copyright", "/usr/share/doc/readline-common/inputrc.arrows", "/usr/share/info/rluserman.info.gz", "/usr/share/lintian/overrides/readline-common", "/usr/share/man/man3/history.3readline.gz", "/usr/share/man/man3/readline.3readline.gz", "/usr/share/readline/inputrc" ], "AnalyzedBy": "dpkg" }, { "ID": "sed@4.9-2+deb13u1", "Name": "sed", "Identifier": { "PURL": "pkg:deb/debian/sed@4.9-2%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "a041ea16982bb927" }, "Version": "4.9", "Release": "2+deb13u1", "Arch": "amd64", "SrcName": "sed", "SrcVersion": "4.9", "SrcRelease": "2+deb13u1", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "X11", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-only", "ISC", "BSD-4-Clause-UC", "BSL-1", "pcre" ], "Maintainer": "Clint Adams \u003cclint@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/sed", "/usr/share/doc/sed/AUTHORS", "/usr/share/doc/sed/BUGS.gz", "/usr/share/doc/sed/NEWS.gz", "/usr/share/doc/sed/README", "/usr/share/doc/sed/THANKS.gz", "/usr/share/doc/sed/changelog.Debian.gz", "/usr/share/doc/sed/changelog.gz", "/usr/share/doc/sed/copyright", "/usr/share/doc/sed/examples/dc.sed", "/usr/share/doc/sed/sedfaq.txt.gz", "/usr/share/info/sed.info.gz", "/usr/share/locale/af/LC_MESSAGES/sed.mo", "/usr/share/locale/ast/LC_MESSAGES/sed.mo", "/usr/share/locale/bg/LC_MESSAGES/sed.mo", "/usr/share/locale/ca/LC_MESSAGES/sed.mo", "/usr/share/locale/cs/LC_MESSAGES/sed.mo", "/usr/share/locale/da/LC_MESSAGES/sed.mo", "/usr/share/locale/de/LC_MESSAGES/sed.mo", "/usr/share/locale/el/LC_MESSAGES/sed.mo", "/usr/share/locale/eo/LC_MESSAGES/sed.mo", "/usr/share/locale/es/LC_MESSAGES/sed.mo", "/usr/share/locale/et/LC_MESSAGES/sed.mo", "/usr/share/locale/eu/LC_MESSAGES/sed.mo", "/usr/share/locale/fi/LC_MESSAGES/sed.mo", "/usr/share/locale/fr/LC_MESSAGES/sed.mo", "/usr/share/locale/ga/LC_MESSAGES/sed.mo", "/usr/share/locale/gl/LC_MESSAGES/sed.mo", "/usr/share/locale/he/LC_MESSAGES/sed.mo", "/usr/share/locale/hr/LC_MESSAGES/sed.mo", "/usr/share/locale/hu/LC_MESSAGES/sed.mo", "/usr/share/locale/id/LC_MESSAGES/sed.mo", "/usr/share/locale/it/LC_MESSAGES/sed.mo", "/usr/share/locale/ja/LC_MESSAGES/sed.mo", "/usr/share/locale/ka/LC_MESSAGES/sed.mo", "/usr/share/locale/ko/LC_MESSAGES/sed.mo", "/usr/share/locale/nb/LC_MESSAGES/sed.mo", "/usr/share/locale/nl/LC_MESSAGES/sed.mo", "/usr/share/locale/pl/LC_MESSAGES/sed.mo", "/usr/share/locale/pt/LC_MESSAGES/sed.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/sed.mo", "/usr/share/locale/ro/LC_MESSAGES/sed.mo", "/usr/share/locale/ru/LC_MESSAGES/sed.mo", "/usr/share/locale/sk/LC_MESSAGES/sed.mo", "/usr/share/locale/sl/LC_MESSAGES/sed.mo", "/usr/share/locale/sr/LC_MESSAGES/sed.mo", "/usr/share/locale/sv/LC_MESSAGES/sed.mo", "/usr/share/locale/tr/LC_MESSAGES/sed.mo", "/usr/share/locale/uk/LC_MESSAGES/sed.mo", "/usr/share/locale/vi/LC_MESSAGES/sed.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/sed.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/sed.mo", "/usr/share/man/man1/sed.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "shared-mime-info@2.4-5+b2", "Name": "shared-mime-info", "Identifier": { "PURL": "pkg:deb/debian/shared-mime-info@2.4-5%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "b76155c0e6ca2c9a" }, "Version": "2.4", "Release": "5+b2", "Arch": "amd64", "SrcName": "shared-mime-info", "SrcVersion": "2.4", "SrcRelease": "5", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian freedesktop.org maintainers \u003cpkg-freedesktop-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libglib2.0-0t64@2.84.4-3~deb13u5", "libstdc++6@14.2.0-19", "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3" ], "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/bin/update-mime-database", "/usr/share/doc-base/shared-mime-info.shared-mime-info", "/usr/share/doc/shared-mime-info/NEWS.gz", "/usr/share/doc/shared-mime-info/README.md", "/usr/share/doc/shared-mime-info/changelog.Debian.amd64.gz", "/usr/share/doc/shared-mime-info/changelog.Debian.gz", "/usr/share/doc/shared-mime-info/copyright", "/usr/share/doc/shared-mime-info/shared-mime-info-spec.html/b521.html", "/usr/share/doc/shared-mime-info/shared-mime-info-spec.html/index.html", "/usr/share/doc/shared-mime-info/shared-mime-info-spec.html/x34.html", "/usr/share/doc/shared-mime-info/shared-mime-info-spec.html/x500.html", "/usr/share/doc/shared-mime-info/shared-mime-info-spec.pdf", "/usr/share/doc/shared-mime-info/shared-mime-info-spec.xml.gz", "/usr/share/gettext/its/shared-mime-info.its", "/usr/share/gettext/its/shared-mime-info.loc", "/usr/share/locale/af/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ar/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/as/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ast/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/az/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/be/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/be@latin/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/bg/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/bn_IN/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ca/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ca@valencia/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/cs/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/cy/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/da/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/de/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/el/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/en_GB/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/eo/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/es/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/et/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/eu/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/fa/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/fi/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/fo/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/fr/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/fur/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ga/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/gl/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/gu/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/he/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/hi/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/hr/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/hu/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ia/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/id/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/is/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/it/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ja/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ka/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/kk/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/kn/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ko/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ky/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/lt/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/lv/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ml/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/mr/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ms/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/nb/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/nl/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/nn/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/oc/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/or/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/pa/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/pl/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/pt/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ro/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ru/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/rw/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/si/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/sk/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/sl/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/sq/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/sr/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/sr@latin/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/sv/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ta/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/te/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/th/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/tr/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/uk/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/vi/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/wa/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/zh_HK/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/shared-mime-info.mo", "/usr/share/man/man1/update-mime-database.1.gz", "/usr/share/mime/packages/freedesktop.org.xml", "/usr/share/pkgconfig/shared-mime-info.pc" ], "AnalyzedBy": "dpkg" }, { "ID": "sqv@1.3.0-3+b2", "Name": "sqv", "Identifier": { "PURL": "pkg:deb/debian/sqv@1.3.0-3%2Bb2?arch=amd64\u0026distro=debian-13.6", "UID": "2bf11ffe79190750" }, "Version": "1.3.0", "Release": "3+b2", "Arch": "amd64", "SrcName": "rust-sequoia-sqv", "SrcVersion": "1.3.0", "SrcRelease": "3", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.0-only" ], "Maintainer": "Debian Rust Maintainers \u003cpkg-rust-maintainers@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3", "libgcc-s1@14.2.0-19", "libgmp10@2:6.3.0+dfsg-3", "libhogweed6t64@3.10.1-1", "libnettle8t64@3.10.1-1" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/sqv", "/usr/share/bash-completion/completions/sqv.bash", "/usr/share/doc/sqv/NEWS.gz", "/usr/share/doc/sqv/changelog.Debian.amd64.gz", "/usr/share/doc/sqv/changelog.Debian.gz", "/usr/share/doc/sqv/copyright", "/usr/share/fish/completions/sqv.fish", "/usr/share/man/man1/sqv.1.gz", "/usr/share/zsh/vendor-completions/_sqv" ], "AnalyzedBy": "dpkg" }, { "ID": "sysvinit-utils@3.14-4", "Name": "sysvinit-utils", "Identifier": { "PURL": "pkg:deb/debian/sysvinit-utils@3.14-4?arch=amd64\u0026distro=debian-13.6", "UID": "f7fb888c58ca826e" }, "Version": "3.14", "Release": "4", "Arch": "amd64", "SrcName": "sysvinit", "SrcVersion": "3.14", "SrcRelease": "4", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "GPL-3.0-only", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian sysvinit maintainers \u003cdebian-init-diversity@chiark.greenend.org.uk\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/init/init-d-script", "/usr/lib/init/vars.sh", "/usr/lib/lsb/init-functions", "/usr/lib/lsb/init-functions.d/00-verbose", "/usr/sbin/fstab-decode", "/usr/sbin/killall5", "/usr/share/doc/sysvinit-utils/changelog.Debian.gz", "/usr/share/doc/sysvinit-utils/copyright", "/usr/share/man/man5/init-d-script.5.gz", "/usr/share/man/man8/fstab-decode.8.gz", "/usr/share/man/man8/killall5.8.gz", "/usr/share/man/man8/pidof.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "tar@1.35+dfsg-3.1", "Name": "tar", "Identifier": { "PURL": "pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=amd64\u0026distro=debian-13.6", "UID": "4f69996c49afbaca" }, "Version": "1.35+dfsg", "Release": "3.1", "Arch": "amd64", "SrcName": "tar", "SrcVersion": "1.35+dfsg", "SrcRelease": "3.1", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-3+ with Bison exception", "LGPL-2.1-or-later", "LGPL-2.1-only", "LGPL-3.0-or-later", "LGPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Janos Lenart \u003cocsi@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/tar", "/usr/lib/mime/packages/tar", "/usr/sbin/rmt-tar", "/usr/sbin/tarcat", "/usr/share/doc/tar/AUTHORS", "/usr/share/doc/tar/NEWS.gz", "/usr/share/doc/tar/README.Debian", "/usr/share/doc/tar/THANKS.gz", "/usr/share/doc/tar/changelog.1.gz", "/usr/share/doc/tar/changelog.Debian.gz", "/usr/share/doc/tar/changelog.gz", "/usr/share/doc/tar/copyright", "/usr/share/locale/bg/LC_MESSAGES/tar.mo", "/usr/share/locale/ca/LC_MESSAGES/tar.mo", "/usr/share/locale/cs/LC_MESSAGES/tar.mo", "/usr/share/locale/da/LC_MESSAGES/tar.mo", "/usr/share/locale/de/LC_MESSAGES/tar.mo", "/usr/share/locale/el/LC_MESSAGES/tar.mo", "/usr/share/locale/eo/LC_MESSAGES/tar.mo", "/usr/share/locale/es/LC_MESSAGES/tar.mo", "/usr/share/locale/et/LC_MESSAGES/tar.mo", "/usr/share/locale/eu/LC_MESSAGES/tar.mo", "/usr/share/locale/fi/LC_MESSAGES/tar.mo", "/usr/share/locale/fr/LC_MESSAGES/tar.mo", "/usr/share/locale/ga/LC_MESSAGES/tar.mo", "/usr/share/locale/gl/LC_MESSAGES/tar.mo", "/usr/share/locale/hr/LC_MESSAGES/tar.mo", "/usr/share/locale/hu/LC_MESSAGES/tar.mo", "/usr/share/locale/id/LC_MESSAGES/tar.mo", "/usr/share/locale/it/LC_MESSAGES/tar.mo", "/usr/share/locale/ja/LC_MESSAGES/tar.mo", "/usr/share/locale/ka/LC_MESSAGES/tar.mo", "/usr/share/locale/ko/LC_MESSAGES/tar.mo", "/usr/share/locale/ky/LC_MESSAGES/tar.mo", "/usr/share/locale/ms/LC_MESSAGES/tar.mo", "/usr/share/locale/nb/LC_MESSAGES/tar.mo", "/usr/share/locale/nl/LC_MESSAGES/tar.mo", "/usr/share/locale/pl/LC_MESSAGES/tar.mo", "/usr/share/locale/pt/LC_MESSAGES/tar.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/tar.mo", "/usr/share/locale/ro/LC_MESSAGES/tar.mo", "/usr/share/locale/ru/LC_MESSAGES/tar.mo", "/usr/share/locale/sk/LC_MESSAGES/tar.mo", "/usr/share/locale/sl/LC_MESSAGES/tar.mo", "/usr/share/locale/sr/LC_MESSAGES/tar.mo", "/usr/share/locale/sv/LC_MESSAGES/tar.mo", "/usr/share/locale/tr/LC_MESSAGES/tar.mo", "/usr/share/locale/uk/LC_MESSAGES/tar.mo", "/usr/share/locale/vi/LC_MESSAGES/tar.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/tar.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/tar.mo", "/usr/share/man/man1/tar.1.gz", "/usr/share/man/man1/tarcat.1.gz", "/usr/share/man/man8/rmt-tar.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "tzdata@2026b-0+deb13u1", "Name": "tzdata", "Identifier": { "PURL": "pkg:deb/debian/tzdata@2026b-0%2Bdeb13u1?arch=all\u0026distro=debian-13.6", "UID": "9e352e373d8245f0" }, "Version": "2026b", "Release": "0+deb13u1", "Arch": "all", "SrcName": "tzdata", "SrcVersion": "2026b", "SrcRelease": "0+deb13u1", "Licenses": [ "public-domain" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.91" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/share/doc/tzdata/NEWS.Debian.gz", "/usr/share/doc/tzdata/README.Debian", "/usr/share/doc/tzdata/changelog.Debian.gz", "/usr/share/doc/tzdata/changelog.gz", "/usr/share/doc/tzdata/copyright", "/usr/share/lintian/overrides/tzdata", "/usr/share/zoneinfo/Africa/Abidjan", "/usr/share/zoneinfo/Africa/Accra", "/usr/share/zoneinfo/Africa/Addis_Ababa", "/usr/share/zoneinfo/Africa/Algiers", "/usr/share/zoneinfo/Africa/Asmara", "/usr/share/zoneinfo/Africa/Bamako", "/usr/share/zoneinfo/Africa/Bangui", "/usr/share/zoneinfo/Africa/Banjul", "/usr/share/zoneinfo/Africa/Bissau", "/usr/share/zoneinfo/Africa/Blantyre", "/usr/share/zoneinfo/Africa/Brazzaville", "/usr/share/zoneinfo/Africa/Bujumbura", "/usr/share/zoneinfo/Africa/Cairo", "/usr/share/zoneinfo/Africa/Casablanca", "/usr/share/zoneinfo/Africa/Ceuta", "/usr/share/zoneinfo/Africa/Conakry", "/usr/share/zoneinfo/Africa/Dakar", "/usr/share/zoneinfo/Africa/Dar_es_Salaam", "/usr/share/zoneinfo/Africa/Djibouti", "/usr/share/zoneinfo/Africa/Douala", "/usr/share/zoneinfo/Africa/El_Aaiun", "/usr/share/zoneinfo/Africa/Freetown", "/usr/share/zoneinfo/Africa/Gaborone", "/usr/share/zoneinfo/Africa/Harare", "/usr/share/zoneinfo/Africa/Johannesburg", "/usr/share/zoneinfo/Africa/Juba", "/usr/share/zoneinfo/Africa/Kampala", "/usr/share/zoneinfo/Africa/Khartoum", "/usr/share/zoneinfo/Africa/Kigali", "/usr/share/zoneinfo/Africa/Kinshasa", "/usr/share/zoneinfo/Africa/Lagos", "/usr/share/zoneinfo/Africa/Libreville", "/usr/share/zoneinfo/Africa/Lome", "/usr/share/zoneinfo/Africa/Luanda", "/usr/share/zoneinfo/Africa/Lubumbashi", "/usr/share/zoneinfo/Africa/Lusaka", "/usr/share/zoneinfo/Africa/Malabo", "/usr/share/zoneinfo/Africa/Maputo", "/usr/share/zoneinfo/Africa/Maseru", "/usr/share/zoneinfo/Africa/Mbabane", "/usr/share/zoneinfo/Africa/Mogadishu", "/usr/share/zoneinfo/Africa/Monrovia", "/usr/share/zoneinfo/Africa/Nairobi", "/usr/share/zoneinfo/Africa/Ndjamena", "/usr/share/zoneinfo/Africa/Niamey", "/usr/share/zoneinfo/Africa/Nouakchott", "/usr/share/zoneinfo/Africa/Ouagadougou", "/usr/share/zoneinfo/Africa/Porto-Novo", "/usr/share/zoneinfo/Africa/Sao_Tome", "/usr/share/zoneinfo/Africa/Tripoli", "/usr/share/zoneinfo/Africa/Tunis", "/usr/share/zoneinfo/Africa/Windhoek", "/usr/share/zoneinfo/America/Adak", "/usr/share/zoneinfo/America/Anchorage", "/usr/share/zoneinfo/America/Anguilla", "/usr/share/zoneinfo/America/Antigua", "/usr/share/zoneinfo/America/Araguaina", "/usr/share/zoneinfo/America/Argentina/Buenos_Aires", "/usr/share/zoneinfo/America/Argentina/Catamarca", "/usr/share/zoneinfo/America/Argentina/Cordoba", "/usr/share/zoneinfo/America/Argentina/Jujuy", "/usr/share/zoneinfo/America/Argentina/La_Rioja", "/usr/share/zoneinfo/America/Argentina/Mendoza", "/usr/share/zoneinfo/America/Argentina/Rio_Gallegos", "/usr/share/zoneinfo/America/Argentina/Salta", "/usr/share/zoneinfo/America/Argentina/San_Juan", "/usr/share/zoneinfo/America/Argentina/San_Luis", "/usr/share/zoneinfo/America/Argentina/Tucuman", "/usr/share/zoneinfo/America/Argentina/Ushuaia", "/usr/share/zoneinfo/America/Aruba", "/usr/share/zoneinfo/America/Asuncion", "/usr/share/zoneinfo/America/Atikokan", "/usr/share/zoneinfo/America/Bahia", "/usr/share/zoneinfo/America/Bahia_Banderas", "/usr/share/zoneinfo/America/Barbados", "/usr/share/zoneinfo/America/Belem", "/usr/share/zoneinfo/America/Belize", "/usr/share/zoneinfo/America/Blanc-Sablon", "/usr/share/zoneinfo/America/Boa_Vista", "/usr/share/zoneinfo/America/Bogota", "/usr/share/zoneinfo/America/Boise", "/usr/share/zoneinfo/America/Cambridge_Bay", "/usr/share/zoneinfo/America/Campo_Grande", "/usr/share/zoneinfo/America/Cancun", "/usr/share/zoneinfo/America/Caracas", "/usr/share/zoneinfo/America/Cayenne", "/usr/share/zoneinfo/America/Cayman", "/usr/share/zoneinfo/America/Chicago", "/usr/share/zoneinfo/America/Chihuahua", "/usr/share/zoneinfo/America/Ciudad_Juarez", "/usr/share/zoneinfo/America/Costa_Rica", "/usr/share/zoneinfo/America/Coyhaique", "/usr/share/zoneinfo/America/Creston", "/usr/share/zoneinfo/America/Cuiaba", "/usr/share/zoneinfo/America/Curacao", "/usr/share/zoneinfo/America/Danmarkshavn", "/usr/share/zoneinfo/America/Dawson", "/usr/share/zoneinfo/America/Dawson_Creek", "/usr/share/zoneinfo/America/Denver", "/usr/share/zoneinfo/America/Detroit", "/usr/share/zoneinfo/America/Dominica", "/usr/share/zoneinfo/America/Edmonton", "/usr/share/zoneinfo/America/Eirunepe", "/usr/share/zoneinfo/America/El_Salvador", "/usr/share/zoneinfo/America/Fort_Nelson", "/usr/share/zoneinfo/America/Fortaleza", "/usr/share/zoneinfo/America/Glace_Bay", "/usr/share/zoneinfo/America/Goose_Bay", "/usr/share/zoneinfo/America/Grand_Turk", "/usr/share/zoneinfo/America/Grenada", "/usr/share/zoneinfo/America/Guadeloupe", "/usr/share/zoneinfo/America/Guatemala", "/usr/share/zoneinfo/America/Guayaquil", "/usr/share/zoneinfo/America/Guyana", "/usr/share/zoneinfo/America/Halifax", "/usr/share/zoneinfo/America/Havana", "/usr/share/zoneinfo/America/Hermosillo", "/usr/share/zoneinfo/America/Indiana/Indianapolis", "/usr/share/zoneinfo/America/Indiana/Knox", "/usr/share/zoneinfo/America/Indiana/Marengo", "/usr/share/zoneinfo/America/Indiana/Petersburg", "/usr/share/zoneinfo/America/Indiana/Tell_City", "/usr/share/zoneinfo/America/Indiana/Vevay", "/usr/share/zoneinfo/America/Indiana/Vincennes", "/usr/share/zoneinfo/America/Indiana/Winamac", "/usr/share/zoneinfo/America/Inuvik", "/usr/share/zoneinfo/America/Iqaluit", "/usr/share/zoneinfo/America/Jamaica", "/usr/share/zoneinfo/America/Juneau", "/usr/share/zoneinfo/America/Kentucky/Louisville", "/usr/share/zoneinfo/America/Kentucky/Monticello", "/usr/share/zoneinfo/America/La_Paz", "/usr/share/zoneinfo/America/Lima", "/usr/share/zoneinfo/America/Los_Angeles", "/usr/share/zoneinfo/America/Maceio", "/usr/share/zoneinfo/America/Managua", "/usr/share/zoneinfo/America/Manaus", "/usr/share/zoneinfo/America/Martinique", "/usr/share/zoneinfo/America/Matamoros", "/usr/share/zoneinfo/America/Mazatlan", "/usr/share/zoneinfo/America/Menominee", "/usr/share/zoneinfo/America/Merida", "/usr/share/zoneinfo/America/Metlakatla", "/usr/share/zoneinfo/America/Mexico_City", "/usr/share/zoneinfo/America/Miquelon", "/usr/share/zoneinfo/America/Moncton", "/usr/share/zoneinfo/America/Monterrey", "/usr/share/zoneinfo/America/Montevideo", "/usr/share/zoneinfo/America/Montserrat", "/usr/share/zoneinfo/America/Nassau", "/usr/share/zoneinfo/America/New_York", "/usr/share/zoneinfo/America/Nome", "/usr/share/zoneinfo/America/Noronha", "/usr/share/zoneinfo/America/North_Dakota/Beulah", "/usr/share/zoneinfo/America/North_Dakota/Center", "/usr/share/zoneinfo/America/North_Dakota/New_Salem", "/usr/share/zoneinfo/America/Nuuk", "/usr/share/zoneinfo/America/Ojinaga", "/usr/share/zoneinfo/America/Panama", "/usr/share/zoneinfo/America/Paramaribo", "/usr/share/zoneinfo/America/Phoenix", "/usr/share/zoneinfo/America/Port-au-Prince", "/usr/share/zoneinfo/America/Port_of_Spain", "/usr/share/zoneinfo/America/Porto_Velho", "/usr/share/zoneinfo/America/Puerto_Rico", "/usr/share/zoneinfo/America/Punta_Arenas", "/usr/share/zoneinfo/America/Rankin_Inlet", "/usr/share/zoneinfo/America/Recife", "/usr/share/zoneinfo/America/Regina", "/usr/share/zoneinfo/America/Resolute", "/usr/share/zoneinfo/America/Rio_Branco", "/usr/share/zoneinfo/America/Santarem", "/usr/share/zoneinfo/America/Santiago", "/usr/share/zoneinfo/America/Santo_Domingo", "/usr/share/zoneinfo/America/Sao_Paulo", "/usr/share/zoneinfo/America/Scoresbysund", "/usr/share/zoneinfo/America/Sitka", "/usr/share/zoneinfo/America/St_Johns", "/usr/share/zoneinfo/America/St_Kitts", "/usr/share/zoneinfo/America/St_Lucia", "/usr/share/zoneinfo/America/St_Thomas", "/usr/share/zoneinfo/America/St_Vincent", "/usr/share/zoneinfo/America/Swift_Current", "/usr/share/zoneinfo/America/Tegucigalpa", "/usr/share/zoneinfo/America/Thule", "/usr/share/zoneinfo/America/Tijuana", "/usr/share/zoneinfo/America/Toronto", "/usr/share/zoneinfo/America/Tortola", "/usr/share/zoneinfo/America/Vancouver", "/usr/share/zoneinfo/America/Whitehorse", "/usr/share/zoneinfo/America/Winnipeg", "/usr/share/zoneinfo/America/Yakutat", "/usr/share/zoneinfo/Antarctica/Casey", "/usr/share/zoneinfo/Antarctica/Davis", "/usr/share/zoneinfo/Antarctica/DumontDUrville", "/usr/share/zoneinfo/Antarctica/Macquarie", "/usr/share/zoneinfo/Antarctica/Mawson", "/usr/share/zoneinfo/Antarctica/McMurdo", "/usr/share/zoneinfo/Antarctica/Palmer", "/usr/share/zoneinfo/Antarctica/Rothera", "/usr/share/zoneinfo/Antarctica/Syowa", "/usr/share/zoneinfo/Antarctica/Troll", "/usr/share/zoneinfo/Antarctica/Vostok", "/usr/share/zoneinfo/Asia/Aden", "/usr/share/zoneinfo/Asia/Almaty", "/usr/share/zoneinfo/Asia/Amman", "/usr/share/zoneinfo/Asia/Anadyr", "/usr/share/zoneinfo/Asia/Aqtau", "/usr/share/zoneinfo/Asia/Aqtobe", "/usr/share/zoneinfo/Asia/Ashgabat", "/usr/share/zoneinfo/Asia/Atyrau", "/usr/share/zoneinfo/Asia/Baghdad", "/usr/share/zoneinfo/Asia/Bahrain", "/usr/share/zoneinfo/Asia/Baku", "/usr/share/zoneinfo/Asia/Bangkok", "/usr/share/zoneinfo/Asia/Barnaul", "/usr/share/zoneinfo/Asia/Beirut", "/usr/share/zoneinfo/Asia/Bishkek", "/usr/share/zoneinfo/Asia/Brunei", "/usr/share/zoneinfo/Asia/Chita", "/usr/share/zoneinfo/Asia/Colombo", "/usr/share/zoneinfo/Asia/Damascus", "/usr/share/zoneinfo/Asia/Dhaka", "/usr/share/zoneinfo/Asia/Dili", "/usr/share/zoneinfo/Asia/Dubai", "/usr/share/zoneinfo/Asia/Dushanbe", "/usr/share/zoneinfo/Asia/Famagusta", "/usr/share/zoneinfo/Asia/Gaza", "/usr/share/zoneinfo/Asia/Hebron", "/usr/share/zoneinfo/Asia/Ho_Chi_Minh", "/usr/share/zoneinfo/Asia/Hong_Kong", "/usr/share/zoneinfo/Asia/Hovd", "/usr/share/zoneinfo/Asia/Irkutsk", "/usr/share/zoneinfo/Asia/Jakarta", "/usr/share/zoneinfo/Asia/Jayapura", "/usr/share/zoneinfo/Asia/Jerusalem", "/usr/share/zoneinfo/Asia/Kabul", "/usr/share/zoneinfo/Asia/Kamchatka", "/usr/share/zoneinfo/Asia/Karachi", "/usr/share/zoneinfo/Asia/Kathmandu", "/usr/share/zoneinfo/Asia/Khandyga", "/usr/share/zoneinfo/Asia/Kolkata", "/usr/share/zoneinfo/Asia/Krasnoyarsk", "/usr/share/zoneinfo/Asia/Kuala_Lumpur", "/usr/share/zoneinfo/Asia/Kuching", "/usr/share/zoneinfo/Asia/Kuwait", "/usr/share/zoneinfo/Asia/Macau", "/usr/share/zoneinfo/Asia/Magadan", "/usr/share/zoneinfo/Asia/Makassar", "/usr/share/zoneinfo/Asia/Manila", "/usr/share/zoneinfo/Asia/Muscat", "/usr/share/zoneinfo/Asia/Nicosia", "/usr/share/zoneinfo/Asia/Novokuznetsk", "/usr/share/zoneinfo/Asia/Novosibirsk", "/usr/share/zoneinfo/Asia/Omsk", "/usr/share/zoneinfo/Asia/Oral", "/usr/share/zoneinfo/Asia/Phnom_Penh", "/usr/share/zoneinfo/Asia/Pontianak", "/usr/share/zoneinfo/Asia/Pyongyang", "/usr/share/zoneinfo/Asia/Qatar", "/usr/share/zoneinfo/Asia/Qostanay", "/usr/share/zoneinfo/Asia/Qyzylorda", "/usr/share/zoneinfo/Asia/Riyadh", "/usr/share/zoneinfo/Asia/Sakhalin", "/usr/share/zoneinfo/Asia/Samarkand", "/usr/share/zoneinfo/Asia/Seoul", "/usr/share/zoneinfo/Asia/Shanghai", "/usr/share/zoneinfo/Asia/Singapore", "/usr/share/zoneinfo/Asia/Srednekolymsk", "/usr/share/zoneinfo/Asia/Taipei", "/usr/share/zoneinfo/Asia/Tashkent", "/usr/share/zoneinfo/Asia/Tbilisi", "/usr/share/zoneinfo/Asia/Tehran", "/usr/share/zoneinfo/Asia/Thimphu", "/usr/share/zoneinfo/Asia/Tokyo", "/usr/share/zoneinfo/Asia/Tomsk", "/usr/share/zoneinfo/Asia/Ulaanbaatar", "/usr/share/zoneinfo/Asia/Urumqi", "/usr/share/zoneinfo/Asia/Ust-Nera", "/usr/share/zoneinfo/Asia/Vientiane", "/usr/share/zoneinfo/Asia/Vladivostok", "/usr/share/zoneinfo/Asia/Yakutsk", "/usr/share/zoneinfo/Asia/Yangon", "/usr/share/zoneinfo/Asia/Yekaterinburg", "/usr/share/zoneinfo/Asia/Yerevan", "/usr/share/zoneinfo/Atlantic/Azores", "/usr/share/zoneinfo/Atlantic/Bermuda", "/usr/share/zoneinfo/Atlantic/Canary", "/usr/share/zoneinfo/Atlantic/Cape_Verde", "/usr/share/zoneinfo/Atlantic/Faroe", "/usr/share/zoneinfo/Atlantic/Madeira", "/usr/share/zoneinfo/Atlantic/Reykjavik", "/usr/share/zoneinfo/Atlantic/South_Georgia", "/usr/share/zoneinfo/Atlantic/St_Helena", "/usr/share/zoneinfo/Atlantic/Stanley", "/usr/share/zoneinfo/Australia/Adelaide", "/usr/share/zoneinfo/Australia/Brisbane", "/usr/share/zoneinfo/Australia/Broken_Hill", "/usr/share/zoneinfo/Australia/Darwin", "/usr/share/zoneinfo/Australia/Eucla", "/usr/share/zoneinfo/Australia/Hobart", "/usr/share/zoneinfo/Australia/Lindeman", "/usr/share/zoneinfo/Australia/Lord_Howe", "/usr/share/zoneinfo/Australia/Melbourne", "/usr/share/zoneinfo/Australia/Perth", "/usr/share/zoneinfo/Australia/Sydney", "/usr/share/zoneinfo/Etc/GMT", "/usr/share/zoneinfo/Etc/GMT+1", "/usr/share/zoneinfo/Etc/GMT+10", "/usr/share/zoneinfo/Etc/GMT+11", "/usr/share/zoneinfo/Etc/GMT+12", "/usr/share/zoneinfo/Etc/GMT+2", "/usr/share/zoneinfo/Etc/GMT+3", "/usr/share/zoneinfo/Etc/GMT+4", "/usr/share/zoneinfo/Etc/GMT+5", "/usr/share/zoneinfo/Etc/GMT+6", "/usr/share/zoneinfo/Etc/GMT+7", "/usr/share/zoneinfo/Etc/GMT+8", "/usr/share/zoneinfo/Etc/GMT+9", "/usr/share/zoneinfo/Etc/GMT-1", "/usr/share/zoneinfo/Etc/GMT-10", "/usr/share/zoneinfo/Etc/GMT-11", "/usr/share/zoneinfo/Etc/GMT-12", "/usr/share/zoneinfo/Etc/GMT-13", "/usr/share/zoneinfo/Etc/GMT-14", "/usr/share/zoneinfo/Etc/GMT-2", "/usr/share/zoneinfo/Etc/GMT-3", "/usr/share/zoneinfo/Etc/GMT-4", "/usr/share/zoneinfo/Etc/GMT-5", "/usr/share/zoneinfo/Etc/GMT-6", "/usr/share/zoneinfo/Etc/GMT-7", "/usr/share/zoneinfo/Etc/GMT-8", "/usr/share/zoneinfo/Etc/GMT-9", "/usr/share/zoneinfo/Etc/UTC", "/usr/share/zoneinfo/Europe/Amsterdam", "/usr/share/zoneinfo/Europe/Andorra", "/usr/share/zoneinfo/Europe/Astrakhan", "/usr/share/zoneinfo/Europe/Athens", "/usr/share/zoneinfo/Europe/Belgrade", "/usr/share/zoneinfo/Europe/Berlin", "/usr/share/zoneinfo/Europe/Brussels", "/usr/share/zoneinfo/Europe/Bucharest", "/usr/share/zoneinfo/Europe/Budapest", "/usr/share/zoneinfo/Europe/Chisinau", "/usr/share/zoneinfo/Europe/Copenhagen", "/usr/share/zoneinfo/Europe/Dublin", "/usr/share/zoneinfo/Europe/Gibraltar", "/usr/share/zoneinfo/Europe/Guernsey", "/usr/share/zoneinfo/Europe/Helsinki", "/usr/share/zoneinfo/Europe/Isle_of_Man", "/usr/share/zoneinfo/Europe/Istanbul", "/usr/share/zoneinfo/Europe/Jersey", "/usr/share/zoneinfo/Europe/Kaliningrad", "/usr/share/zoneinfo/Europe/Kirov", "/usr/share/zoneinfo/Europe/Kyiv", "/usr/share/zoneinfo/Europe/Lisbon", "/usr/share/zoneinfo/Europe/Ljubljana", "/usr/share/zoneinfo/Europe/London", "/usr/share/zoneinfo/Europe/Luxembourg", "/usr/share/zoneinfo/Europe/Madrid", "/usr/share/zoneinfo/Europe/Malta", "/usr/share/zoneinfo/Europe/Minsk", "/usr/share/zoneinfo/Europe/Monaco", "/usr/share/zoneinfo/Europe/Moscow", "/usr/share/zoneinfo/Europe/Oslo", "/usr/share/zoneinfo/Europe/Paris", "/usr/share/zoneinfo/Europe/Prague", "/usr/share/zoneinfo/Europe/Riga", "/usr/share/zoneinfo/Europe/Rome", "/usr/share/zoneinfo/Europe/Samara", "/usr/share/zoneinfo/Europe/Sarajevo", "/usr/share/zoneinfo/Europe/Saratov", "/usr/share/zoneinfo/Europe/Simferopol", "/usr/share/zoneinfo/Europe/Skopje", "/usr/share/zoneinfo/Europe/Sofia", "/usr/share/zoneinfo/Europe/Stockholm", "/usr/share/zoneinfo/Europe/Tallinn", "/usr/share/zoneinfo/Europe/Tirane", "/usr/share/zoneinfo/Europe/Ulyanovsk", "/usr/share/zoneinfo/Europe/Vaduz", "/usr/share/zoneinfo/Europe/Vienna", "/usr/share/zoneinfo/Europe/Vilnius", "/usr/share/zoneinfo/Europe/Volgograd", "/usr/share/zoneinfo/Europe/Warsaw", "/usr/share/zoneinfo/Europe/Zagreb", "/usr/share/zoneinfo/Europe/Zurich", "/usr/share/zoneinfo/Factory", "/usr/share/zoneinfo/Indian/Antananarivo", "/usr/share/zoneinfo/Indian/Chagos", "/usr/share/zoneinfo/Indian/Christmas", "/usr/share/zoneinfo/Indian/Cocos", "/usr/share/zoneinfo/Indian/Comoro", "/usr/share/zoneinfo/Indian/Kerguelen", "/usr/share/zoneinfo/Indian/Mahe", "/usr/share/zoneinfo/Indian/Maldives", "/usr/share/zoneinfo/Indian/Mauritius", "/usr/share/zoneinfo/Indian/Mayotte", "/usr/share/zoneinfo/Indian/Reunion", "/usr/share/zoneinfo/Pacific/Apia", "/usr/share/zoneinfo/Pacific/Auckland", "/usr/share/zoneinfo/Pacific/Bougainville", "/usr/share/zoneinfo/Pacific/Chatham", "/usr/share/zoneinfo/Pacific/Chuuk", "/usr/share/zoneinfo/Pacific/Easter", "/usr/share/zoneinfo/Pacific/Efate", "/usr/share/zoneinfo/Pacific/Fakaofo", "/usr/share/zoneinfo/Pacific/Fiji", "/usr/share/zoneinfo/Pacific/Funafuti", "/usr/share/zoneinfo/Pacific/Galapagos", "/usr/share/zoneinfo/Pacific/Gambier", "/usr/share/zoneinfo/Pacific/Guadalcanal", "/usr/share/zoneinfo/Pacific/Guam", "/usr/share/zoneinfo/Pacific/Honolulu", "/usr/share/zoneinfo/Pacific/Kanton", "/usr/share/zoneinfo/Pacific/Kiritimati", "/usr/share/zoneinfo/Pacific/Kosrae", "/usr/share/zoneinfo/Pacific/Kwajalein", "/usr/share/zoneinfo/Pacific/Majuro", "/usr/share/zoneinfo/Pacific/Marquesas", "/usr/share/zoneinfo/Pacific/Midway", "/usr/share/zoneinfo/Pacific/Nauru", "/usr/share/zoneinfo/Pacific/Niue", "/usr/share/zoneinfo/Pacific/Norfolk", "/usr/share/zoneinfo/Pacific/Noumea", "/usr/share/zoneinfo/Pacific/Pago_Pago", "/usr/share/zoneinfo/Pacific/Palau", "/usr/share/zoneinfo/Pacific/Pitcairn", "/usr/share/zoneinfo/Pacific/Pohnpei", "/usr/share/zoneinfo/Pacific/Port_Moresby", "/usr/share/zoneinfo/Pacific/Rarotonga", "/usr/share/zoneinfo/Pacific/Saipan", "/usr/share/zoneinfo/Pacific/Tahiti", "/usr/share/zoneinfo/Pacific/Tarawa", "/usr/share/zoneinfo/Pacific/Tongatapu", "/usr/share/zoneinfo/Pacific/Wake", "/usr/share/zoneinfo/Pacific/Wallis", "/usr/share/zoneinfo/iso3166.tab", "/usr/share/zoneinfo/leap-seconds.list", "/usr/share/zoneinfo/leapseconds", "/usr/share/zoneinfo/tzdata.zi", "/usr/share/zoneinfo/zone.tab", "/usr/share/zoneinfo/zone1970.tab", "/usr/share/zoneinfo/zonenow.tab" ], "AnalyzedBy": "dpkg" }, { "ID": "util-linux@2.41.5-0+deb13u1", "Name": "util-linux", "Identifier": { "PURL": "pkg:deb/debian/util-linux@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "e4d9863928456765" }, "Version": "2.41.5", "Release": "0+deb13u1", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.41.5", "SrcRelease": "0+deb13u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "LGPL-2.1-or-later", "public-domain", "BSD-4-Clause", "MIT", "ISC", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "BSD-2-Clause", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Chris Hofstaedtler \u003czeha@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/bin/choom", "/usr/bin/chrt", "/usr/bin/dmesg", "/usr/bin/fallocate", "/usr/bin/findmnt", "/usr/bin/flock", "/usr/bin/getopt", "/usr/bin/hardlink", "/usr/bin/ionice", "/usr/bin/ipcmk", "/usr/bin/ipcrm", "/usr/bin/ipcs", "/usr/bin/lsblk", "/usr/bin/lscpu", "/usr/bin/lsipc", "/usr/bin/lslocks", "/usr/bin/lslogins", "/usr/bin/lsmem", "/usr/bin/lsns", "/usr/bin/mcookie", "/usr/bin/more", "/usr/bin/mountpoint", "/usr/bin/namei", "/usr/bin/nsenter", "/usr/bin/partx", "/usr/bin/prlimit", "/usr/bin/rename.ul", "/usr/bin/rev", "/usr/bin/setarch", "/usr/bin/setpriv", "/usr/bin/setsid", "/usr/bin/setterm", "/usr/bin/su", "/usr/bin/taskset", "/usr/bin/uclampset", "/usr/bin/unshare", "/usr/bin/wdctl", "/usr/bin/whereis", "/usr/lib/mime/packages/util-linux", "/usr/lib/systemd/system/fstrim.service", "/usr/lib/systemd/system/fstrim.timer", "/usr/sbin/agetty", "/usr/sbin/blkdiscard", "/usr/sbin/blkid", "/usr/sbin/blkzone", "/usr/sbin/blockdev", "/usr/sbin/chcpu", "/usr/sbin/chmem", "/usr/sbin/findfs", "/usr/sbin/fsck", "/usr/sbin/fsfreeze", "/usr/sbin/fstrim", "/usr/sbin/isosize", "/usr/sbin/ldattach", "/usr/sbin/mkfs", "/usr/sbin/mkswap", "/usr/sbin/pivot_root", "/usr/sbin/readprofile", "/usr/sbin/rtcwake", "/usr/sbin/runuser", "/usr/sbin/sulogin", "/usr/sbin/swaplabel", "/usr/sbin/switch_root", "/usr/sbin/wipefs", "/usr/sbin/zramctl", "/usr/share/bash-completion/completions/blkdiscard", "/usr/share/bash-completion/completions/blkid", "/usr/share/bash-completion/completions/blkzone", "/usr/share/bash-completion/completions/blockdev", "/usr/share/bash-completion/completions/chcpu", "/usr/share/bash-completion/completions/chmem", "/usr/share/bash-completion/completions/chrt", "/usr/share/bash-completion/completions/dmesg", "/usr/share/bash-completion/completions/fallocate", "/usr/share/bash-completion/completions/findfs", "/usr/share/bash-completion/completions/findmnt", "/usr/share/bash-completion/completions/flock", "/usr/share/bash-completion/completions/fsck", "/usr/share/bash-completion/completions/fsfreeze", "/usr/share/bash-completion/completions/fstrim", "/usr/share/bash-completion/completions/getopt", "/usr/share/bash-completion/completions/hardlink", "/usr/share/bash-completion/completions/ionice", "/usr/share/bash-completion/completions/ipcmk", "/usr/share/bash-completion/completions/ipcrm", "/usr/share/bash-completion/completions/ipcs", "/usr/share/bash-completion/completions/isosize", "/usr/share/bash-completion/completions/ldattach", "/usr/share/bash-completion/completions/lsblk", "/usr/share/bash-completion/completions/lscpu", "/usr/share/bash-completion/completions/lsipc", "/usr/share/bash-completion/completions/lslocks", "/usr/share/bash-completion/completions/lslogins", "/usr/share/bash-completion/completions/lsmem", "/usr/share/bash-completion/completions/lsns", "/usr/share/bash-completion/completions/mcookie", "/usr/share/bash-completion/completions/mkfs", "/usr/share/bash-completion/completions/mkswap", "/usr/share/bash-completion/completions/more", "/usr/share/bash-completion/completions/mountpoint", "/usr/share/bash-completion/completions/namei", "/usr/share/bash-completion/completions/nsenter", "/usr/share/bash-completion/completions/partx", "/usr/share/bash-completion/completions/pivot_root", "/usr/share/bash-completion/completions/prlimit", "/usr/share/bash-completion/completions/readprofile", "/usr/share/bash-completion/completions/rename.ul", "/usr/share/bash-completion/completions/rev", "/usr/share/bash-completion/completions/rtcwake", "/usr/share/bash-completion/completions/setarch", "/usr/share/bash-completion/completions/setpriv", "/usr/share/bash-completion/completions/setsid", "/usr/share/bash-completion/completions/setterm", "/usr/share/bash-completion/completions/su", "/usr/share/bash-completion/completions/swaplabel", "/usr/share/bash-completion/completions/taskset", "/usr/share/bash-completion/completions/uclampset", "/usr/share/bash-completion/completions/unshare", "/usr/share/bash-completion/completions/wdctl", "/usr/share/bash-completion/completions/whereis", "/usr/share/bash-completion/completions/wipefs", "/usr/share/bash-completion/completions/zramctl", "/usr/share/doc/util-linux/00-about-docs.txt", "/usr/share/doc/util-linux/AUTHORS.gz", "/usr/share/doc/util-linux/NEWS.Debian.gz", "/usr/share/doc/util-linux/PAM-configuration.txt", "/usr/share/doc/util-linux/README.Debian", "/usr/share/doc/util-linux/blkid.txt", "/usr/share/doc/util-linux/cal.txt", "/usr/share/doc/util-linux/changelog.Debian.gz", "/usr/share/doc/util-linux/changelog.gz", "/usr/share/doc/util-linux/col.txt", "/usr/share/doc/util-linux/copyright", "/usr/share/doc/util-linux/deprecated.txt", "/usr/share/doc/util-linux/examples/getopt-example.bash", "/usr/share/doc/util-linux/getopt.txt", "/usr/share/doc/util-linux/getopt_changelog.txt", "/usr/share/doc/util-linux/howto-build-sys.txt", "/usr/share/doc/util-linux/howto-compilation.txt", "/usr/share/doc/util-linux/howto-contribute.txt.gz", "/usr/share/doc/util-linux/howto-debug.txt", "/usr/share/doc/util-linux/howto-man-page.txt", "/usr/share/doc/util-linux/howto-pull-request.txt.gz", "/usr/share/doc/util-linux/howto-tests.txt", "/usr/share/doc/util-linux/howto-usage-function.txt.gz", "/usr/share/doc/util-linux/hwclock.txt", "/usr/share/doc/util-linux/modems-with-agetty.txt", "/usr/share/doc/util-linux/mount.txt", "/usr/share/doc/util-linux/parse-date.txt.gz", "/usr/share/doc/util-linux/pg.txt", "/usr/share/doc/util-linux/poeigl.txt.gz", "/usr/share/doc/util-linux/release-schedule.txt", "/usr/share/doc/util-linux/releases/v2.13-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.14-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.15-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.16-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.17-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.18-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.19-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.20-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.21-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.22-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.23-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.24-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.25-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.26-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.27-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.28-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.29-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.30-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.31-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.32-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.33-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.34-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.35-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.36-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.37-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.38-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.39-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.40-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.41-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.41.1-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.41.2-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.41.3-ReleaseNotes", "/usr/share/doc/util-linux/releases/v2.41.4-ReleaseNotes", "/usr/share/doc/util-linux/releases/v2.41.5-ReleaseNotes", "/usr/share/lintian/overrides/util-linux", "/usr/share/man/man1/choom.1.gz", "/usr/share/man/man1/chrt.1.gz", "/usr/share/man/man1/dmesg.1.gz", "/usr/share/man/man1/fallocate.1.gz", "/usr/share/man/man1/flock.1.gz", "/usr/share/man/man1/getopt.1.gz", "/usr/share/man/man1/hardlink.1.gz", "/usr/share/man/man1/ionice.1.gz", "/usr/share/man/man1/ipcmk.1.gz", "/usr/share/man/man1/ipcrm.1.gz", "/usr/share/man/man1/ipcs.1.gz", "/usr/share/man/man1/lscpu.1.gz", "/usr/share/man/man1/lsipc.1.gz", "/usr/share/man/man1/lslogins.1.gz", "/usr/share/man/man1/lsmem.1.gz", "/usr/share/man/man1/mcookie.1.gz", "/usr/share/man/man1/more.1.gz", "/usr/share/man/man1/mountpoint.1.gz", "/usr/share/man/man1/namei.1.gz", "/usr/share/man/man1/nsenter.1.gz", "/usr/share/man/man1/prlimit.1.gz", "/usr/share/man/man1/rename.ul.1.gz", "/usr/share/man/man1/rev.1.gz", "/usr/share/man/man1/runuser.1.gz", "/usr/share/man/man1/setpriv.1.gz", "/usr/share/man/man1/setsid.1.gz", "/usr/share/man/man1/setterm.1.gz", "/usr/share/man/man1/su.1.gz", "/usr/share/man/man1/taskset.1.gz", "/usr/share/man/man1/uclampset.1.gz", "/usr/share/man/man1/unshare.1.gz", "/usr/share/man/man1/whereis.1.gz", "/usr/share/man/man5/adjtime_config.5.gz", "/usr/share/man/man5/scols-filter.5.gz", "/usr/share/man/man5/terminal-colors.d.5.gz", "/usr/share/man/man8/agetty.8.gz", "/usr/share/man/man8/blkdiscard.8.gz", "/usr/share/man/man8/blkid.8.gz", "/usr/share/man/man8/blkzone.8.gz", "/usr/share/man/man8/blockdev.8.gz", "/usr/share/man/man8/chcpu.8.gz", "/usr/share/man/man8/chmem.8.gz", "/usr/share/man/man8/findfs.8.gz", "/usr/share/man/man8/findmnt.8.gz", "/usr/share/man/man8/fsck.8.gz", "/usr/share/man/man8/fsfreeze.8.gz", "/usr/share/man/man8/fstrim.8.gz", "/usr/share/man/man8/isosize.8.gz", "/usr/share/man/man8/ldattach.8.gz", "/usr/share/man/man8/lsblk.8.gz", "/usr/share/man/man8/lslocks.8.gz", "/usr/share/man/man8/lsns.8.gz", "/usr/share/man/man8/mkfs.8.gz", "/usr/share/man/man8/mkswap.8.gz", "/usr/share/man/man8/partx.8.gz", "/usr/share/man/man8/pivot_root.8.gz", "/usr/share/man/man8/readprofile.8.gz", "/usr/share/man/man8/rtcwake.8.gz", "/usr/share/man/man8/setarch.8.gz", "/usr/share/man/man8/sulogin.8.gz", "/usr/share/man/man8/swaplabel.8.gz", "/usr/share/man/man8/switch_root.8.gz", "/usr/share/man/man8/wdctl.8.gz", "/usr/share/man/man8/wipefs.8.gz", "/usr/share/man/man8/zramctl.8.gz", "/usr/share/util-linux/logcheck/ignore.d.server/util-linux" ], "AnalyzedBy": "dpkg" }, { "ID": "x11-common@1:7.7+24+deb13u1", "Name": "x11-common", "Identifier": { "PURL": "pkg:deb/debian/x11-common@7.7%2B24%2Bdeb13u1?arch=all\u0026distro=debian-13.6\u0026epoch=1", "UID": "821f09237a6368c2" }, "Version": "7.7+24+deb13u1", "Epoch": 1, "Arch": "all", "SrcName": "xorg", "SrcVersion": "7.7+24+deb13u1", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/doc/x11-common/changelog.Debian.old.gz", "/usr/share/doc/x11-common/changelog.gz", "/usr/share/doc/x11-common/copyright", "/usr/share/lintian/overrides/x11-common", "/usr/share/man/man5/Xsession.5.gz", "/usr/share/man/man5/Xsession.options.5.gz", "/usr/share/man/man5/Xsession.options.d.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "xkb-data@2.42-1", "Name": "xkb-data", "Identifier": { "PURL": "pkg:deb/debian/xkb-data@2.42-1?arch=all\u0026distro=debian-13.6", "UID": "d10ac508afd1a768" }, "Version": "2.42", "Release": "1", "Arch": "all", "SrcName": "xkeyboard-config", "SrcVersion": "2.42", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "InstalledFiles": [ "/usr/share/X11/xkb/compat/README", "/usr/share/X11/xkb/compat/accessx", "/usr/share/X11/xkb/compat/basic", "/usr/share/X11/xkb/compat/caps", "/usr/share/X11/xkb/compat/complete", "/usr/share/X11/xkb/compat/grab", "/usr/share/X11/xkb/compat/grp_led", "/usr/share/X11/xkb/compat/iso9995", "/usr/share/X11/xkb/compat/japan", "/usr/share/X11/xkb/compat/ledcaps", "/usr/share/X11/xkb/compat/ledcompose", "/usr/share/X11/xkb/compat/lednum", "/usr/share/X11/xkb/compat/ledscroll", "/usr/share/X11/xkb/compat/level5", "/usr/share/X11/xkb/compat/misc", "/usr/share/X11/xkb/compat/mod_led", "/usr/share/X11/xkb/compat/mousekeys", "/usr/share/X11/xkb/compat/olpc", "/usr/share/X11/xkb/compat/pc", "/usr/share/X11/xkb/compat/pc98", "/usr/share/X11/xkb/compat/xfree86", "/usr/share/X11/xkb/compat/xtest", "/usr/share/X11/xkb/geometry/README", "/usr/share/X11/xkb/geometry/amiga", "/usr/share/X11/xkb/geometry/ataritt", "/usr/share/X11/xkb/geometry/chicony", "/usr/share/X11/xkb/geometry/dell", "/usr/share/X11/xkb/geometry/digital_vndr/lk", "/usr/share/X11/xkb/geometry/digital_vndr/pc", "/usr/share/X11/xkb/geometry/digital_vndr/unix", "/usr/share/X11/xkb/geometry/everex", "/usr/share/X11/xkb/geometry/fujitsu", "/usr/share/X11/xkb/geometry/hhk", "/usr/share/X11/xkb/geometry/hp", "/usr/share/X11/xkb/geometry/keytronic", "/usr/share/X11/xkb/geometry/kinesis", "/usr/share/X11/xkb/geometry/macintosh", "/usr/share/X11/xkb/geometry/microsoft", "/usr/share/X11/xkb/geometry/nec", "/usr/share/X11/xkb/geometry/northgate", "/usr/share/X11/xkb/geometry/pc", "/usr/share/X11/xkb/geometry/sanwa", "/usr/share/X11/xkb/geometry/sgi_vndr/O2", "/usr/share/X11/xkb/geometry/sgi_vndr/indigo", "/usr/share/X11/xkb/geometry/sgi_vndr/indy", "/usr/share/X11/xkb/geometry/sony", "/usr/share/X11/xkb/geometry/steelseries", "/usr/share/X11/xkb/geometry/sun", "/usr/share/X11/xkb/geometry/teck", "/usr/share/X11/xkb/geometry/thinkpad", "/usr/share/X11/xkb/geometry/typematrix", "/usr/share/X11/xkb/geometry/winbook", "/usr/share/X11/xkb/keycodes/README", "/usr/share/X11/xkb/keycodes/aliases", "/usr/share/X11/xkb/keycodes/amiga", "/usr/share/X11/xkb/keycodes/ataritt", "/usr/share/X11/xkb/keycodes/digital_vndr/lk", "/usr/share/X11/xkb/keycodes/digital_vndr/pc", "/usr/share/X11/xkb/keycodes/empty", "/usr/share/X11/xkb/keycodes/evdev", "/usr/share/X11/xkb/keycodes/fujitsu", "/usr/share/X11/xkb/keycodes/hp", "/usr/share/X11/xkb/keycodes/ibm", "/usr/share/X11/xkb/keycodes/jolla", "/usr/share/X11/xkb/keycodes/macintosh", "/usr/share/X11/xkb/keycodes/olpc", "/usr/share/X11/xkb/keycodes/sgi_vndr/indigo", "/usr/share/X11/xkb/keycodes/sgi_vndr/indy", "/usr/share/X11/xkb/keycodes/sgi_vndr/iris", "/usr/share/X11/xkb/keycodes/sony", "/usr/share/X11/xkb/keycodes/sun", "/usr/share/X11/xkb/keycodes/xfree86", "/usr/share/X11/xkb/keycodes/xfree98", "/usr/share/X11/xkb/rules/README", "/usr/share/X11/xkb/rules/base", "/usr/share/X11/xkb/rules/base.extras.xml", "/usr/share/X11/xkb/rules/base.lst", "/usr/share/X11/xkb/rules/base.xml", "/usr/share/X11/xkb/rules/evdev", "/usr/share/X11/xkb/rules/evdev.extras.xml", "/usr/share/X11/xkb/rules/evdev.lst", "/usr/share/X11/xkb/rules/evdev.xml", "/usr/share/X11/xkb/rules/xfree98", "/usr/share/X11/xkb/rules/xkb.dtd", "/usr/share/X11/xkb/symbols/af", "/usr/share/X11/xkb/symbols/al", "/usr/share/X11/xkb/symbols/altwin", "/usr/share/X11/xkb/symbols/am", "/usr/share/X11/xkb/symbols/ancient", "/usr/share/X11/xkb/symbols/apl", "/usr/share/X11/xkb/symbols/ara", "/usr/share/X11/xkb/symbols/at", "/usr/share/X11/xkb/symbols/au", "/usr/share/X11/xkb/symbols/az", "/usr/share/X11/xkb/symbols/ba", "/usr/share/X11/xkb/symbols/bd", "/usr/share/X11/xkb/symbols/be", "/usr/share/X11/xkb/symbols/bg", "/usr/share/X11/xkb/symbols/bqn", "/usr/share/X11/xkb/symbols/br", "/usr/share/X11/xkb/symbols/brai", "/usr/share/X11/xkb/symbols/bt", "/usr/share/X11/xkb/symbols/bw", "/usr/share/X11/xkb/symbols/by", "/usr/share/X11/xkb/symbols/ca", "/usr/share/X11/xkb/symbols/capslock", "/usr/share/X11/xkb/symbols/cd", "/usr/share/X11/xkb/symbols/ch", "/usr/share/X11/xkb/symbols/cm", "/usr/share/X11/xkb/symbols/cn", "/usr/share/X11/xkb/symbols/compose", "/usr/share/X11/xkb/symbols/ctrl", "/usr/share/X11/xkb/symbols/cz", "/usr/share/X11/xkb/symbols/de", "/usr/share/X11/xkb/symbols/digital_vndr/lk", "/usr/share/X11/xkb/symbols/digital_vndr/pc", "/usr/share/X11/xkb/symbols/digital_vndr/us", "/usr/share/X11/xkb/symbols/digital_vndr/vt", "/usr/share/X11/xkb/symbols/dk", "/usr/share/X11/xkb/symbols/dz", "/usr/share/X11/xkb/symbols/ee", "/usr/share/X11/xkb/symbols/eg", "/usr/share/X11/xkb/symbols/empty", "/usr/share/X11/xkb/symbols/epo", "/usr/share/X11/xkb/symbols/es", "/usr/share/X11/xkb/symbols/et", "/usr/share/X11/xkb/symbols/eu", "/usr/share/X11/xkb/symbols/eurosign", "/usr/share/X11/xkb/symbols/fi", "/usr/share/X11/xkb/symbols/fo", "/usr/share/X11/xkb/symbols/fr", "/usr/share/X11/xkb/symbols/fujitsu_vndr/jp", "/usr/share/X11/xkb/symbols/fujitsu_vndr/us", "/usr/share/X11/xkb/symbols/gb", "/usr/share/X11/xkb/symbols/ge", "/usr/share/X11/xkb/symbols/gh", "/usr/share/X11/xkb/symbols/gn", "/usr/share/X11/xkb/symbols/gr", "/usr/share/X11/xkb/symbols/grab", "/usr/share/X11/xkb/symbols/group", "/usr/share/X11/xkb/symbols/hp_vndr/us", "/usr/share/X11/xkb/symbols/hr", "/usr/share/X11/xkb/symbols/hu", "/usr/share/X11/xkb/symbols/id", "/usr/share/X11/xkb/symbols/ie", "/usr/share/X11/xkb/symbols/il", "/usr/share/X11/xkb/symbols/in", "/usr/share/X11/xkb/symbols/inet", "/usr/share/X11/xkb/symbols/iq", "/usr/share/X11/xkb/symbols/ir", "/usr/share/X11/xkb/symbols/is", "/usr/share/X11/xkb/symbols/it", "/usr/share/X11/xkb/symbols/jolla_vndr/sbj", "/usr/share/X11/xkb/symbols/jp", "/usr/share/X11/xkb/symbols/ke", "/usr/share/X11/xkb/symbols/keypad", "/usr/share/X11/xkb/symbols/kg", "/usr/share/X11/xkb/symbols/kh", "/usr/share/X11/xkb/symbols/kpdl", "/usr/share/X11/xkb/symbols/kr", "/usr/share/X11/xkb/symbols/kz", "/usr/share/X11/xkb/symbols/la", "/usr/share/X11/xkb/symbols/latam", "/usr/share/X11/xkb/symbols/latin", "/usr/share/X11/xkb/symbols/level2", "/usr/share/X11/xkb/symbols/level3", "/usr/share/X11/xkb/symbols/level5", "/usr/share/X11/xkb/symbols/lk", "/usr/share/X11/xkb/symbols/lt", "/usr/share/X11/xkb/symbols/lv", "/usr/share/X11/xkb/symbols/ma", "/usr/share/X11/xkb/symbols/macintosh_vndr/apple", "/usr/share/X11/xkb/symbols/macintosh_vndr/ch", "/usr/share/X11/xkb/symbols/macintosh_vndr/de", "/usr/share/X11/xkb/symbols/macintosh_vndr/dk", "/usr/share/X11/xkb/symbols/macintosh_vndr/fi", "/usr/share/X11/xkb/symbols/macintosh_vndr/fr", "/usr/share/X11/xkb/symbols/macintosh_vndr/gb", "/usr/share/X11/xkb/symbols/macintosh_vndr/is", "/usr/share/X11/xkb/symbols/macintosh_vndr/it", "/usr/share/X11/xkb/symbols/macintosh_vndr/jp", "/usr/share/X11/xkb/symbols/macintosh_vndr/latam", "/usr/share/X11/xkb/symbols/macintosh_vndr/nl", "/usr/share/X11/xkb/symbols/macintosh_vndr/no", "/usr/share/X11/xkb/symbols/macintosh_vndr/pt", "/usr/share/X11/xkb/symbols/macintosh_vndr/se", "/usr/share/X11/xkb/symbols/macintosh_vndr/us", "/usr/share/X11/xkb/symbols/md", "/usr/share/X11/xkb/symbols/me", "/usr/share/X11/xkb/symbols/mk", "/usr/share/X11/xkb/symbols/ml", "/usr/share/X11/xkb/symbols/mm", "/usr/share/X11/xkb/symbols/mn", "/usr/share/X11/xkb/symbols/mt", "/usr/share/X11/xkb/symbols/mv", "/usr/share/X11/xkb/symbols/my", "/usr/share/X11/xkb/symbols/nbsp", "/usr/share/X11/xkb/symbols/nec_vndr/jp", "/usr/share/X11/xkb/symbols/ng", "/usr/share/X11/xkb/symbols/nl", "/usr/share/X11/xkb/symbols/no", "/usr/share/X11/xkb/symbols/np", "/usr/share/X11/xkb/symbols/nz", "/usr/share/X11/xkb/symbols/olpc", "/usr/share/X11/xkb/symbols/parens", "/usr/share/X11/xkb/symbols/pc", "/usr/share/X11/xkb/symbols/ph", "/usr/share/X11/xkb/symbols/pk", "/usr/share/X11/xkb/symbols/pl", "/usr/share/X11/xkb/symbols/pt", "/usr/share/X11/xkb/symbols/ro", "/usr/share/X11/xkb/symbols/rs", "/usr/share/X11/xkb/symbols/ru", "/usr/share/X11/xkb/symbols/rupeesign", "/usr/share/X11/xkb/symbols/scrolllock", "/usr/share/X11/xkb/symbols/se", "/usr/share/X11/xkb/symbols/sgi_vndr/jp", "/usr/share/X11/xkb/symbols/sharp_vndr/sl-c3x00", "/usr/share/X11/xkb/symbols/sharp_vndr/ws003sh", "/usr/share/X11/xkb/symbols/sharp_vndr/ws007sh", "/usr/share/X11/xkb/symbols/sharp_vndr/ws011sh", "/usr/share/X11/xkb/symbols/sharp_vndr/ws020sh", "/usr/share/X11/xkb/symbols/shift", "/usr/share/X11/xkb/symbols/si", "/usr/share/X11/xkb/symbols/sk", "/usr/share/X11/xkb/symbols/sn", "/usr/share/X11/xkb/symbols/sony_vndr/us", "/usr/share/X11/xkb/symbols/srvr_ctrl", "/usr/share/X11/xkb/symbols/srvrkeys", "/usr/share/X11/xkb/symbols/sun_vndr/ara", "/usr/share/X11/xkb/symbols/sun_vndr/be", "/usr/share/X11/xkb/symbols/sun_vndr/br", "/usr/share/X11/xkb/symbols/sun_vndr/ca", "/usr/share/X11/xkb/symbols/sun_vndr/ch", "/usr/share/X11/xkb/symbols/sun_vndr/cz", "/usr/share/X11/xkb/symbols/sun_vndr/de", "/usr/share/X11/xkb/symbols/sun_vndr/dk", "/usr/share/X11/xkb/symbols/sun_vndr/ee", "/usr/share/X11/xkb/symbols/sun_vndr/es", "/usr/share/X11/xkb/symbols/sun_vndr/fi", "/usr/share/X11/xkb/symbols/sun_vndr/fr", "/usr/share/X11/xkb/symbols/sun_vndr/gb", "/usr/share/X11/xkb/symbols/sun_vndr/gr", "/usr/share/X11/xkb/symbols/sun_vndr/it", "/usr/share/X11/xkb/symbols/sun_vndr/jp", "/usr/share/X11/xkb/symbols/sun_vndr/kr", "/usr/share/X11/xkb/symbols/sun_vndr/lt", "/usr/share/X11/xkb/symbols/sun_vndr/lv", "/usr/share/X11/xkb/symbols/sun_vndr/nl", "/usr/share/X11/xkb/symbols/sun_vndr/no", "/usr/share/X11/xkb/symbols/sun_vndr/pl", "/usr/share/X11/xkb/symbols/sun_vndr/pt", "/usr/share/X11/xkb/symbols/sun_vndr/ro", "/usr/share/X11/xkb/symbols/sun_vndr/ru", "/usr/share/X11/xkb/symbols/sun_vndr/se", "/usr/share/X11/xkb/symbols/sun_vndr/sk", "/usr/share/X11/xkb/symbols/sun_vndr/solaris", "/usr/share/X11/xkb/symbols/sun_vndr/tr", "/usr/share/X11/xkb/symbols/sun_vndr/tw", "/usr/share/X11/xkb/symbols/sun_vndr/ua", "/usr/share/X11/xkb/symbols/sun_vndr/us", "/usr/share/X11/xkb/symbols/sy", "/usr/share/X11/xkb/symbols/terminate", "/usr/share/X11/xkb/symbols/tg", "/usr/share/X11/xkb/symbols/th", "/usr/share/X11/xkb/symbols/tj", "/usr/share/X11/xkb/symbols/tm", "/usr/share/X11/xkb/symbols/tr", "/usr/share/X11/xkb/symbols/trans", "/usr/share/X11/xkb/symbols/tw", "/usr/share/X11/xkb/symbols/typo", "/usr/share/X11/xkb/symbols/tz", "/usr/share/X11/xkb/symbols/ua", "/usr/share/X11/xkb/symbols/us", "/usr/share/X11/xkb/symbols/uz", "/usr/share/X11/xkb/symbols/vn", "/usr/share/X11/xkb/symbols/xfree68_vndr/amiga", "/usr/share/X11/xkb/symbols/xfree68_vndr/ataritt", "/usr/share/X11/xkb/symbols/za", "/usr/share/X11/xkb/types/README", "/usr/share/X11/xkb/types/basic", "/usr/share/X11/xkb/types/cancel", "/usr/share/X11/xkb/types/caps", "/usr/share/X11/xkb/types/complete", "/usr/share/X11/xkb/types/default", "/usr/share/X11/xkb/types/extra", "/usr/share/X11/xkb/types/iso9995", "/usr/share/X11/xkb/types/level5", "/usr/share/X11/xkb/types/mousekeys", "/usr/share/X11/xkb/types/numpad", "/usr/share/X11/xkb/types/pc", "/usr/share/doc/xkb-data/NEWS.Debian.gz", "/usr/share/doc/xkb-data/README.Debian", "/usr/share/doc/xkb-data/changelog.Debian.gz", "/usr/share/doc/xkb-data/changelog.gz", "/usr/share/doc/xkb-data/copyright", "/usr/share/locale/af/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ar/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/az/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/bg/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ca/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/crh/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/cs/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/da/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/de/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/el/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/en_GB/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/eo/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/es/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/fi/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/fr/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/fur/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/gl/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/he/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/hr/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/hu/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/id/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/it/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ja/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ka/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ko/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ky/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/lt/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/nb/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/nl/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/pl/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/pt/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ro/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ru/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/rw/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sk/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sl/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sq/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sr/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sv/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/tr/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/uk/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/vi/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/man/man7/xkeyboard-config.7.gz", "/usr/share/pkgconfig/xkeyboard-config.pc" ], "AnalyzedBy": "dpkg" }, { "ID": "zlib1g@1:1.3.dfsg+really1.3.1-1+b1", "Name": "zlib1g", "Identifier": { "PURL": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "ff182eb2a26a8142" }, "Version": "1.3.dfsg+really1.3.1", "Release": "1+b1", "Epoch": 1, "Arch": "amd64", "SrcName": "zlib", "SrcVersion": "1.3.dfsg+really1.3.1", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "Zlib" ], "Maintainer": "Mark Brown \u003cbroonie@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.41-12+deb13u3" ], "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libz.so.1.3.1", "/usr/share/doc/zlib1g/changelog.Debian.amd64.gz", "/usr/share/doc/zlib1g/changelog.Debian.gz", "/usr/share/doc/zlib1g/changelog.gz", "/usr/share/doc/zlib1g/copyright" ], "AnalyzedBy": "dpkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-109518", "VendorIDs": [ "DSA-6607-1" ], "PkgID": "apt@3.0.3", "PkgName": "apt", "PkgIdentifier": { "PURL": "pkg:deb/debian/apt@3.0.3?arch=amd64\u0026distro=debian-13.6", "UID": "1c5db4816123219d" }, "InstalledVersion": "3.0.3", "FixedVersion": "3.0.4", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109518", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d77e5e94f17391b1e372824911548a5e50231536911ef0a1df41dd11c5fd2ec6", "Title": "apt: apt: Remote code execution via hard link reuse during package download retries", "Description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration", "Severity": "HIGH", "CweIDs": [ "CWE-62", "CWE-367" ], "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/11/04/12", "https://access.redhat.com/security/cve/CVE-2026-109518", "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html", "https://lists.debian.org/debian-security-announce/2026/msg00526.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109518", "https://ubuntu.com/blog/apt-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8996-1", "https://www.cve.org/CVERecord?id=CVE-2026-109518" ], "PublishedDate": "2026-11-04T16:17:33.01Z", "LastModifiedDate": "2026-11-05T05:18:19.033Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "bsdutils@1:2.41.5-0+deb13u1", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "a4b47561565a3535" }, "InstalledVersion": "1:2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cfdcc848f325e9046b04684232e05a215a670adc83e7c040aab80b9d5279b22d", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "bsdutils@1:2.41.5-0+deb13u1", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "a4b47561565a3535" }, "InstalledVersion": "1:2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:db70a995ad2c763189bbddf454413da2755ea6c838974c40d378f7ae8529480d", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "bsdutils@1:2.41.5-0+deb13u1", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "a4b47561565a3535" }, "InstalledVersion": "1:2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1c483c951a4df82fd53909c8b1fdd27fdb1273412c44c3efee64be19387d89a3", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "bsdutils@1:2.41.5-0+deb13u1", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "a4b47561565a3535" }, "InstalledVersion": "1:2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0dd3b79f06b699a7effd3f11d72cc3a00fe1fcc3a9245b68b8efb830648d2528", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "curl@8.14.1-2+deb13u5", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "bdf93d017278ebe4" }, "InstalledVersion": "8.14.1-2+deb13u5", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd568db13eeb9655207abba4771afdcf958f3ce64108d43c2a17202d7535f555", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-8286", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "curl@8.14.1-2+deb13u5", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "bdf93d017278ebe4" }, "InstalledVersion": "8.14.1-2+deb13u5", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:853b9e060756d6fd63a1c87c5340ddf181a19f42df88d73bcf90b6703790d108", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "curl@8.14.1-2+deb13u5", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "bdf93d017278ebe4" }, "InstalledVersion": "8.14.1-2+deb13u5", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fa41b8ca8dcb784062d8420f8e7f3978461bc57dd31d84a8e4fafe1403c774a9", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8927", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "curl@8.14.1-2+deb13u5", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "bdf93d017278ebe4" }, "InstalledVersion": "8.14.1-2+deb13u5", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b0e04aff4d19e864eab5664ec10ad1bf690a6e378d565e50a040be788051ee8f", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "curl@8.14.1-2+deb13u5", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "bdf93d017278ebe4" }, "InstalledVersion": "8.14.1-2+deb13u5", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4dee4432441ce6f858bb827393be17b94d29041efc29ff1988141c828910a78f", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:09e86d5f1117f1bfee49bbbe27fabb72bfa6abb94f3627d2c9b5ed50ed9b41cc", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.6, "V40Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/errata/RHSA-2026:51180", "https://access.redhat.com/errata/RHSA-2026:52832", "https://access.redhat.com/errata/RHSA-2026:52833", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61627", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:61629", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/advisories/GHSA-mjxr-6gqf-w78h", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://ubuntu.com/security/notices/USN-8750-1", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-09-01T13:19:51.89Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4c68b528b5453cc38a81a5f764fe2f9e4804cb9c8f9d09ea83d806bfaed37df7", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64830", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://github.com/advisories/GHSA-jphx-q7f7-4x8r", "https://nvd.nist.gov/vuln/detail/CVE-2026-64830", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64830", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:acd0cb256b3175ba4e386bdeda3faa35b2828d168f8e9a86862c5300c2cad052", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video file in NVDEC hardware decoder", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64832", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://github.com/advisories/GHSA-jc8j-9799-c943", "https://nvd.nist.gov/vuln/detail/CVE-2026-64832", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64832", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:44252b7515d9d33141a4b58ff94f707f81f2a3011db98cc53444874d7c02fc3e", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in S/PDIF muxer", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.1, "V40Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64833", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://github.com/advisories/GHSA-34g6-m4cp-w5c9", "https://nvd.nist.gov/vuln/detail/CVE-2026-64833", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64833", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8d7c0b17c97c79064b08e717ae96d7caa84eb67a24834118d6a99b00657eed33", "Title": "FFmpeg: Denial of Service via crafted RTP/ASF stream", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64834", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://github.com/advisories/GHSA-5xcx-3qx2-qv4x", "https://nvd.nist.gov/vuln/detail/CVE-2026-64834", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64834", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bfe34bfcc5a9f2a2419d4ef7d6b4a2bf2e9cfbc526f6380a8168589a6fb16159", "Title": "FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64835", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://github.com/advisories/GHSA-p2v8-4c4f-rwpq", "https://nvd.nist.gov/vuln/detail/CVE-2026-64835", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64835", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a5ca2c05a88f8b2cd7ed0c16f4e12fe813243b3d26fbfcfcf0bff1779ed4f59d", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66036", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://github.com/advisories/GHSA-575m-jfmw-q76c", "https://nvd.nist.gov/vuln/detail/CVE-2026-66036", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66036", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-08-07T01:05:17.87Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:091c6a8036484cbebc7fd62dc2f7c30a5acbdc418e002b1e04faeb4796cc3fe7", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-190" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66039", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://github.com/advisories/GHSA-84qc-6h9r-4w33", "https://nvd.nist.gov/vuln/detail/CVE-2026-66039", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66039", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-08-07T00:46:17.303Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:83c4fa28f7215d21ae221173d5077872fb31e65eb06330d4374ee3699180212c", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PNG image", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66040", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://github.com/advisories/GHSA-6vcg-882j-82v5", "https://nvd.nist.gov/vuln/detail/CVE-2026-66040", "https://www.cve.org/CVERecord?id=CVE-2026-66040", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-08-07T00:35:29.773Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4e296be7fba1781e212a3f89b4cca19ba856562990cdad518fd095d8e564169f", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PGS/SUP subtitle file", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66041", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://github.com/advisories/GHSA-frhp-m687-9g3q", "https://nvd.nist.gov/vuln/detail/CVE-2026-66041", "https://www.cve.org/CVERecord?id=CVE-2026-66041", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-70628", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70628", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d9dea3f559a8284536304bbb519f1f70a12ba863139a083bb4c8cced5de07800", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser", "Description": "FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70628", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897", "https://github.com/advisories/GHSA-qw9h-2hhv-hpfr", "https://nvd.nist.gov/vuln/detail/CVE-2026-70628", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70628", "https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file" ], "PublishedDate": "2026-08-06T22:18:26.957Z", "LastModifiedDate": "2026-09-01T15:36:28.407Z" }, { "VulnerabilityID": "CVE-2026-70632", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70632", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dbb36ddd76aa6518b1d0c038e1a92447d76966de6f839688134a333adf132813", "Title": "ffmpeg: FFmpeg: Arbitrary Code Execution in CFHD Decoder via Crafted AVI File", "Description": "FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898", "https://github.com/advisories/GHSA-q24x-99v6-6hxc", "https://nvd.nist.gov/vuln/detail/CVE-2026-70632", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70632", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing" ], "PublishedDate": "2026-08-06T22:18:27.567Z", "LastModifiedDate": "2026-09-01T15:32:31.087Z" }, { "VulnerabilityID": "CVE-2026-75141", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd802ad9fb41420046ec78d5f7cc5a8812e9071bec901118795cb92f32f1093b", "Title": "ffmpeg: FFmpeg: Heap buffer overflow via crafted HEVC input file during muxing", "Description": "FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75141", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088", "https://nvd.nist.gov/vuln/detail/CVE-2026-75141", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75141", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing" ], "PublishedDate": "2026-08-19T17:21:12.287Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75142", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75142", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:272d44a19b0a9cbd094fe69790ec8a981595e093291a447ae12e46626a9f9476", "Title": "ffmpeg: FFmpeg: Stack Buffer Overflow in MPEG-PS Muxer", "Description": "FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75142", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087", "https://nvd.nist.gov/vuln/detail/CVE-2026-75142", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75142", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c" ], "PublishedDate": "2026-08-19T17:21:12.437Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75143", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c492e49ad23a1dafc236c8ef1c87e2fc1473965b004fb3ea5464f32be7d1f4c6", "Title": "ffmpeg: FFmpeg Heap Buffer Overflow via RIST Protocol Reader", "Description": "FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75143", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089", "https://nvd.nist.gov/vuln/detail/CVE-2026-75143", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75143", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader" ], "PublishedDate": "2026-08-19T17:21:12.577Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75144", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cfa998bb21d68f586d6c2d84eb57a6128b99842c7db6c9528af7e9684d7b0d8d", "Title": "ffmpeg: FFmpeg: Memory corruption via crafted Dirac data unit", "Description": "FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75144", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091", "https://nvd.nist.gov/vuln/detail/CVE-2026-75144", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75144", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer" ], "PublishedDate": "2026-08-19T17:21:12.72Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75146", "PkgID": "ffmpeg@7:7.1.5-0+deb13u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "31d1727f8d79b874" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75146", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0cd8814d6f18263193745f6c836d94980ec77cf9de5eb0eb031373de15a42311", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer", "Description": "FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75146", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093", "https://nvd.nist.gov/vuln/detail/CVE-2026-75146", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75146", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c" ], "PublishedDate": "2026-08-19T17:21:13.057Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-41992", "PkgID": "gzip@1.13-1", "PkgName": "gzip", "PkgIdentifier": { "PURL": "pkg:deb/debian/gzip@1.13-1?arch=amd64\u0026distro=debian-13.6", "UID": "954545ce99bc687e" }, "InstalledVersion": "1.13-1", "FixedVersion": "1.13-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41992", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:48855a156d7161b53fccff9e79ff25a0b6b527f571bb6405546691759b048743", "Title": "gzip: gzip: Information disclosure via global buffer overflow in LZH decompression", "Description": "GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "alma": 2, "azure": 2, "julia": 2, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 1, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 6.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "V3Score": 3.6 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/23/1", "http://www.openwall.com/lists/oss-security/2026/08/25/1", "http://www.openwall.com/lists/oss-security/2026/08/27/2", "https://access.redhat.com/errata/RHSA-2026:61623", "https://access.redhat.com/security/cve/CVE-2026-41992", "https://bugzilla.redhat.com/2494158", "https://bugzilla.redhat.com/show_bug.cgi?id=2494158", "https://bugzilla.redhat.com/show_bug.cgi?id=2494159", "https://cert.pl/en/posts/2026/04/CVE-2026-41991", "https://cert.pl/en/posts/2026/04/CVE-2026-41991/", "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681", "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41992", "https://errata.almalinux.org/9/ALSA-2026-61623.html", "https://errata.rockylinux.org/RLSA-2026:61623", "https://github.com/advisories/GHSA-qxh4-rprf-2mmj", "https://linux.oracle.com/cve/CVE-2026-41992.html", "https://linux.oracle.com/errata/ELSA-2026-65998-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-41992", "https://ubuntu.com/security/notices/USN-8512-1", "https://ubuntu.com/security/notices/USN-8733-1", "https://ubuntu.com/security/notices/USN-8733-2", "https://www.cve.org/CVERecord?id=CVE-2026-41992", "https://www.gnu.org/software/gzip", "https://www.gnu.org/software/gzip/" ], "PublishedDate": "2026-06-29T12:16:29.94Z", "LastModifiedDate": "2026-10-25T21:10:00.77Z" }, { "VulnerabilityID": "CVE-2026-54369", "PkgID": "libacl1@2.3.2-2+b1", "PkgName": "libacl1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64\u0026distro=debian-13.6", "UID": "f9f7789d147b9636" }, "InstalledVersion": "2.3.2-2+b1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:60f2b61edd20c2cddc2edc958606cc71e82decd268099cad6cd40bd4d31c4dab", "Title": "acl: Symlink traversal privilege escalation via libacl functions", "Description": "acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34351", "https://access.redhat.com/errata/RHSA-2026:42736", "https://access.redhat.com/errata/RHSA-2026:42739", "https://access.redhat.com/errata/RHSA-2026:43420", "https://access.redhat.com/errata/RHSA-2026:44481", "https://access.redhat.com/errata/RHSA-2026:46836", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:53371", "https://access.redhat.com/errata/RHSA-2026:54769", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:64805", "https://access.redhat.com/errata/RHSA-2026:67140", "https://access.redhat.com/errata/RHSA-2026:67142", "https://access.redhat.com/errata/RHSA-2026:67144", "https://access.redhat.com/security/cve/CVE-2026-54369", "https://bugzilla.redhat.com/2490277", "https://bugzilla.redhat.com/2490279", "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "https://bugzilla.redhat.com/show_bug.cgi?id=2490279", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54370", "https://errata.almalinux.org/9/ALSA-2026-42736.html", "https://errata.rockylinux.org/RLSA-2026:42736", "https://linux.oracle.com/cve/CVE-2026-54369.html", "https://linux.oracle.com/errata/ELSA-2026-43420.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54369", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "https://www.cve.org/CVERecord?id=CVE-2026-54369", "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" ], "PublishedDate": "2026-06-29T14:16:57.487Z", "LastModifiedDate": "2026-10-25T21:10:00.77Z" }, { "VulnerabilityID": "CVE-2026-109518", "VendorIDs": [ "DSA-6607-1" ], "PkgID": "libapt-pkg7.0@3.0.3", "PkgName": "libapt-pkg7.0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libapt-pkg7.0@3.0.3?arch=amd64\u0026distro=debian-13.6", "UID": "f84404f3bc23d874" }, "InstalledVersion": "3.0.3", "FixedVersion": "3.0.4", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109518", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9d0cf6714282de29b22fa3d03e5b87a14c11a168b912026ec71c85b228f738cf", "Title": "apt: apt: Remote code execution via hard link reuse during package download retries", "Description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration", "Severity": "HIGH", "CweIDs": [ "CWE-62", "CWE-367" ], "VendorSeverity": { "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/11/04/12", "https://access.redhat.com/security/cve/CVE-2026-109518", "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html", "https://lists.debian.org/debian-security-announce/2026/msg00526.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109518", "https://ubuntu.com/blog/apt-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8996-1", "https://www.cve.org/CVERecord?id=CVE-2026-109518" ], "PublishedDate": "2026-11-04T16:17:33.01Z", "LastModifiedDate": "2026-11-05T05:18:19.033Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9ccee58d2f0598d6a5fae519fc7d9e5ee3bbe60107309b71742bb64bde026e52", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.6, "V40Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/errata/RHSA-2026:51180", "https://access.redhat.com/errata/RHSA-2026:52832", "https://access.redhat.com/errata/RHSA-2026:52833", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61627", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:61629", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/advisories/GHSA-mjxr-6gqf-w78h", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://ubuntu.com/security/notices/USN-8750-1", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-09-01T13:19:51.89Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b7272d0f62da6ed47abf3f961862ef98e8fee64c5d00a9d6528ea5b92ee3d5c", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64830", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://github.com/advisories/GHSA-jphx-q7f7-4x8r", "https://nvd.nist.gov/vuln/detail/CVE-2026-64830", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64830", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e0d96a3e9dc6997d5cce11e7d8a4b8870a652eda5de6d655c69684a2d91985c7", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video file in NVDEC hardware decoder", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64832", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://github.com/advisories/GHSA-jc8j-9799-c943", "https://nvd.nist.gov/vuln/detail/CVE-2026-64832", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64832", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d8a922cfc6a7813c1a919b11c78d31bc85f7f19162d70af6064bd7a8c127ab0d", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in S/PDIF muxer", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.1, "V40Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64833", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://github.com/advisories/GHSA-34g6-m4cp-w5c9", "https://nvd.nist.gov/vuln/detail/CVE-2026-64833", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64833", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d1be3c441455882a6281dabae074b438a731d7cc03e1d291727b28dccfbaf435", "Title": "FFmpeg: Denial of Service via crafted RTP/ASF stream", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64834", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://github.com/advisories/GHSA-5xcx-3qx2-qv4x", "https://nvd.nist.gov/vuln/detail/CVE-2026-64834", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64834", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1f300b0a799d5ba48c05d8fde8c337ce588872aacc116dec4f2114650619e14e", "Title": "FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64835", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://github.com/advisories/GHSA-p2v8-4c4f-rwpq", "https://nvd.nist.gov/vuln/detail/CVE-2026-64835", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64835", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1ccf4c4fff7f4e1a62d9f04b28023e06bb75c878f71b2dd09e1e02a5bd6f35a2", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66036", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://github.com/advisories/GHSA-575m-jfmw-q76c", "https://nvd.nist.gov/vuln/detail/CVE-2026-66036", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66036", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-08-07T01:05:17.87Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fdd295bddb854d91125c5ff5b4c58916ccfa4667dfff15c35c9e6c4d6722acf3", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-190" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66039", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://github.com/advisories/GHSA-84qc-6h9r-4w33", "https://nvd.nist.gov/vuln/detail/CVE-2026-66039", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66039", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-08-07T00:46:17.303Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4874a94043f81178043a1845162e0fd71df4c55f1f7099eb1f1e7892730dd58d", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PNG image", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66040", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://github.com/advisories/GHSA-6vcg-882j-82v5", "https://nvd.nist.gov/vuln/detail/CVE-2026-66040", "https://www.cve.org/CVERecord?id=CVE-2026-66040", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-08-07T00:35:29.773Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3d1920bf8a43987194c1685c01cd491f04467826176090afb9989d2116b2c28b", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PGS/SUP subtitle file", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66041", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://github.com/advisories/GHSA-frhp-m687-9g3q", "https://nvd.nist.gov/vuln/detail/CVE-2026-66041", "https://www.cve.org/CVERecord?id=CVE-2026-66041", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-70628", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70628", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:36f22d621605f0e2dde996c34c12e2301361416f8420f53134af3ea6e37b0cd3", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser", "Description": "FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70628", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897", "https://github.com/advisories/GHSA-qw9h-2hhv-hpfr", "https://nvd.nist.gov/vuln/detail/CVE-2026-70628", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70628", "https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file" ], "PublishedDate": "2026-08-06T22:18:26.957Z", "LastModifiedDate": "2026-09-01T15:36:28.407Z" }, { "VulnerabilityID": "CVE-2026-70632", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70632", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8c3ef078781e55cf85b55028cca51841cc8a0ba2eaf8544e65c030040cc260bd", "Title": "ffmpeg: FFmpeg: Arbitrary Code Execution in CFHD Decoder via Crafted AVI File", "Description": "FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898", "https://github.com/advisories/GHSA-q24x-99v6-6hxc", "https://nvd.nist.gov/vuln/detail/CVE-2026-70632", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70632", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing" ], "PublishedDate": "2026-08-06T22:18:27.567Z", "LastModifiedDate": "2026-09-01T15:32:31.087Z" }, { "VulnerabilityID": "CVE-2026-75141", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b1626752136a0ea09c6afaac959ff13083a44a54b91cfeb4f03425d76aee571d", "Title": "ffmpeg: FFmpeg: Heap buffer overflow via crafted HEVC input file during muxing", "Description": "FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75141", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088", "https://nvd.nist.gov/vuln/detail/CVE-2026-75141", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75141", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing" ], "PublishedDate": "2026-08-19T17:21:12.287Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75142", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75142", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:47f9b21aab981f9d772bb9fe8e76dbc9e9a9e1cc14b3273ab288446747ee0790", "Title": "ffmpeg: FFmpeg: Stack Buffer Overflow in MPEG-PS Muxer", "Description": "FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75142", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087", "https://nvd.nist.gov/vuln/detail/CVE-2026-75142", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75142", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c" ], "PublishedDate": "2026-08-19T17:21:12.437Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75143", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c05adb8ec863ed3beed889aa70b44d3b61a00002d021a044c032c8d857053e6", "Title": "ffmpeg: FFmpeg Heap Buffer Overflow via RIST Protocol Reader", "Description": "FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75143", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089", "https://nvd.nist.gov/vuln/detail/CVE-2026-75143", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75143", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader" ], "PublishedDate": "2026-08-19T17:21:12.577Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75144", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ed4b4fe1788e7074db8dd1d5d4da3dfa8d713c9ca739dbde535914dc9ba36ac8", "Title": "ffmpeg: FFmpeg: Memory corruption via crafted Dirac data unit", "Description": "FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75144", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091", "https://nvd.nist.gov/vuln/detail/CVE-2026-75144", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75144", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer" ], "PublishedDate": "2026-08-19T17:21:12.72Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75146", "PkgID": "libavcodec61@7:7.1.5-0+deb13u1", "PkgName": "libavcodec61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "f9c43fe42cd53c74" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75146", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2baa2c776df4dc771c1d75c81f1b6b1e0c126e080f8168ef0fb776c32ce53f85", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer", "Description": "FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75146", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093", "https://nvd.nist.gov/vuln/detail/CVE-2026-75146", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75146", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c" ], "PublishedDate": "2026-08-19T17:21:13.057Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6e2de24629dc15c66809c2b6f96352f96b4525a2921bcd9082b6d3617a08690a", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.6, "V40Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/errata/RHSA-2026:51180", "https://access.redhat.com/errata/RHSA-2026:52832", "https://access.redhat.com/errata/RHSA-2026:52833", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61627", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:61629", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/advisories/GHSA-mjxr-6gqf-w78h", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://ubuntu.com/security/notices/USN-8750-1", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-09-01T13:19:51.89Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ad4e302bfaedc426f2a1270ba3ab70802c33a40571c574ad8ffeb5fb7f7d4e22", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64830", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://github.com/advisories/GHSA-jphx-q7f7-4x8r", "https://nvd.nist.gov/vuln/detail/CVE-2026-64830", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64830", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:87c0260ac1579b1aeb296f8a45176752e659c049e5b54ca91f105da99674a6d7", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video file in NVDEC hardware decoder", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64832", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://github.com/advisories/GHSA-jc8j-9799-c943", "https://nvd.nist.gov/vuln/detail/CVE-2026-64832", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64832", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ffaaf9b5f2e4d3da8b03bd103b4a9c68038897f975ef5956447b9e66ea773f1d", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in S/PDIF muxer", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.1, "V40Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64833", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://github.com/advisories/GHSA-34g6-m4cp-w5c9", "https://nvd.nist.gov/vuln/detail/CVE-2026-64833", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64833", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cdee2c039edf4f512a66ae2cb30caf0ba12531325a92ff680fbf47a6495d8e8d", "Title": "FFmpeg: Denial of Service via crafted RTP/ASF stream", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64834", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://github.com/advisories/GHSA-5xcx-3qx2-qv4x", "https://nvd.nist.gov/vuln/detail/CVE-2026-64834", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64834", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c1be2cac4939f8bf0ed36b5dc57df16245100413f9c02950b7a0bc4880dba95e", "Title": "FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64835", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://github.com/advisories/GHSA-p2v8-4c4f-rwpq", "https://nvd.nist.gov/vuln/detail/CVE-2026-64835", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64835", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:09b0281ae94fa49a6c1046c0fbc4e59906f02c3af976579f30ce1bbcd27fe6db", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66036", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://github.com/advisories/GHSA-575m-jfmw-q76c", "https://nvd.nist.gov/vuln/detail/CVE-2026-66036", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66036", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-08-07T01:05:17.87Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e5d51b8c075932ceb865ecc24bd163058257ddb3b3921403c30ff46191b01796", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-190" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66039", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://github.com/advisories/GHSA-84qc-6h9r-4w33", "https://nvd.nist.gov/vuln/detail/CVE-2026-66039", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66039", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-08-07T00:46:17.303Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:461a70ceba948cac5eb8f9d6f8869cec2fe97cb0e0e0bce8539d574c6451ce57", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PNG image", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66040", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://github.com/advisories/GHSA-6vcg-882j-82v5", "https://nvd.nist.gov/vuln/detail/CVE-2026-66040", "https://www.cve.org/CVERecord?id=CVE-2026-66040", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-08-07T00:35:29.773Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:132c4f07b4585c1d1d266ff0081ece1482fa1ad302683fb27058b94c8364d032", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PGS/SUP subtitle file", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66041", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://github.com/advisories/GHSA-frhp-m687-9g3q", "https://nvd.nist.gov/vuln/detail/CVE-2026-66041", "https://www.cve.org/CVERecord?id=CVE-2026-66041", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-70628", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70628", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd8efb4b05908cd5033e6a5694c15ba6115e2c1bb601805b785e8573c0dd0623", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser", "Description": "FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70628", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897", "https://github.com/advisories/GHSA-qw9h-2hhv-hpfr", "https://nvd.nist.gov/vuln/detail/CVE-2026-70628", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70628", "https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file" ], "PublishedDate": "2026-08-06T22:18:26.957Z", "LastModifiedDate": "2026-09-01T15:36:28.407Z" }, { "VulnerabilityID": "CVE-2026-70632", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70632", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f7332ae010aed40fa2e49775eab541416a173ed318a2ccc5bd66eeff562a1ef8", "Title": "ffmpeg: FFmpeg: Arbitrary Code Execution in CFHD Decoder via Crafted AVI File", "Description": "FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898", "https://github.com/advisories/GHSA-q24x-99v6-6hxc", "https://nvd.nist.gov/vuln/detail/CVE-2026-70632", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70632", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing" ], "PublishedDate": "2026-08-06T22:18:27.567Z", "LastModifiedDate": "2026-09-01T15:32:31.087Z" }, { "VulnerabilityID": "CVE-2026-75141", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a6c3b6b632cc5e76eaea878c8e59a0393cabc80459474f8c50ca1ee6a5321641", "Title": "ffmpeg: FFmpeg: Heap buffer overflow via crafted HEVC input file during muxing", "Description": "FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75141", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088", "https://nvd.nist.gov/vuln/detail/CVE-2026-75141", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75141", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing" ], "PublishedDate": "2026-08-19T17:21:12.287Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75142", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75142", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4af96921bdf92837e67600dcaff38c76336023d21fe86a293c93c7161e4c0719", "Title": "ffmpeg: FFmpeg: Stack Buffer Overflow in MPEG-PS Muxer", "Description": "FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75142", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087", "https://nvd.nist.gov/vuln/detail/CVE-2026-75142", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75142", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c" ], "PublishedDate": "2026-08-19T17:21:12.437Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75143", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3d1847adcb8d382c9a428a2fb28fa6cb1fe06fa018b712613cbd81dfb56fd32a", "Title": "ffmpeg: FFmpeg Heap Buffer Overflow via RIST Protocol Reader", "Description": "FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75143", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089", "https://nvd.nist.gov/vuln/detail/CVE-2026-75143", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75143", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader" ], "PublishedDate": "2026-08-19T17:21:12.577Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75144", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c4d6c9fad8b359b399e13d1459d2870b9a74eac9a8b5bfd3eaf26f11961d2761", "Title": "ffmpeg: FFmpeg: Memory corruption via crafted Dirac data unit", "Description": "FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75144", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091", "https://nvd.nist.gov/vuln/detail/CVE-2026-75144", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75144", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer" ], "PublishedDate": "2026-08-19T17:21:12.72Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75146", "PkgID": "libavdevice61@7:7.1.5-0+deb13u1", "PkgName": "libavdevice61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "c50a6d3d2818a678" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75146", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eb56ef6610e04e60e87a5804adc44645bbe2f1994cf51fad9557fb77976daca4", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer", "Description": "FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75146", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093", "https://nvd.nist.gov/vuln/detail/CVE-2026-75146", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75146", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c" ], "PublishedDate": "2026-08-19T17:21:13.057Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7d8cc6536beea250d84216b4ef51c4649c0027f04f454a32d826fb46ed12ea20", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.6, "V40Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/errata/RHSA-2026:51180", "https://access.redhat.com/errata/RHSA-2026:52832", "https://access.redhat.com/errata/RHSA-2026:52833", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61627", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:61629", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/advisories/GHSA-mjxr-6gqf-w78h", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://ubuntu.com/security/notices/USN-8750-1", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-09-01T13:19:51.89Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:147f826cdfadf8ac3d5e002a7e5c5c3c1f856f21b271b3098399dd20460f61a5", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64830", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://github.com/advisories/GHSA-jphx-q7f7-4x8r", "https://nvd.nist.gov/vuln/detail/CVE-2026-64830", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64830", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:92ddc31e73d8a4cc01cd11938732d50f5706a54e36f9dda161445577b9e74f15", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video file in NVDEC hardware decoder", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64832", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://github.com/advisories/GHSA-jc8j-9799-c943", "https://nvd.nist.gov/vuln/detail/CVE-2026-64832", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64832", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:78e3bfc27901e0037f4b7e2bd41d710f62a66c4499a3fb1449d49c1d329e3232", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in S/PDIF muxer", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.1, "V40Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64833", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://github.com/advisories/GHSA-34g6-m4cp-w5c9", "https://nvd.nist.gov/vuln/detail/CVE-2026-64833", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64833", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ffa7acb280565ba9d512f3361faff9f39262d882487710727802339a4a9e96bf", "Title": "FFmpeg: Denial of Service via crafted RTP/ASF stream", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64834", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://github.com/advisories/GHSA-5xcx-3qx2-qv4x", "https://nvd.nist.gov/vuln/detail/CVE-2026-64834", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64834", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b37afc80258c54a032e20f52bcf089e17cf140a143512e68b2ca89b0d2e31eea", "Title": "FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64835", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://github.com/advisories/GHSA-p2v8-4c4f-rwpq", "https://nvd.nist.gov/vuln/detail/CVE-2026-64835", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64835", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:245b35baa4ec32ff06729ffaf83c15705f6d7a057db2d4f6789a090ecc6b716f", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66036", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://github.com/advisories/GHSA-575m-jfmw-q76c", "https://nvd.nist.gov/vuln/detail/CVE-2026-66036", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66036", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-08-07T01:05:17.87Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5675d7c1320620d95e77cfdad2ad9d05080f49bc6436f164b7bb4bb06b89003f", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-190" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66039", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://github.com/advisories/GHSA-84qc-6h9r-4w33", "https://nvd.nist.gov/vuln/detail/CVE-2026-66039", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66039", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-08-07T00:46:17.303Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5af83539bf3052d3d6de5bd8e8818e9dc05894337c8e8ac871a07b8143dc345f", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PNG image", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66040", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://github.com/advisories/GHSA-6vcg-882j-82v5", "https://nvd.nist.gov/vuln/detail/CVE-2026-66040", "https://www.cve.org/CVERecord?id=CVE-2026-66040", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-08-07T00:35:29.773Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f2b643956ab36a0dc45e738befe89a7de8f03df6cd23a8994ff1c4383a243621", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PGS/SUP subtitle file", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66041", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://github.com/advisories/GHSA-frhp-m687-9g3q", "https://nvd.nist.gov/vuln/detail/CVE-2026-66041", "https://www.cve.org/CVERecord?id=CVE-2026-66041", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-70628", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70628", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d0b279cc5d8826a09812194b01698811c4e2fb03d5dad51688bb9ec52673e923", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser", "Description": "FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70628", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897", "https://github.com/advisories/GHSA-qw9h-2hhv-hpfr", "https://nvd.nist.gov/vuln/detail/CVE-2026-70628", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70628", "https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file" ], "PublishedDate": "2026-08-06T22:18:26.957Z", "LastModifiedDate": "2026-09-01T15:36:28.407Z" }, { "VulnerabilityID": "CVE-2026-70632", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70632", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:467664db33da5ce7be741583f42068a90693aa9ab4cd1507765ea7bb03b70a5e", "Title": "ffmpeg: FFmpeg: Arbitrary Code Execution in CFHD Decoder via Crafted AVI File", "Description": "FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898", "https://github.com/advisories/GHSA-q24x-99v6-6hxc", "https://nvd.nist.gov/vuln/detail/CVE-2026-70632", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70632", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing" ], "PublishedDate": "2026-08-06T22:18:27.567Z", "LastModifiedDate": "2026-09-01T15:32:31.087Z" }, { "VulnerabilityID": "CVE-2026-75141", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:11125c104510ed0620f242e9af755879164b74ea421d727e8aec18f038971db2", "Title": "ffmpeg: FFmpeg: Heap buffer overflow via crafted HEVC input file during muxing", "Description": "FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75141", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088", "https://nvd.nist.gov/vuln/detail/CVE-2026-75141", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75141", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing" ], "PublishedDate": "2026-08-19T17:21:12.287Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75142", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75142", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8367954c0b6b92c7d63803c30be53dbac05e716b79b57fa56071dbac653676ab", "Title": "ffmpeg: FFmpeg: Stack Buffer Overflow in MPEG-PS Muxer", "Description": "FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75142", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087", "https://nvd.nist.gov/vuln/detail/CVE-2026-75142", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75142", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c" ], "PublishedDate": "2026-08-19T17:21:12.437Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75143", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e74e2b9aba59d33864d0b2c9581e6423604e97d6f13c64f974a00cacc42429f2", "Title": "ffmpeg: FFmpeg Heap Buffer Overflow via RIST Protocol Reader", "Description": "FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75143", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089", "https://nvd.nist.gov/vuln/detail/CVE-2026-75143", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75143", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader" ], "PublishedDate": "2026-08-19T17:21:12.577Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75144", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b47946d41c56209267e1a4768db356708c1315322e03af7b5618b3f6b201160d", "Title": "ffmpeg: FFmpeg: Memory corruption via crafted Dirac data unit", "Description": "FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75144", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091", "https://nvd.nist.gov/vuln/detail/CVE-2026-75144", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75144", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer" ], "PublishedDate": "2026-08-19T17:21:12.72Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75146", "PkgID": "libavfilter10@7:7.1.5-0+deb13u1", "PkgName": "libavfilter10", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter10@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "96ba42f08915bcd1" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75146", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e73dff9d5da6a5d53236f4b6ddc87441c8e826969b708b1b107341d32d71b82c", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer", "Description": "FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75146", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093", "https://nvd.nist.gov/vuln/detail/CVE-2026-75146", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75146", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c" ], "PublishedDate": "2026-08-19T17:21:13.057Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b9b2ab7f73de1b34d346ea27db33de31e1afddceda45585f046c9102948baf35", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.6, "V40Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/errata/RHSA-2026:51180", "https://access.redhat.com/errata/RHSA-2026:52832", "https://access.redhat.com/errata/RHSA-2026:52833", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61627", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:61629", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/advisories/GHSA-mjxr-6gqf-w78h", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://ubuntu.com/security/notices/USN-8750-1", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-09-01T13:19:51.89Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:82348a1696a81fdfb840110779bd862f76fac5eb5d4c59bc808bddd3191365b4", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64830", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://github.com/advisories/GHSA-jphx-q7f7-4x8r", "https://nvd.nist.gov/vuln/detail/CVE-2026-64830", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64830", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9ef5a110752d11df43dcbe5a33d1f7a119e6e50ea42a19eb0980d1045542febb", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video file in NVDEC hardware decoder", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64832", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://github.com/advisories/GHSA-jc8j-9799-c943", "https://nvd.nist.gov/vuln/detail/CVE-2026-64832", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64832", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:410a3b36551365b05c553d76f791dec1fc108f724472a1fafc4ece466d48167d", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in S/PDIF muxer", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.1, "V40Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64833", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://github.com/advisories/GHSA-34g6-m4cp-w5c9", "https://nvd.nist.gov/vuln/detail/CVE-2026-64833", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64833", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f3ae44af457b37d1b349ae3eb8f3e67ad55ecbc3451a7bb2e81514c59e4ef27d", "Title": "FFmpeg: Denial of Service via crafted RTP/ASF stream", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64834", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://github.com/advisories/GHSA-5xcx-3qx2-qv4x", "https://nvd.nist.gov/vuln/detail/CVE-2026-64834", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64834", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d65efce4fe759997383dfadaaa6ee0bcb9e7cb6e4e34e15778f2e80a475cc0c6", "Title": "FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64835", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://github.com/advisories/GHSA-p2v8-4c4f-rwpq", "https://nvd.nist.gov/vuln/detail/CVE-2026-64835", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64835", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bcaa97892db0478c0ad3831881919a0d7acadabf59ff491741390b0f1d500e7d", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66036", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://github.com/advisories/GHSA-575m-jfmw-q76c", "https://nvd.nist.gov/vuln/detail/CVE-2026-66036", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66036", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-08-07T01:05:17.87Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5d7a708139304fac3a41039ef2f766c7d21c00c939eea9283421dde35961c26a", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-190" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66039", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://github.com/advisories/GHSA-84qc-6h9r-4w33", "https://nvd.nist.gov/vuln/detail/CVE-2026-66039", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66039", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-08-07T00:46:17.303Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e1c7016a4591e5a187f07c8c5ba95b7c7e166ee32b487f12d68e7ad1062f7139", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PNG image", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66040", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://github.com/advisories/GHSA-6vcg-882j-82v5", "https://nvd.nist.gov/vuln/detail/CVE-2026-66040", "https://www.cve.org/CVERecord?id=CVE-2026-66040", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-08-07T00:35:29.773Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b7ac31a216221f427abe5e5c7056da8ebb7f1df28feeee791ce763d84087b18c", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PGS/SUP subtitle file", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66041", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://github.com/advisories/GHSA-frhp-m687-9g3q", "https://nvd.nist.gov/vuln/detail/CVE-2026-66041", "https://www.cve.org/CVERecord?id=CVE-2026-66041", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-70628", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70628", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0c57641326c72c2c5615dd52f9d64eaab670fe791b3d46d765f11d668571f25d", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser", "Description": "FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70628", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897", "https://github.com/advisories/GHSA-qw9h-2hhv-hpfr", "https://nvd.nist.gov/vuln/detail/CVE-2026-70628", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70628", "https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file" ], "PublishedDate": "2026-08-06T22:18:26.957Z", "LastModifiedDate": "2026-09-01T15:36:28.407Z" }, { "VulnerabilityID": "CVE-2026-70632", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70632", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:85c7790c7a8d5352a61d1e015ba6ad0f3d7b076c21965fa44c95ddedbd8f5726", "Title": "ffmpeg: FFmpeg: Arbitrary Code Execution in CFHD Decoder via Crafted AVI File", "Description": "FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898", "https://github.com/advisories/GHSA-q24x-99v6-6hxc", "https://nvd.nist.gov/vuln/detail/CVE-2026-70632", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70632", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing" ], "PublishedDate": "2026-08-06T22:18:27.567Z", "LastModifiedDate": "2026-09-01T15:32:31.087Z" }, { "VulnerabilityID": "CVE-2026-75141", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:763e8cdea7943d9fc61b5631daf383114110510795122704f75918127f1d0d2d", "Title": "ffmpeg: FFmpeg: Heap buffer overflow via crafted HEVC input file during muxing", "Description": "FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75141", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088", "https://nvd.nist.gov/vuln/detail/CVE-2026-75141", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75141", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing" ], "PublishedDate": "2026-08-19T17:21:12.287Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75142", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75142", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d5bba757fefbeab03cfd815dbe804ee5fe18db89b765ba1020679a54d1005e26", "Title": "ffmpeg: FFmpeg: Stack Buffer Overflow in MPEG-PS Muxer", "Description": "FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75142", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087", "https://nvd.nist.gov/vuln/detail/CVE-2026-75142", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75142", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c" ], "PublishedDate": "2026-08-19T17:21:12.437Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75143", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a0901c1ff44e97b318b27ec988ea62da9448319bea49e7111fd407ea77ec237a", "Title": "ffmpeg: FFmpeg Heap Buffer Overflow via RIST Protocol Reader", "Description": "FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75143", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089", "https://nvd.nist.gov/vuln/detail/CVE-2026-75143", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75143", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader" ], "PublishedDate": "2026-08-19T17:21:12.577Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75144", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9acb7666df712366c24fcb889a76016b4de7f3fae8d8d4787021227b717a2e77", "Title": "ffmpeg: FFmpeg: Memory corruption via crafted Dirac data unit", "Description": "FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75144", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091", "https://nvd.nist.gov/vuln/detail/CVE-2026-75144", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75144", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer" ], "PublishedDate": "2026-08-19T17:21:12.72Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75146", "PkgID": "libavformat61@7:7.1.5-0+deb13u1", "PkgName": "libavformat61", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat61@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "393ab2bb41642fde" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75146", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c826f45b7320cc91ea2d66f0f5d7c2fe0bffca36d3ba5f14844087db64f8f33a", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer", "Description": "FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75146", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093", "https://nvd.nist.gov/vuln/detail/CVE-2026-75146", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75146", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c" ], "PublishedDate": "2026-08-19T17:21:13.057Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd31a95d1964ad2fd04f19fb905095abb9f4c64330578abc7679425fc30b718f", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.6, "V40Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/errata/RHSA-2026:51180", "https://access.redhat.com/errata/RHSA-2026:52832", "https://access.redhat.com/errata/RHSA-2026:52833", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61627", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:61629", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/advisories/GHSA-mjxr-6gqf-w78h", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://ubuntu.com/security/notices/USN-8750-1", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-09-01T13:19:51.89Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e16111db70b03dcd1b21000cdda2ee31e54eb5c952ac71ae1cbe7ffdf6959bfa", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64830", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://github.com/advisories/GHSA-jphx-q7f7-4x8r", "https://nvd.nist.gov/vuln/detail/CVE-2026-64830", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64830", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0321050bfbb97dc307c261d369f26c73a0f27e81f3073f1d862594f2bdc9eaee", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video file in NVDEC hardware decoder", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64832", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://github.com/advisories/GHSA-jc8j-9799-c943", "https://nvd.nist.gov/vuln/detail/CVE-2026-64832", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64832", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0ce7d03f74e44ad8aa71d4ede283845ee397b54327ea8bc1067431a7710fc555", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in S/PDIF muxer", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.1, "V40Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64833", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://github.com/advisories/GHSA-34g6-m4cp-w5c9", "https://nvd.nist.gov/vuln/detail/CVE-2026-64833", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64833", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6368c070486aa3b86fbfae65412ffd2c23d7824b407b4e9b51acebecf8563429", "Title": "FFmpeg: Denial of Service via crafted RTP/ASF stream", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64834", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://github.com/advisories/GHSA-5xcx-3qx2-qv4x", "https://nvd.nist.gov/vuln/detail/CVE-2026-64834", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64834", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:da0ed1cd2a3bc3256eed2c48c56626c67e19a56e0d7b13b8f8ae2b538f53aec2", "Title": "FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64835", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://github.com/advisories/GHSA-p2v8-4c4f-rwpq", "https://nvd.nist.gov/vuln/detail/CVE-2026-64835", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64835", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4add486c7762d2d8259a0bfaeb7f52c09afe04c39f10d09fc84550ab27c8736f", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66036", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://github.com/advisories/GHSA-575m-jfmw-q76c", "https://nvd.nist.gov/vuln/detail/CVE-2026-66036", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66036", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-08-07T01:05:17.87Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:796b435fdf96db10b56dc27d2f1ef4d45b98e5b582e26c9752c40de432697605", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-190" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66039", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://github.com/advisories/GHSA-84qc-6h9r-4w33", "https://nvd.nist.gov/vuln/detail/CVE-2026-66039", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66039", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-08-07T00:46:17.303Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:74ee7d8537e107f5aeff815e6068819d836ad5f621fedb6ddf576382d027dd53", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PNG image", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66040", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://github.com/advisories/GHSA-6vcg-882j-82v5", "https://nvd.nist.gov/vuln/detail/CVE-2026-66040", "https://www.cve.org/CVERecord?id=CVE-2026-66040", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-08-07T00:35:29.773Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b9a81f5c81b7f54314af9e95a69ef48712a5d0db256c63796bff043b0b6425e", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PGS/SUP subtitle file", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66041", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://github.com/advisories/GHSA-frhp-m687-9g3q", "https://nvd.nist.gov/vuln/detail/CVE-2026-66041", "https://www.cve.org/CVERecord?id=CVE-2026-66041", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-70628", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70628", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:940738757ccf58833474dd092412a5e902920507057162cd636e716eb61b8c04", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser", "Description": "FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70628", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897", "https://github.com/advisories/GHSA-qw9h-2hhv-hpfr", "https://nvd.nist.gov/vuln/detail/CVE-2026-70628", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70628", "https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file" ], "PublishedDate": "2026-08-06T22:18:26.957Z", "LastModifiedDate": "2026-09-01T15:36:28.407Z" }, { "VulnerabilityID": "CVE-2026-70632", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70632", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cab3893735b142db867c062c8b6bc2168fdfbf139b00c27678d29144278bad83", "Title": "ffmpeg: FFmpeg: Arbitrary Code Execution in CFHD Decoder via Crafted AVI File", "Description": "FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898", "https://github.com/advisories/GHSA-q24x-99v6-6hxc", "https://nvd.nist.gov/vuln/detail/CVE-2026-70632", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70632", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing" ], "PublishedDate": "2026-08-06T22:18:27.567Z", "LastModifiedDate": "2026-09-01T15:32:31.087Z" }, { "VulnerabilityID": "CVE-2026-75141", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2bff840abc215a070bc5601a41fc975ea0fe2c3ac065db658cb07a1d424dc7f5", "Title": "ffmpeg: FFmpeg: Heap buffer overflow via crafted HEVC input file during muxing", "Description": "FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75141", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088", "https://nvd.nist.gov/vuln/detail/CVE-2026-75141", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75141", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing" ], "PublishedDate": "2026-08-19T17:21:12.287Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75142", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75142", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd10e4a514d7114cc5892c597ebc3fd6d7b1a91731e188d8517e79c47e04d2a9", "Title": "ffmpeg: FFmpeg: Stack Buffer Overflow in MPEG-PS Muxer", "Description": "FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75142", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087", "https://nvd.nist.gov/vuln/detail/CVE-2026-75142", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75142", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c" ], "PublishedDate": "2026-08-19T17:21:12.437Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75143", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e63b088c78ec56509543bf18d5d8b2c114b04f460b4c4c62ff8183f191c373dd", "Title": "ffmpeg: FFmpeg Heap Buffer Overflow via RIST Protocol Reader", "Description": "FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75143", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089", "https://nvd.nist.gov/vuln/detail/CVE-2026-75143", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75143", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader" ], "PublishedDate": "2026-08-19T17:21:12.577Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75144", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:939d35e642e8ebf16b7f1c025d7e877b97967806cd30a7be78db3efbf46898dd", "Title": "ffmpeg: FFmpeg: Memory corruption via crafted Dirac data unit", "Description": "FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75144", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091", "https://nvd.nist.gov/vuln/detail/CVE-2026-75144", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75144", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer" ], "PublishedDate": "2026-08-19T17:21:12.72Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75146", "PkgID": "libavutil59@7:7.1.5-0+deb13u1", "PkgName": "libavutil59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil59@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "8833b5857f4c2d63" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75146", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3873193add1bcc36e0f40f760dda15620380546491308754a55ec24f9a762133", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer", "Description": "FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75146", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093", "https://nvd.nist.gov/vuln/detail/CVE-2026-75146", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75146", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c" ], "PublishedDate": "2026-08-19T17:21:13.057Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libblkid1@2.41.5-0+deb13u1", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "57ce331079f40f84" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:412318d9ed8ee09a9b216657478534b03ba16c983d851abc5d489a2cf4684f0f", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libblkid1@2.41.5-0+deb13u1", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "57ce331079f40f84" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4204586f141b9f60010750552e4dc63b4177317c3d993e709e3fb2e79d2a0a20", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libblkid1@2.41.5-0+deb13u1", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "57ce331079f40f84" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:513961643455ca231c441557c308b2d275a8e312ef8a10f70aa6ba822b5f31dd", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libblkid1@2.41.5-0+deb13u1", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "57ce331079f40f84" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e30ab7276658f9d89fe463c6774c6c19457b16a84fa333c1b1210e922b240c96", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-111497", "VendorIDs": [ "DSA-6582-1" ], "PkgID": "libbrotli1@1.1.0-2+b7", "PkgName": "libbrotli1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libbrotli1@1.1.0-2%2Bb7?arch=amd64\u0026distro=debian-13.6", "UID": "3f78e505ac03922b" }, "InstalledVersion": "1.1.0-2+b7", "FixedVersion": "1.1.0-2+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7c9155bfd757b73239572d6b614fcc466fbec27e6ad350793077ec2a93fbc152", "Title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "Description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "Severity": "CRITICAL", "CweIDs": [ "CWE-252", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 9.8, "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/23/25", "http://www.openwall.com/lists/oss-security/2026/10/24/6", "http://www.openwall.com/lists/oss-security/2026/10/26/12", "http://www.openwall.com/lists/oss-security/2026/10/26/13", "http://www.openwall.com/lists/oss-security/2026/10/26/16", "http://www.openwall.com/lists/oss-security/2026/11/03/2", "https://access.redhat.com/errata/RHSA-2026:90495", "https://access.redhat.com/errata/RHSA-2026:92492", "https://access.redhat.com/security/cve/CVE-2026-111497", "https://advisory.echohq.com/cve/CVE-2026-111497", "https://broccoli2shell.com", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2562054", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://cert-portal.siemens.com/productcert/html/ssa-045512.html", "https://cert-portal.siemens.com/productcert/html/ssa-443410.html", "https://cert-portal.siemens.com/productcert/html/ssa-898633.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/", "https://errata.almalinux.org/9/ALSA-2026-92492.html", "https://errata.rockylinux.org/RLSA-2026:90495", "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "https://github.com/andybalholm/brotli/releases/tag/v1.2.7", "https://github.com/dotnet/announcements/issues/494", "https://github.com/google/brotli", "https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b", "https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0", "https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6", "https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12", "https://github.com/google/brotli/releases/tag/v1.0.10", "https://github.com/google/brotli/releases/tag/v1.1.1", "https://github.com/google/brotli/releases/tag/v1.2.1", "https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml", "https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml", "https://linux.oracle.com/cve/CVE-2026-111497.html", "https://linux.oracle.com/errata/ELSA-2026-92492.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high", "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "https://opensourcemalware.com/blog/node2shell-affects-python", "https://patchtheplanet.org/brotli", "https://pypi.org/project/Brotli", "https://pypi.org/project/brotlicffi", "https://ubuntu.com/security/notices/USN-8956-1", "https://ubuntu.com/security/notices/USN-8956-2", "https://ubuntu.com/security/notices/USN-8958-1", "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497", "https://www.cve.org/CVERecord?id=CVE-2026-111497" ], "PublishedDate": "2026-10-22T14:17:37.19Z", "LastModifiedDate": "2026-11-06T16:17:37.393Z" }, { "VulnerabilityID": "CVE-2026-16554", "PkgID": "libcjson1@1.7.18-3.1+deb13u1", "PkgName": "libcjson1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcjson1@1.7.18-3.1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "4e2f6c2ffefb1018" }, "InstalledVersion": "1.7.18-3.1+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16554", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:af531d43e1f9dc43d22e7d8a6abfdb1cd97a65207bf0754988ea7e4300ca2601", "Title": "cJSON: cJSON: Remote code execution due to integer overflow via crafted JSON", "Description": "cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.\n\n\n\n\nBecause project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "V3Score": 6.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/30/26", "http://www.openwall.com/lists/oss-security/2026/07/31/4", "https://access.redhat.com/security/cve/CVE-2026-16554", "https://cert.pl/en/posts/2026/07/CVE-2026-16554", "https://github.com/DaveGamble/cJSON", "https://nvd.nist.gov/vuln/detail/CVE-2026-16554", "https://www.cve.org/CVERecord?id=CVE-2026-16554" ], "PublishedDate": "2026-07-27T09:16:37.383Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-29036", "PkgID": "libcjson1@1.7.18-3.1+deb13u1", "PkgName": "libcjson1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcjson1@1.7.18-3.1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "4e2f6c2ffefb1018" }, "InstalledVersion": "1.7.18-3.1+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-29036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dd6f24cc96229211effdc4ed8ca9622fa874cee7884a1fb04dfea2d2dbe0f74f", "Title": "cJSON: cJSON: Data corruption and unauthorized modification via JSON Pointer escape decoding", "Description": "cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.", "Severity": "HIGH", "CweIDs": [ "CWE-706" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-29036", "https://github.com/DaveGamble/cJSON", "https://nvd.nist.gov/vuln/detail/CVE-2026-29036", "https://www.cve.org/CVERecord?id=CVE-2026-29036", "https://www.vulncheck.com/advisories/cjson-wrong-key-modification-via-json-pointer-escape-decoding" ], "PublishedDate": "2026-08-11T22:17:22.257Z", "LastModifiedDate": "2026-10-23T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-67215", "PkgID": "libcjson1@1.7.18-3.1+deb13u1", "PkgName": "libcjson1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcjson1@1.7.18-3.1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "4e2f6c2ffefb1018" }, "InstalledVersion": "1.7.18-3.1+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-67215", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3e7cb890f4933ea4047e8cc8d63413aad1c488d42cc50a355e01676a54b52e22", "Title": "cJSON: cJSON: Denial of Service via uncontrolled recursion in JSON Patch application", "Description": "cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service.", "Severity": "HIGH", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-67215", "https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L253-L261", "https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L906-L940", "https://joshua.hu/cjson-json-parser-cve-vulnerabilities", "https://nvd.nist.gov/vuln/detail/CVE-2026-67215", "https://www.cve.org/CVERecord?id=CVE-2026-67215", "https://www.vulncheck.com/advisories/cjson-json-patch-copy-add-uncontrolled-recursion-stack-exhaustion" ], "PublishedDate": "2026-07-29T14:16:35.187Z", "LastModifiedDate": "2026-10-23T23:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-67216", "PkgID": "libcjson1@1.7.18-3.1+deb13u1", "PkgName": "libcjson1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcjson1@1.7.18-3.1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "4e2f6c2ffefb1018" }, "InstalledVersion": "1.7.18-3.1+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-67216", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6987ebfbc8bb4669caeabb31f031cc823bdbde1c931dcfb45cd3c7b998950f0a", "Title": "cJSON: Denial of Service due to inefficient JSON object comparison", "Description": "cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-67216", "https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180", "https://joshua.hu/cjson-json-parser-cve-vulnerabilities", "https://nvd.nist.gov/vuln/detail/CVE-2026-67216", "https://www.cve.org/CVERecord?id=CVE-2026-67216", "https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service" ], "PublishedDate": "2026-07-29T14:16:35.333Z", "LastModifiedDate": "2026-10-23T23:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-87933", "PkgID": "libcjson1@1.7.18-3.1+deb13u1", "PkgName": "libcjson1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcjson1@1.7.18-3.1%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "4e2f6c2ffefb1018" }, "InstalledVersion": "1.7.18-3.1+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-87933", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6fc709ee5c2f587b42533f7132f4ab5f1bcbdd0a1a66eb47c6cbb1206fdd33e6", "Title": "cJSON: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch", "Description": "A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.", "Severity": "HIGH", "CweIDs": [ "CWE-119", "CWE-416" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-87933", "https://github.com/DaveGamble/cJSON/", "https://github.com/DaveGamble/cJSON/issues/1060", "https://github.com/DaveGamble/cJSON/pull/1065", "https://nvd.nist.gov/vuln/detail/CVE-2026-87933", "https://vuldb.com/cve/CVE-2026-87933", "https://vuldb.com/submit/911136", "https://vuldb.com/vuln/401815", "https://vuldb.com/vuln/401815/cti", "https://www.cve.org/CVERecord?id=CVE-2026-87933" ], "PublishedDate": "2026-09-10T01:16:35.65Z", "LastModifiedDate": "2026-09-10T20:17:31.073Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "libcurl4t64@8.14.1-2+deb13u5", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "49a807f44571c630" }, "InstalledVersion": "8.14.1-2+deb13u5", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:272b2d855e342dd3578b9fe71c631ce735cd8c788a420ac82ffa406f613db969", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-8286", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "libcurl4t64@8.14.1-2+deb13u5", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "49a807f44571c630" }, "InstalledVersion": "8.14.1-2+deb13u5", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:19f4f3ba4a07d7895c318c3802911d46febac29de97cce300add04932e624fd5", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "libcurl4t64@8.14.1-2+deb13u5", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "49a807f44571c630" }, "InstalledVersion": "8.14.1-2+deb13u5", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7ae7925556d80a9cf908b42d20cb425c01dc8537eb2f407b82ae92a9af222794", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8927", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "libcurl4t64@8.14.1-2+deb13u5", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "49a807f44571c630" }, "InstalledVersion": "8.14.1-2+deb13u5", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:560d092cab84f6edd44c0ab49b6d8f02d363ddb1baa3fc304139435805226a68", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "VendorIDs": [ "DSA-6558-1" ], "PkgID": "libcurl4t64@8.14.1-2+deb13u5", "PkgName": "libcurl4t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u5?arch=amd64\u0026distro=debian-13.6", "UID": "49a807f44571c630" }, "InstalledVersion": "8.14.1-2+deb13u5", "FixedVersion": "8.14.1-2+deb13u7", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ef4718963d0f2a300b2e376798ff32b2b1d34018c78239d9db336ddee6921afa", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-113351", "PkgID": "libexpat1@2.8.3-1~deb13u1", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "bacd3a088c2a3546" }, "InstalledVersion": "2.8.3-1~deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-113351", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1aa473a5d790da0257051ba534378dbe28b2118d898b8d726416a0d6424bea7d", "Title": "expat: expat: Denial of Service via improper memory tracking in XML_ParserReset", "Description": "libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.", "Severity": "HIGH", "CweIDs": [ "CWE-909" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-113351", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884", "https://github.com/libexpat/libexpat/pull/1431", "https://nvd.nist.gov/vuln/detail/CVE-2026-113351", "https://www.cve.org/CVERecord?id=CVE-2026-113351", "https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset" ], "PublishedDate": "2026-10-20T11:17:19.363Z", "LastModifiedDate": "2026-11-03T21:26:47.25Z" }, { "VulnerabilityID": "CVE-2026-115506", "PkgID": "libexpat1@2.8.3-1~deb13u1", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "bacd3a088c2a3546" }, "InstalledVersion": "2.8.3-1~deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-115506", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6d75ed5a5bc1c903dfcaaa6b133a87396e7307693b773e71cce8e4b2beb7e471", "Title": "expat: expat: Denial of Service via delayed entity amplification detection", "Description": "libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.", "Severity": "HIGH", "CweIDs": [ "CWE-776" ], "VendorSeverity": { "photon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-115506", "https://github.com/hannob/lololol", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/issues/1160", "https://github.com/libexpat/libexpat/pull/1433", "https://nvd.nist.gov/vuln/detail/CVE-2026-115506", "https://www.cve.org/CVERecord?id=CVE-2026-115506", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay" ], "PublishedDate": "2026-10-22T20:17:06.62Z", "LastModifiedDate": "2026-11-02T18:27:06.127Z" }, { "VulnerabilityID": "CVE-2026-117610", "PkgID": "libexpat1@2.8.3-1~deb13u1", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "bacd3a088c2a3546" }, "InstalledVersion": "2.8.3-1~deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-117610", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:253f426582362f4034893bea663d78e745fa27e39accc7597dba7062af5b88cb", "Title": "expat: expat: Denial of Service via NULL pointer dereference in external entity parsing", "Description": "libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-117610", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510", "https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d", "https://github.com/libexpat/libexpat/pull/1444", "https://nvd.nist.gov/vuln/detail/CVE-2026-117610", "https://www.cve.org/CVERecord?id=CVE-2026-117610", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser" ], "PublishedDate": "2026-10-28T03:17:12.777Z", "LastModifiedDate": "2026-11-05T16:17:35.787Z" }, { "VulnerabilityID": "CVE-2026-118370", "PkgID": "libexpat1@2.8.3-1~deb13u1", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "bacd3a088c2a3546" }, "InstalledVersion": "2.8.3-1~deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-118370", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7c71526be2059e75b9ce5f4ed2f36fee0337f8ccaab19390696ada324a044d05", "Title": "expat: expat: Denial of Service via integer overflow during XML attribute parsing", "Description": "libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-118370", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140", "https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae", "https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c", "https://github.com/libexpat/libexpat/pull/1450", "https://nvd.nist.gov/vuln/detail/CVE-2026-118370", "https://www.cve.org/CVERecord?id=CVE-2026-118370", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes" ], "PublishedDate": "2026-10-28T03:17:13.293Z", "LastModifiedDate": "2026-11-02T20:17:37.377Z" }, { "VulnerabilityID": "CVE-2026-66046", "VendorIDs": [ "DSA-6566-1" ], "PkgID": "libexpat1@2.8.3-1~deb13u1", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "bacd3a088c2a3546" }, "InstalledVersion": "2.8.3-1~deb13u1", "FixedVersion": "2.9.0-1~deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66046", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:62432565894da9eb9f1dd8d179c123b39d72ad1c1a0abba2de616f821c80f16b", "Title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "Description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType-\u003edefaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72663", "https://access.redhat.com/security/cve/CVE-2026-66046", "https://bugzilla.redhat.com/2538967", "https://bugzilla.redhat.com/show_bug.cgi?id=2517901", "https://bugzilla.redhat.com/show_bug.cgi?id=2538967", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93990", "https://errata.almalinux.org/9/ALSA-2026-72663.html", "https://errata.rockylinux.org/RLSA-2026:72663", "https://github.com/libexpat/libexpat/pull/1321", "https://linux.oracle.com/cve/CVE-2026-66046.html", "https://linux.oracle.com/errata/ELSA-2026-74001.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-66046", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-66046", "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity" ], "PublishedDate": "2026-08-18T15:16:57Z", "LastModifiedDate": "2026-10-22T22:10:00.25Z" }, { "VulnerabilityID": "CVE-2026-76956", "VendorIDs": [ "DSA-6566-1" ], "PkgID": "libexpat1@2.8.3-1~deb13u1", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "bacd3a088c2a3546" }, "InstalledVersion": "2.8.3-1~deb13u1", "FixedVersion": "2.9.0-1~deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76956", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f0dd138aa58a181011a4e0450715efa0347c81a3c18c430a62181820917183b4", "Title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML", "Description": "In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.", "Severity": "HIGH", "CweIDs": [ "CWE-394" ], "VendorSeverity": { "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76956", "https://github.com/libexpat/libexpat/pull/1326", "https://github.com/libexpat/libexpat/pull/1329", "https://nvd.nist.gov/vuln/detail/CVE-2026-76956", "https://www.cve.org/CVERecord?id=CVE-2026-76956" ], "PublishedDate": "2026-08-20T05:16:29.61Z", "LastModifiedDate": "2026-09-08T21:08:20.697Z" }, { "VulnerabilityID": "CVE-2026-76957", "VendorIDs": [ "DSA-6566-1" ], "PkgID": "libexpat1@2.8.3-1~deb13u1", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "bacd3a088c2a3546" }, "InstalledVersion": "2.8.3-1~deb13u1", "FixedVersion": "2.9.0-1~deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76957", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:936c28078f1bc5e324ae09eab34c6251d169869d88aadbf902513d71c1cb83ef", "Title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "Description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 4.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76957", "https://github.com/libexpat/libexpat/pull/1322", "https://github.com/libexpat/libexpat/pull/1329", "https://nvd.nist.gov/vuln/detail/CVE-2026-76957", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-76957" ], "PublishedDate": "2026-08-20T05:16:29.747Z", "LastModifiedDate": "2026-09-08T20:56:31.86Z" }, { "VulnerabilityID": "CVE-2026-77214", "VendorIDs": [ "DSA-6566-1" ], "PkgID": "libexpat1@2.8.3-1~deb13u1", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "bacd3a088c2a3546" }, "InstalledVersion": "2.8.3-1~deb13u1", "FixedVersion": "2.9.0-1~deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-77214", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9b36f80c6bebfa9196ea2467f1b3d8ed743fa00f1ab1ee6a09fe29e604f8c8da", "Title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "Description": "libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:88247", "https://access.redhat.com/security/cve/CVE-2026-77214", "https://bugzilla.redhat.com/2543288", "https://bugzilla.redhat.com/2547476", "https://bugzilla.redhat.com/show_bug.cgi?id=2543288", "https://bugzilla.redhat.com/show_bug.cgi?id=2547476", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77214", "https://errata.almalinux.org/9/ALSA-2026-88247.html", "https://errata.rockylinux.org/RLSA-2026:88247", "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0", "https://github.com/libexpat/libexpat/pull/1393", "https://linux.oracle.com/cve/CVE-2026-77214.html", "https://linux.oracle.com/errata/ELSA-2026-92323.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-77214", "https://www.cve.org/CVERecord?id=CVE-2026-77214", "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer" ], "PublishedDate": "2026-10-07T15:17:53.327Z", "LastModifiedDate": "2026-10-10T03:17:08.487Z" }, { "VulnerabilityID": "CVE-2026-93990", "VendorIDs": [ "DSA-6566-1" ], "PkgID": "libexpat1@2.8.3-1~deb13u1", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "bacd3a088c2a3546" }, "InstalledVersion": "2.8.3-1~deb13u1", "FixedVersion": "2.9.0-1~deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93990", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:59bd2c0cd7627e2ed7571d35a5b17685dcffe1aaea4c5f2dd046901f885790a9", "Title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "Description": "Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.", "Severity": "HIGH", "CweIDs": [ "CWE-176" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72663", "https://access.redhat.com/security/cve/CVE-2026-93990", "https://blog.hartwork.org/posts/expat-2-8-5-released/", "https://bugzilla.redhat.com/2538967", "https://bugzilla.redhat.com/show_bug.cgi?id=2517901", "https://bugzilla.redhat.com/show_bug.cgi?id=2538967", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93990", "https://errata.almalinux.org/9/ALSA-2026-72663.html", "https://errata.rockylinux.org/RLSA-2026:72663", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a", "https://github.com/libexpat/libexpat/pull/1282", "https://github.com/libexpat/libexpat/releases/tag/R_2_8_5", "https://linux.oracle.com/cve/CVE-2026-93990.html", "https://linux.oracle.com/errata/ELSA-2026-74001.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93990", "https://www.cve.org/CVERecord?id=CVE-2026-93990", "https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate" ], "PublishedDate": "2026-09-19T23:17:10.203Z", "LastModifiedDate": "2026-09-28T17:17:53.037Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "liblastlog2-2@2.41.5-0+deb13u1", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "9b0fe2f2c9e6f842" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:040facbd39c4f77191b14ee9b1fb326e79cdc9aa381e3b28ff5d3ca84470c882", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "liblastlog2-2@2.41.5-0+deb13u1", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "9b0fe2f2c9e6f842" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3d6b45cc872bb2755a18c248306dcbbb76e43491291dcec116199860c0300ea0", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "liblastlog2-2@2.41.5-0+deb13u1", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "9b0fe2f2c9e6f842" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dc4c82c352801a07df4ea969bfa28f643afb8553f7695a92b28f155582c381e3", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "liblastlog2-2@2.41.5-0+deb13u1", "PkgName": "liblastlog2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblastlog2-2@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "9b0fe2f2c9e6f842" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5c6463eb9a39ec3d611645bab44d31798f590d7c1626c6ba3ab088361feb112f", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libmount1@2.41.5-0+deb13u1", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "b26c2651b95c08c5" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6694e92b8908df314a52211c508d6be5e878c27dfef1e2165215c40570cf034f", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libmount1@2.41.5-0+deb13u1", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "b26c2651b95c08c5" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d919a71fe61b3cdec244d1b060e898e7f5ce6a0c5ad803f3db714384410da03a", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libmount1@2.41.5-0+deb13u1", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "b26c2651b95c08c5" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:27f0fb366f676018cf4d0fbc36265556c18744f00d3a22800325e5ed31b48c05", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libmount1@2.41.5-0+deb13u1", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "b26c2651b95c08c5" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c832ae517e679c0321b5836904313a420ffdc6fe64fdf3cfb7e00dbe66b2ff97", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "libncursesw6@6.5+20250216-2", "PkgName": "libncursesw6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.6", "UID": "c7a5d333a8ad931e" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:93dd5da6b4d4b874613be272c7f33da476acd1b8b97341c90a3c58bac804dcc2", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-103111", "VendorIDs": [ "DSA-6530-1" ], "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "aa7e3a6ab471d889" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-103111", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c35a1272ee84c45d6bccc1261293749648e8c958af37d25cfd776d58def1c1e3", "Title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "Description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-103111", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m", "https://linux.oracle.com/cve/CVE-2026-103111.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-103111" ], "PublishedDate": "2026-09-30T05:16:45.863Z", "LastModifiedDate": "2026-10-04T00:16:35.563Z" }, { "VulnerabilityID": "CVE-2026-86145", "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "aa7e3a6ab471d889" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86145", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9eac6db4adde324257be9371b4cec1f5652cf13e1c4a2f3c610beae03ae78ea3", "Title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "Description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "Severity": "HIGH", "CweIDs": [ "CWE-424" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "http://www.openwall.com/lists/oss-security/2026/09/05/3", "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-86145", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/17.1.0/BRSA-xqvt0yt0g9rb.toml", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://linux.oracle.com/cve/CVE-2026-86145.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-86145" ], "PublishedDate": "2026-09-05T06:17:10.37Z", "LastModifiedDate": "2026-09-09T16:04:24.933Z" }, { "VulnerabilityID": "CVE-2026-89157", "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "aa7e3a6ab471d889" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89157", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b7836e5683474a2bbfb3990d6c7e4d374807e025f07b8aa83815c8e21b4d750", "Title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "Description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 5.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89157", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "https://linux.oracle.com/cve/CVE-2026-89157.html", "https://linux.oracle.com/errata/ELSA-2026-81613.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89157", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89157" ], "PublishedDate": "2026-09-11T04:18:03.753Z", "LastModifiedDate": "2026-09-16T19:25:08.88Z" }, { "VulnerabilityID": "CVE-2026-89161", "PkgID": "libpcre2-8-0@10.46-1~deb13u1", "PkgName": "libpcre2-8-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "aa7e3a6ab471d889" }, "InstalledVersion": "10.46-1~deb13u1", "FixedVersion": "10.46-1~deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89161", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:21822367338d932407247166aaee1655ebdd1d656bb33cd9bc615148ee301648", "Title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "Description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "Severity": "HIGH", "CweIDs": [ "CWE-590" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89161", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/commit/1dcd0cf42a6a7cb62cc9a7c024196733abcfda95%20%28pcre2-10.48-RC1%29", "https://github.com/PCRE2Project/pcre2/pull/937", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://linux.oracle.com/cve/CVE-2026-89161.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89161" ], "PublishedDate": "2026-09-11T04:18:04.47Z", "LastModifiedDate": "2026-09-16T19:10:47.78Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:041b252bb5d04abb2f85ae6fdabe2fa4e082c60e8186eaec524511cc9c6769c7", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.6, "V40Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/errata/RHSA-2026:51180", "https://access.redhat.com/errata/RHSA-2026:52832", "https://access.redhat.com/errata/RHSA-2026:52833", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61627", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:61629", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/advisories/GHSA-mjxr-6gqf-w78h", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://ubuntu.com/security/notices/USN-8750-1", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-09-01T13:19:51.89Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:374b533e2564af2737cc2ba451db1afd8b3a1ecb77ff19ec25d55207e5182bf4", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64830", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://github.com/advisories/GHSA-jphx-q7f7-4x8r", "https://nvd.nist.gov/vuln/detail/CVE-2026-64830", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64830", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bb732ac144caf0aa82c05c3ab35ea656139256e992a21ea8543b469fbbbe05a5", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video file in NVDEC hardware decoder", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64832", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://github.com/advisories/GHSA-jc8j-9799-c943", "https://nvd.nist.gov/vuln/detail/CVE-2026-64832", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64832", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7cf122611eaedacab012188b059a6356fb11bc842d0e6e4c823c9e366cb764a1", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in S/PDIF muxer", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.1, "V40Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64833", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://github.com/advisories/GHSA-34g6-m4cp-w5c9", "https://nvd.nist.gov/vuln/detail/CVE-2026-64833", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64833", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3fd149adb4d0a345cd9c6f600662b472baef83d4e8a74bdc8a8fa854e3965a00", "Title": "FFmpeg: Denial of Service via crafted RTP/ASF stream", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64834", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://github.com/advisories/GHSA-5xcx-3qx2-qv4x", "https://nvd.nist.gov/vuln/detail/CVE-2026-64834", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64834", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9497342ed678c5a7b907bd2d3f8427a401bdb969893b5057990ba35b815bea1d", "Title": "FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64835", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://github.com/advisories/GHSA-p2v8-4c4f-rwpq", "https://nvd.nist.gov/vuln/detail/CVE-2026-64835", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64835", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:07e38cd1c82e9239fd759cfa08adb25de9a90c61b977eda9415a93320319332b", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66036", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://github.com/advisories/GHSA-575m-jfmw-q76c", "https://nvd.nist.gov/vuln/detail/CVE-2026-66036", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66036", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-08-07T01:05:17.87Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:12411c14cfa10aace1430f0d189561d5c4f23d36788c9ef07c74ee2777ffb0d1", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-190" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66039", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://github.com/advisories/GHSA-84qc-6h9r-4w33", "https://nvd.nist.gov/vuln/detail/CVE-2026-66039", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66039", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-08-07T00:46:17.303Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0567920b221c1451032936f379cb723665cabaa6c4c0a641c4bc8ffa3b2ece21", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PNG image", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66040", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://github.com/advisories/GHSA-6vcg-882j-82v5", "https://nvd.nist.gov/vuln/detail/CVE-2026-66040", "https://www.cve.org/CVERecord?id=CVE-2026-66040", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-08-07T00:35:29.773Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:47c6d9b3beae664cb5d2abee528dcfb49993aa85a68fdb75e3a963f071d21eba", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PGS/SUP subtitle file", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66041", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://github.com/advisories/GHSA-frhp-m687-9g3q", "https://nvd.nist.gov/vuln/detail/CVE-2026-66041", "https://www.cve.org/CVERecord?id=CVE-2026-66041", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-70628", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70628", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5218945b8c23d635415ef6f99321fa528484a3c93f18ebce592ece640f5da159", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser", "Description": "FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70628", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897", "https://github.com/advisories/GHSA-qw9h-2hhv-hpfr", "https://nvd.nist.gov/vuln/detail/CVE-2026-70628", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70628", "https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file" ], "PublishedDate": "2026-08-06T22:18:26.957Z", "LastModifiedDate": "2026-09-01T15:36:28.407Z" }, { "VulnerabilityID": "CVE-2026-70632", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70632", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6246103830840c06747e567410805e025ea3e91dd31b4a2ed9e2a3c0f73f3c7a", "Title": "ffmpeg: FFmpeg: Arbitrary Code Execution in CFHD Decoder via Crafted AVI File", "Description": "FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898", "https://github.com/advisories/GHSA-q24x-99v6-6hxc", "https://nvd.nist.gov/vuln/detail/CVE-2026-70632", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70632", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing" ], "PublishedDate": "2026-08-06T22:18:27.567Z", "LastModifiedDate": "2026-09-01T15:32:31.087Z" }, { "VulnerabilityID": "CVE-2026-75141", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:37ce08bb58db0412f3739b90f65ce6c9db589212dfadee8d6a385420be1c6c7e", "Title": "ffmpeg: FFmpeg: Heap buffer overflow via crafted HEVC input file during muxing", "Description": "FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75141", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088", "https://nvd.nist.gov/vuln/detail/CVE-2026-75141", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75141", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing" ], "PublishedDate": "2026-08-19T17:21:12.287Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75142", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75142", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f33b4ef81fd08197b852b788875a45b629a9c6a0ee5b17239f570d1be5a1bc3e", "Title": "ffmpeg: FFmpeg: Stack Buffer Overflow in MPEG-PS Muxer", "Description": "FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75142", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087", "https://nvd.nist.gov/vuln/detail/CVE-2026-75142", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75142", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c" ], "PublishedDate": "2026-08-19T17:21:12.437Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75143", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f6ff2f9f7d57dd843626ac13569eaf1bdbc18ffbb72e9c409ac7cff75cf93312", "Title": "ffmpeg: FFmpeg Heap Buffer Overflow via RIST Protocol Reader", "Description": "FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75143", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089", "https://nvd.nist.gov/vuln/detail/CVE-2026-75143", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75143", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader" ], "PublishedDate": "2026-08-19T17:21:12.577Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75144", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fc9ff2cc9a974d9b6cfc0754563e02ce0f7960181641aa3528e65e2c52f5979c", "Title": "ffmpeg: FFmpeg: Memory corruption via crafted Dirac data unit", "Description": "FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75144", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091", "https://nvd.nist.gov/vuln/detail/CVE-2026-75144", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75144", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer" ], "PublishedDate": "2026-08-19T17:21:12.72Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75146", "PkgID": "libpostproc58@7:7.1.5-0+deb13u1", "PkgName": "libpostproc58", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc58@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "3521ee10d12b2895" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75146", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7fe6095a5b189fe19c971b35854bb4681e25fb37cb626ffe51330d458abb67de", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer", "Description": "FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75146", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093", "https://nvd.nist.gov/vuln/detail/CVE-2026-75146", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75146", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c" ], "PublishedDate": "2026-08-19T17:21:13.057Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-96889", "VendorIDs": [ "DSA-6555-1" ], "PkgID": "librsvg2-2@2.60.0+dfsg-1", "PkgName": "librsvg2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/librsvg2-2@2.60.0%2Bdfsg-1?arch=amd64\u0026distro=debian-13.6", "UID": "8db0239d9634c1cf" }, "InstalledVersion": "2.60.0+dfsg-1", "FixedVersion": "2.60.0+dfsg-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96889", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b975ee553674b49ae7e978f5a3493ef67351426043f53d069db4db162e3cd737", "Title": "librsvg: Use-after-free when XML includes have duplicated entities", "Description": "A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "azure": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:86331", "https://access.redhat.com/errata/RHSA-2026:86841", "https://access.redhat.com/errata/RHSA-2026:86842", "https://access.redhat.com/errata/RHSA-2026:86921", "https://access.redhat.com/errata/RHSA-2026:92212", "https://access.redhat.com/errata/RHSA-2026:92213", "https://access.redhat.com/errata/RHSA-2026:92214", "https://access.redhat.com/errata/RHSA-2026:92218", "https://access.redhat.com/errata/RHSA-2026:92336", "https://access.redhat.com/errata/RHSA-2026:92353", "https://access.redhat.com/errata/RHSA-2026:92382", "https://access.redhat.com/errata/RHSA-2026:92573", "https://access.redhat.com/errata/RHSA-2026:92579", "https://access.redhat.com/errata/RHSA-2026:94452", "https://access.redhat.com/errata/RHSA-2026:94453", "https://access.redhat.com/errata/RHSA-2026:94454", "https://access.redhat.com/errata/RHSA-2026:94455", "https://access.redhat.com/errata/RHSA-2026:94457", "https://access.redhat.com/errata/RHSA-2026:94458", "https://access.redhat.com/errata/RHSA-2026:94459", "https://access.redhat.com/errata/RHSA-2026:94460", "https://access.redhat.com/errata/RHSA-2026:94461", "https://access.redhat.com/errata/RHSA-2026:94462", "https://access.redhat.com/errata/RHSA-2026:94463", "https://access.redhat.com/errata/RHSA-2026:94464", "https://access.redhat.com/errata/RHSA-2026:94465", "https://access.redhat.com/errata/RHSA-2026:94466", "https://access.redhat.com/errata/RHSA-2026:94467", "https://access.redhat.com/errata/RHSA-2026:94468", "https://access.redhat.com/errata/RHSA-2026:94469", "https://access.redhat.com/errata/RHSA-2026:94470", "https://access.redhat.com/errata/RHSA-2026:94471", "https://access.redhat.com/errata/RHSA-2026:94472", "https://access.redhat.com/errata/RHSA-2026:94473", "https://access.redhat.com/errata/RHSA-2026:94474", "https://access.redhat.com/errata/RHSA-2026:94476", "https://access.redhat.com/security/cve/CVE-2026-96889", "https://bugzilla.redhat.com/2539279", "https://bugzilla.redhat.com/show_bug.cgi?id=2539279", "https://crates.io/crates/librsvg", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96889", "https://errata.almalinux.org/9/ALSA-2026-86921.html", "https://errata.rockylinux.org/RLSA-2026:86921", "https://github.com/GNOME/librsvg/blob/2.63.2/NEWS", "https://github.com/GNOME/librsvg/commit/0bc935e675947e185d42005d3ad93d7cf61bcea9", "https://github.com/GNOME/librsvg/commit/1606574427408baca8203ef723281509a229f9e2", "https://github.com/GNOME/librsvg/commit/4d0051a9dbd038a5fe8461b61486677d88f8736d", "https://github.com/GNOME/librsvg/commit/e56cc8a33a7184eef6e8a720414aee6205a400ad", "https://github.com/GNOME/librsvg/releases/tag/2.57.5", "https://github.com/GNOME/librsvg/releases/tag/2.60.3", "https://github.com/GNOME/librsvg/releases/tag/2.61.5", "https://github.com/GNOME/librsvg/releases/tag/2.62.4", "https://github.com/GNOME/librsvg/releases/tag/2.63.2", "https://gitlab.gnome.org/GNOME/librsvg", "https://gitlab.gnome.org/GNOME/librsvg/-/commit/8a1b0cd319e9af2d1e9cf878081dd77f227a0504", "https://gitlab.gnome.org/GNOME/librsvg/-/merge_requests/1211", "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241", "https://linux.oracle.com/cve/CVE-2026-96889.html", "https://linux.oracle.com/errata/ELSA-2026-86921.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-96889", "https://rustsec.org/advisories/RUSTSEC-2026-0305.html", "https://ubuntu.com/security/notices/USN-8891-1", "https://www.cve.org/CVERecord?id=CVE-2026-96889" ], "PublishedDate": "2026-09-23T20:17:27.587Z", "LastModifiedDate": "2026-11-05T01:17:25.013Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libsmartcols1@2.41.5-0+deb13u1", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "20af24e636963c71" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c1f29942e7ece1b46f162ea6b212a9707bd42200d83992dde6bf1aa527b70ae", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libsmartcols1@2.41.5-0+deb13u1", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "20af24e636963c71" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6a1930e938d71efaa7f21ce4d36a2a02d539740cff3381056fb145b42cb249bd", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libsmartcols1@2.41.5-0+deb13u1", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "20af24e636963c71" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:681754172a81c9357fd14c6853e4b9e5112e9d3df939dd3754116a8fa6a2d78a", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libsmartcols1@2.41.5-0+deb13u1", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "20af24e636963c71" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a3c8510ca8605d57cb9d6149af577fc0d4060a67a0c969c10e10a01d0dd00474", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-37555", "PkgID": "libsndfile1@1.2.2-2+deb13u1", "PkgName": "libsndfile1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsndfile1@1.2.2-2%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "c2487b43deba7765" }, "InstalledVersion": "1.2.2-2+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-37555", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:18f1db60b5d4584bdafc8eef56463f34357abc2faf213fb6971c150b7ddd8116", "Title": "libsndfile: integer overflow in ima_reader_init()", "Description": "An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19559", "https://access.redhat.com/errata/RHSA-2026:19560", "https://access.redhat.com/errata/RHSA-2026:19610", "https://access.redhat.com/errata/RHSA-2026:23221", "https://access.redhat.com/errata/RHSA-2026:23222", "https://access.redhat.com/errata/RHSA-2026:23223", "https://access.redhat.com/errata/RHSA-2026:25092", "https://access.redhat.com/errata/RHSA-2026:25197", "https://access.redhat.com/errata/RHSA-2026:25198", "https://access.redhat.com/errata/RHSA-2026:25227", "https://access.redhat.com/errata/RHSA-2026:30078", "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/security/cve/CVE-2026-37555", "https://bugzilla.redhat.com/2463856", "https://bugzilla.redhat.com/show_bug.cgi?id=2463856", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-37555", "https://errata.almalinux.org/9/ALSA-2026-19610.html", "https://errata.rockylinux.org/RLSA-2026:19610", "https://gist.github.com/sgInnora/a5f5c19e4bf6f4fb74fab7b0ef2bfcc1", "https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151", "https://github.com/libsndfile/libsndfile/issues/833", "https://linux.oracle.com/cve/CVE-2026-37555.html", "https://linux.oracle.com/errata/ELSA-2026-19610.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-37555", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-37555.json", "https://www.cve.org/CVERecord?id=CVE-2026-37555", "https://www.openwall.com/lists/oss-security/2026/04/30/7" ], "PublishedDate": "2026-04-29T16:16:23.41Z", "LastModifiedDate": "2026-07-15T02:20:44.847Z" }, { "VulnerabilityID": "CVE-2026-11822", "PkgID": "libsqlite3-0@3.46.1-7+deb13u1", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "c7da287e696e8198" }, "InstalledVersion": "3.46.1-7+deb13u1", "FixedVersion": "3.46.1-7+deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11822", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:65f095e38a51eb7c2806ae137d73c32eb06aad8ae1360e094126552fc919148a", "Title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "Description": "SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:58936", "https://access.redhat.com/security/cve/CVE-2026-11822", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://errata.almalinux.org/9/ALSA-2026-58936.html", "https://errata.rockylinux.org/RLSA-2026:58936", "https://linux.oracle.com/cve/CVE-2026-11822.html", "https://linux.oracle.com/errata/ELSA-2026-61242-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-11822", "https://sqlite.org/releaselog/3_53_2.html", "https://sqlite.org/src/info/061febcf41ca", "https://sqlite.org/src/info/4a5ad516ea93", "https://sqlite.org/src/info/87b653731171", "https://sqlite.org/src/info/fad98805b7d7", "https://ubuntu.com/security/notices/USN-8480-1", "https://www.cve.org/CVERecord?id=CVE-2026-11822", "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension" ], "PublishedDate": "2026-06-09T20:16:32.15Z", "LastModifiedDate": "2026-10-30T02:17:08.76Z" }, { "VulnerabilityID": "CVE-2026-11824", "PkgID": "libsqlite3-0@3.46.1-7+deb13u1", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "c7da287e696e8198" }, "InstalledVersion": "3.46.1-7+deb13u1", "FixedVersion": "3.46.1-7+deb13u2", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11824", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3928c3092458d7994e96dabd3985081f848632c4fc36c79144a87bf2b8276fa7", "Title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "Description": "SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:58936", "https://access.redhat.com/security/cve/CVE-2026-11824", "https://bugzilla.redhat.com/show_bug.cgi?id=2487258", "https://bugzilla.redhat.com/show_bug.cgi?id=2487269", "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11822", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11824", "https://errata.almalinux.org/9/ALSA-2026-58936.html", "https://errata.rockylinux.org/RLSA-2026:58936", "https://linux.oracle.com/cve/CVE-2026-11824.html", "https://linux.oracle.com/errata/ELSA-2026-58938.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-11824", "https://sqlite.org/releaselog/3_53_2.html", "https://sqlite.org/src/info/061febcf41ca", "https://sqlite.org/src/info/4a5ad516ea93", "https://ubuntu.com/security/notices/USN-8480-1", "https://www.cve.org/CVERecord?id=CVE-2026-11824", "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate" ], "PublishedDate": "2026-06-09T20:16:32.3Z", "LastModifiedDate": "2026-10-15T02:18:37.653Z" }, { "VulnerabilityID": "CVE-2026-119373", "PkgID": "libsqlite3-0@3.46.1-7+deb13u1", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "c7da287e696e8198" }, "InstalledVersion": "3.46.1-7+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119373", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:06435f6b45e831ae1b9ac22d89247db13eedfe46b7ad473157a8891835ececf9", "Title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5", "Description": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge", "https://access.redhat.com/security/cve/CVE-2026-119373", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107", "https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80", "https://nvd.nist.gov/vuln/detail/CVE-2026-119373", "https://sqlite.org/bugs/info/2026-08-04T08:49:27Z", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/a7f8c92f62", "https://www.cve.org/CVERecord?id=CVE-2026-119373", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists" ], "PublishedDate": "2026-10-30T12:16:36.027Z", "LastModifiedDate": "2026-11-05T21:18:41.047Z" }, { "VulnerabilityID": "CVE-2026-119374", "PkgID": "libsqlite3-0@3.46.1-7+deb13u1", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "c7da287e696e8198" }, "InstalledVersion": "3.46.1-7+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119374", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a94ae8d461b859e2a661aefffea92d6b402c21887643ebce1992dd855294ecc7", "Title": "sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index", "Description": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-fts5-securedel", "https://access.redhat.com/security/cve/CVE-2026-119374", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525", "https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9", "https://nvd.nist.gov/vuln/detail/CVE-2026-119374", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/9cd4f9e920", "https://www.cve.org/CVERecord?id=CVE-2026-119374", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete" ], "PublishedDate": "2026-10-30T12:16:36.187Z", "LastModifiedDate": "2026-11-03T16:09:06.143Z" }, { "VulnerabilityID": "CVE-2026-119379", "PkgID": "libsqlite3-0@3.46.1-7+deb13u1", "PkgName": "libsqlite3-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "c7da287e696e8198" }, "InstalledVersion": "3.46.1-7+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-119379", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:29991b8beba98c6264de9dcd03fee5117380c62bc5540b3ed52c6b91a9a6ae55", "Title": "sqlite: sqlite: Arbitrary code execution via crafted session changesets", "Description": "SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://abraxaslabs.tech/research/sqlite-session-ncol", "https://access.redhat.com/security/cve/CVE-2026-119379", "https://github.com/sqlite/sqlite", "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619", "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52", "https://nvd.nist.gov/vuln/detail/CVE-2026-119379", "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z", "https://sqlite.org/releaselog/3_54_0.html", "https://sqlite.org/src/info/3f57024aecea0f3b", "https://www.cve.org/CVERecord?id=CVE-2026-119379", "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind" ], "PublishedDate": "2026-10-30T12:16:36.967Z", "LastModifiedDate": "2026-11-03T15:38:24.827Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DSA-6531-1" ], "PkgID": "libssl3t64@3.5.7-1~deb13u2", "PkgName": "libssl3t64", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3t64@3.5.7-1~deb13u2?arch=amd64\u0026distro=debian-13.6", "UID": "ef6621757ca9b535" }, "InstalledVersion": "3.5.7-1~deb13u2", "FixedVersion": "3.5.7-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:4d43b7f98e4c38fd2d37f37f1bf9965d2c4018b01453d3b29d924653c3275f4b" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8d96b9eede85e8654e411a8cd42a87f4f007f7c2d792f676f5e473142422f76f", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f031f288fb1aeb3f774956153e3e1c27569bc506debd41fcf844b0daa8d49e4f", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.6, "V40Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/errata/RHSA-2026:51180", "https://access.redhat.com/errata/RHSA-2026:52832", "https://access.redhat.com/errata/RHSA-2026:52833", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61627", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:61629", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/advisories/GHSA-mjxr-6gqf-w78h", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://ubuntu.com/security/notices/USN-8750-1", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-09-01T13:19:51.89Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9942bce91f9168d34ca6149b44490a80e356e85864c71c92fa62e7ef57cc0dbd", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64830", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://github.com/advisories/GHSA-jphx-q7f7-4x8r", "https://nvd.nist.gov/vuln/detail/CVE-2026-64830", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64830", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e162935ebcdaf3bcecd8a083ec8f3fbdce2b3610a5e284e34c4511fe2e315f48", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video file in NVDEC hardware decoder", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64832", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://github.com/advisories/GHSA-jc8j-9799-c943", "https://nvd.nist.gov/vuln/detail/CVE-2026-64832", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64832", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ba3ac2d81292f931459c15d7893845a4a79f61716484c8f261750ce7d2ddcb0a", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in S/PDIF muxer", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.1, "V40Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64833", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://github.com/advisories/GHSA-34g6-m4cp-w5c9", "https://nvd.nist.gov/vuln/detail/CVE-2026-64833", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64833", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:619a68de2b5e8c3098ffaadc099e34b3577324a5e90bd76648eb686338ef2f79", "Title": "FFmpeg: Denial of Service via crafted RTP/ASF stream", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64834", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://github.com/advisories/GHSA-5xcx-3qx2-qv4x", "https://nvd.nist.gov/vuln/detail/CVE-2026-64834", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64834", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c0fe420bdd25a1c1055e2241fc1bed8230262f4d371863f72c4e38a9bb842d0e", "Title": "FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64835", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://github.com/advisories/GHSA-p2v8-4c4f-rwpq", "https://nvd.nist.gov/vuln/detail/CVE-2026-64835", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64835", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aeca2bb34d5c71e079f466a0d009e5056b2675ed39f82ead987b5d03da452abc", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66036", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://github.com/advisories/GHSA-575m-jfmw-q76c", "https://nvd.nist.gov/vuln/detail/CVE-2026-66036", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66036", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-08-07T01:05:17.87Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cdcb2e7c42a45729587fb66088865a7a78857fcc664ae0224646c2de502af95b", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-190" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66039", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://github.com/advisories/GHSA-84qc-6h9r-4w33", "https://nvd.nist.gov/vuln/detail/CVE-2026-66039", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66039", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-08-07T00:46:17.303Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:24ae8c524d3df89e9b0e822976be1f041a5ecb8f9a535224a77236cb73ba3cd0", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PNG image", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66040", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://github.com/advisories/GHSA-6vcg-882j-82v5", "https://nvd.nist.gov/vuln/detail/CVE-2026-66040", "https://www.cve.org/CVERecord?id=CVE-2026-66040", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-08-07T00:35:29.773Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ff1e57ba617b6771854f04d3e10bbdef6f5b208272082b838036fb070a026dc9", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PGS/SUP subtitle file", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66041", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://github.com/advisories/GHSA-frhp-m687-9g3q", "https://nvd.nist.gov/vuln/detail/CVE-2026-66041", "https://www.cve.org/CVERecord?id=CVE-2026-66041", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-70628", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70628", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1734b61c23b6d49d6951c3c79b0c1d184e475b972647ca0fb78daad5e72ee6a9", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser", "Description": "FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70628", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897", "https://github.com/advisories/GHSA-qw9h-2hhv-hpfr", "https://nvd.nist.gov/vuln/detail/CVE-2026-70628", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70628", "https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file" ], "PublishedDate": "2026-08-06T22:18:26.957Z", "LastModifiedDate": "2026-09-01T15:36:28.407Z" }, { "VulnerabilityID": "CVE-2026-70632", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70632", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:16f756fca8c5592ad0cc8898210121ac1029cc47e5c286c61a9d9c76c8b884b0", "Title": "ffmpeg: FFmpeg: Arbitrary Code Execution in CFHD Decoder via Crafted AVI File", "Description": "FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898", "https://github.com/advisories/GHSA-q24x-99v6-6hxc", "https://nvd.nist.gov/vuln/detail/CVE-2026-70632", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70632", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing" ], "PublishedDate": "2026-08-06T22:18:27.567Z", "LastModifiedDate": "2026-09-01T15:32:31.087Z" }, { "VulnerabilityID": "CVE-2026-75141", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:716c86a9f0ef55ef8e1d0742615a49d2e3e4ade5b3117cd41b13bcd8577426a9", "Title": "ffmpeg: FFmpeg: Heap buffer overflow via crafted HEVC input file during muxing", "Description": "FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75141", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088", "https://nvd.nist.gov/vuln/detail/CVE-2026-75141", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75141", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing" ], "PublishedDate": "2026-08-19T17:21:12.287Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75142", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75142", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0fc2eb4dd421d82a8e5cabd1a7427abb6aad1e09fdceee5b3784579b175c65b4", "Title": "ffmpeg: FFmpeg: Stack Buffer Overflow in MPEG-PS Muxer", "Description": "FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75142", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087", "https://nvd.nist.gov/vuln/detail/CVE-2026-75142", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75142", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c" ], "PublishedDate": "2026-08-19T17:21:12.437Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75143", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:82fc2cca24eb886dac00a39c279ed9c839fef27bda18aa971d773790a17cb522", "Title": "ffmpeg: FFmpeg Heap Buffer Overflow via RIST Protocol Reader", "Description": "FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75143", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089", "https://nvd.nist.gov/vuln/detail/CVE-2026-75143", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75143", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader" ], "PublishedDate": "2026-08-19T17:21:12.577Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75144", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0fbf2686a1f380f8beec10fa1aa6f69bc7a8280e3a022fdde278cf1ad2611f96", "Title": "ffmpeg: FFmpeg: Memory corruption via crafted Dirac data unit", "Description": "FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75144", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091", "https://nvd.nist.gov/vuln/detail/CVE-2026-75144", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75144", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer" ], "PublishedDate": "2026-08-19T17:21:12.72Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75146", "PkgID": "libswresample5@7:7.1.5-0+deb13u1", "PkgName": "libswresample5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample5@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "5a906806615a9741" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75146", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6177d48715fde237454173f44f3c285ee3103bb7fe426c61b9238a706d42a217", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer", "Description": "FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75146", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093", "https://nvd.nist.gov/vuln/detail/CVE-2026-75146", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75146", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c" ], "PublishedDate": "2026-08-19T17:21:13.057Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aeed271997e482e9e693033dbbeb5cf778fa1d186be3431b47883a82d6dad75e", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.6, "V40Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/errata/RHSA-2026:51180", "https://access.redhat.com/errata/RHSA-2026:52832", "https://access.redhat.com/errata/RHSA-2026:52833", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61627", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:61629", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/advisories/GHSA-mjxr-6gqf-w78h", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://ubuntu.com/security/notices/USN-8750-1", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-09-01T13:19:51.89Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:55a6959defeefbefe961457ab6ad7442c41e1303bb97edbf48be722bdfefe0c9", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64830", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://github.com/advisories/GHSA-jphx-q7f7-4x8r", "https://nvd.nist.gov/vuln/detail/CVE-2026-64830", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64830", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:960883e337c26ec3ed04efe6886273fb9c1878c8942614858a8884a28caff6a7", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video file in NVDEC hardware decoder", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64832", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://github.com/advisories/GHSA-jc8j-9799-c943", "https://nvd.nist.gov/vuln/detail/CVE-2026-64832", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64832", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:43b66d537ff60aa5de42462dd7fa3c1f219426db0574f7ffa8c660635348c265", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in S/PDIF muxer", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.1, "V40Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64833", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://github.com/advisories/GHSA-34g6-m4cp-w5c9", "https://nvd.nist.gov/vuln/detail/CVE-2026-64833", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64833", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f0f173a36d4c48aa209fd4b1b4b8487d19735c95e71c2793cee59ba470f3eeaf", "Title": "FFmpeg: Denial of Service via crafted RTP/ASF stream", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64834", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://github.com/advisories/GHSA-5xcx-3qx2-qv4x", "https://nvd.nist.gov/vuln/detail/CVE-2026-64834", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64834", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c3164af8e5d94fb87f3178a26dd39fa2b40743cc546b78d0f575791e3b99d57c", "Title": "FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64835", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://github.com/advisories/GHSA-p2v8-4c4f-rwpq", "https://nvd.nist.gov/vuln/detail/CVE-2026-64835", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-64835", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-10-24T15:10:00.19Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:61e120910ab82b6d6fb940b8c3c5a0cb2d3cbb8e48d91b6c5eedb6cd068b6d09", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66036", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://github.com/advisories/GHSA-575m-jfmw-q76c", "https://nvd.nist.gov/vuln/detail/CVE-2026-66036", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66036", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-08-07T01:05:17.87Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6a10703fe4976639e74319cd4550ea788797419c52d91afecf388aa59cef57fe", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-190" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66039", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://github.com/advisories/GHSA-84qc-6h9r-4w33", "https://nvd.nist.gov/vuln/detail/CVE-2026-66039", "https://ubuntu.com/security/notices/USN-8671-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-66039", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-08-07T00:46:17.303Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6e6f6dd8eb7610abc7d23fb8fc5a26c1e3bdebb389ce8cfaebdbd31ada5e71d8", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PNG image", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.8, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66040", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://github.com/advisories/GHSA-6vcg-882j-82v5", "https://nvd.nist.gov/vuln/detail/CVE-2026-66040", "https://www.cve.org/CVERecord?id=CVE-2026-66040", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-08-07T00:35:29.773Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b78ba25a0764ee062a0f03758e3821d7d8f19d4af223b076531b145c67912b82", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted PGS/SUP subtitle file", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-66041", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://github.com/advisories/GHSA-frhp-m687-9g3q", "https://nvd.nist.gov/vuln/detail/CVE-2026-66041", "https://www.cve.org/CVERecord?id=CVE-2026-66041", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-70628", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70628", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4fba581141f069752fe32279d8a419c539f75e589d41ec45a726ce33f32a460f", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser", "Description": "FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70628", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/02fc47e13f903768b75f7985a2706a6223ab4506", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae68322720d10188fc6e30", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c6ec28b18cd1eb7d39e6163137367f2d1c62aa7c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23897", "https://github.com/advisories/GHSA-qw9h-2hhv-hpfr", "https://nvd.nist.gov/vuln/detail/CVE-2026-70628", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70628", "https://www.vulncheck.com/advisories/ffmpeg-dvb-subtitle-parser-heap-buffer-overflow-via-wtv-file" ], "PublishedDate": "2026-08-06T22:18:26.957Z", "LastModifiedDate": "2026-09-01T15:36:28.407Z" }, { "VulnerabilityID": "CVE-2026-70632", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-70632", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:49a74036d2ade21ea6121986f93a8cf16c7cf4c0a57b5a62ab065331b45bff40", "Title": "ffmpeg: FFmpeg: Arbitrary Code Execution in CFHD Decoder via Crafted AVI File", "Description": "FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 8.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-70632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898", "https://github.com/advisories/GHSA-q24x-99v6-6hxc", "https://nvd.nist.gov/vuln/detail/CVE-2026-70632", "https://ubuntu.com/security/notices/USN-8680-1", "https://ubuntu.com/security/notices/USN-8738-1", "https://www.cve.org/CVERecord?id=CVE-2026-70632", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing" ], "PublishedDate": "2026-08-06T22:18:27.567Z", "LastModifiedDate": "2026-09-01T15:32:31.087Z" }, { "VulnerabilityID": "CVE-2026-75141", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9ca4797645fad415defa9bf298814bf1cb3d3a5eacc1ad4de3e7f0dd44ae6b29", "Title": "ffmpeg: FFmpeg: Heap buffer overflow via crafted HEVC input file during muxing", "Description": "FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75141", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24088", "https://nvd.nist.gov/vuln/detail/CVE-2026-75141", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75141", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-hvcc-box-writer-via-hevc-muxing" ], "PublishedDate": "2026-08-19T17:21:12.287Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75142", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75142", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b576e36cc9964fd30971129a7108ab2ceda5804b3693de5ab12d6576402c7a8a", "Title": "ffmpeg: FFmpeg: Stack Buffer Overflow in MPEG-PS Muxer", "Description": "FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75142", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087", "https://nvd.nist.gov/vuln/detail/CVE-2026-75142", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75142", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c" ], "PublishedDate": "2026-08-19T17:21:12.437Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75143", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:17d7b2d43eb6d2d6ecf76e7ca14257b80c96a0499ad24443bd14d871a39820bb", "Title": "ffmpeg: FFmpeg Heap Buffer Overflow via RIST Protocol Reader", "Description": "FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75143", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089", "https://nvd.nist.gov/vuln/detail/CVE-2026-75143", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75143", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader" ], "PublishedDate": "2026-08-19T17:21:12.577Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75144", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cf1a804a804a15c99950ecac3324d658bbd0aa2b48bcd0b68f4b74ad60d8fac0", "Title": "ffmpeg: FFmpeg: Memory corruption via crafted Dirac data unit", "Description": "FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75144", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091", "https://nvd.nist.gov/vuln/detail/CVE-2026-75144", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75144", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer" ], "PublishedDate": "2026-08-19T17:21:12.72Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-75146", "PkgID": "libswscale8@7:7.1.5-0+deb13u1", "PkgName": "libswscale8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale8@7.1.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=7", "UID": "74083c1caf8a1c37" }, "InstalledVersion": "7:7.1.5-0+deb13u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-75146", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d8d6321ed95701ebd05b26c5a2e65eef74300c141747acd379deb5101191dba2", "Title": "ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer", "Description": "FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-75146", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093", "https://nvd.nist.gov/vuln/detail/CVE-2026-75146", "https://ubuntu.com/security/notices/USN-8716-1", "https://ubuntu.com/security/notices/USN-8716-2", "https://www.cve.org/CVERecord?id=CVE-2026-75146", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c" ], "PublishedDate": "2026-08-19T17:21:13.057Z", "LastModifiedDate": "2026-10-26T11:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-16742", "PkgID": "libsystemd0@257.13-1~deb13u1", "PkgName": "libsystemd0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsystemd0@257.13-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "a2b4ba47389f858e" }, "InstalledVersion": "257.13-1~deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16742", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:637c8a4741e35c85d8cae514ab662bfab237adc9537326d0c15d192aefdd252f", "Title": "systemd: systemd-homed: Local privilege escalation via missing home-record signature verification", "Description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16742", "https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv", "https://nvd.nist.gov/vuln/detail/CVE-2026-16742", "https://ubuntu.com/security/notices/USN-8626-1", "https://www.cve.org/CVERecord?id=CVE-2026-16742" ], "PublishedDate": "2026-08-10T14:17:21.277Z", "LastModifiedDate": "2026-10-23T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-36849", "PkgID": "libtiff6@4.7.0-3+deb13u3", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "9dd8411c2ec5ec7c" }, "InstalledVersion": "4.7.0-3+deb13u3", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-36849", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f87e898cb7b3f13a389ab0ca6bc5476583a620d2a70703ed62adac7a21151155", "Title": "[Denial of Service via large SamplesPerPixel tag]", "Description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2026-36849:\n\tDenial of Service via large SamplesPerPixel tag\n\nCVE-2026-12912:\n\tA flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).\n", "Severity": "HIGH", "VendorSeverity": { "amazon": 3 } }, { "VulnerabilityID": "CVE-2026-52490", "PkgID": "libtiff6@4.7.0-3+deb13u3", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "9dd8411c2ec5ec7c" }, "InstalledVersion": "4.7.0-3+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52490", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd07f1aa364b79ffd9ba80ac1ba76abf682d60e4bd3a6f40b79f605e1397d1c0", "Title": "libtiff: libtiff: Arbitrary code execution via process_command_opts() function", "Description": "An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c", "Severity": "HIGH", "CweIDs": [ "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69095", "https://access.redhat.com/security/cve/CVE-2026-52490", "https://bugzilla.redhat.com/2523148", "https://bugzilla.redhat.com/show_bug.cgi?id=2523148", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52490", "https://errata.almalinux.org/8/ALSA-2026-69095.html", "https://errata.rockylinux.org/RLSA-2026:69095", "https://gist.github.com/okyfh/122c2d72e991a78c8af80a3af3be8671", "https://gitlab.com/libtiff/libtiff/-/work_items/846", "https://linux.oracle.com/cve/CVE-2026-52490.html", "https://linux.oracle.com/errata/ELSA-2026-69095.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-52490", "https://www.cve.org/CVERecord?id=CVE-2026-52490" ], "PublishedDate": "2026-08-24T21:17:19.803Z", "LastModifiedDate": "2026-10-12T21:10:00.227Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "libtinfo6@6.5+20250216-2", "PkgName": "libtinfo6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.6", "UID": "ba2c2b464f07108a" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0f7ee625d62c7e95acdd7f30e983b18e208ec3ee974f6cca01ce7592ad5180b6", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-16742", "PkgID": "libudev1@257.13-1~deb13u1", "PkgName": "libudev1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libudev1@257.13-1~deb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "3b7a2f1a9ab169b" }, "InstalledVersion": "257.13-1~deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16742", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:436890be00cb58af14eef8d3a251688e167fd7b422aa1303ccee7fe96bf5e049", "Title": "systemd: systemd-homed: Local privilege escalation via missing home-record signature verification", "Description": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16742", "https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv", "https://nvd.nist.gov/vuln/detail/CVE-2026-16742", "https://ubuntu.com/security/notices/USN-8626-1", "https://www.cve.org/CVERecord?id=CVE-2026-16742" ], "PublishedDate": "2026-08-10T14:17:21.277Z", "LastModifiedDate": "2026-10-23T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libuuid1@2.41.5-0+deb13u1", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "67cba3b022acab2f" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b682100570dff785d897c768c2c469a7ad19ba74a7ff46f0855d8e9f0316c2fb", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libuuid1@2.41.5-0+deb13u1", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "67cba3b022acab2f" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:91162504ab6757583e2e7027ee0c3cc3253a4ca4326363ff93c1ecac0a3d58d2", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "libuuid1@2.41.5-0+deb13u1", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "67cba3b022acab2f" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:278fa0f555c393368b996eae8f90c6dc9c9d6d9655266d00f90c564f5560a70d", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libuuid1@2.41.5-0+deb13u1", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "67cba3b022acab2f" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b63df19f5c39cc1ad7025dc330415aa2bc6c7c25543157cce37e635f8e7bc304", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-88806", "PkgID": "libx11-6@2:1.8.12-1", "PkgName": "libx11-6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libx11-6@1.8.12-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "3d1913efb366978c" }, "InstalledVersion": "2:1.8.12-1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-88806", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6749dba96a4909916c1036037c2e599234694645b627ad36acaada80a2a8e741", "Title": "libX11: libX11: Heap-based buffer overflow via malicious X server", "Description": "A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:91365", "https://access.redhat.com/security/cve/CVE-2026-88806", "https://bugzilla.redhat.com/2538514", "https://bugzilla.redhat.com/show_bug.cgi?id=2538514", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88806", "https://errata.almalinux.org/9/ALSA-2026-91365.html", "https://errata.rockylinux.org/RLSA-2026:91365", "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309", "https://linux.oracle.com/cve/CVE-2026-88806.html", "https://linux.oracle.com/errata/ELSA-2026-91366.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-88806", "https://ubuntu.com/security/notices/USN-8913-1", "https://www.cve.org/CVERecord?id=CVE-2026-88806" ], "PublishedDate": "2026-09-21T14:17:22.273Z", "LastModifiedDate": "2026-09-22T19:40:05.87Z" }, { "VulnerabilityID": "CVE-2026-88806", "PkgID": "libx11-data@2:1.8.12-1", "PkgName": "libx11-data", "PkgIdentifier": { "PURL": "pkg:deb/debian/libx11-data@1.8.12-1?arch=all\u0026distro=debian-13.6\u0026epoch=2", "UID": "e6b7a201b95ba699" }, "InstalledVersion": "2:1.8.12-1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-88806", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9238df492f9e7a48ec4ea5a741237fbc1b4dde3c683c1a0835c06ad245a7b92f", "Title": "libX11: libX11: Heap-based buffer overflow via malicious X server", "Description": "A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:91365", "https://access.redhat.com/security/cve/CVE-2026-88806", "https://bugzilla.redhat.com/2538514", "https://bugzilla.redhat.com/show_bug.cgi?id=2538514", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88806", "https://errata.almalinux.org/9/ALSA-2026-91365.html", "https://errata.rockylinux.org/RLSA-2026:91365", "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309", "https://linux.oracle.com/cve/CVE-2026-88806.html", "https://linux.oracle.com/errata/ELSA-2026-91366.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-88806", "https://ubuntu.com/security/notices/USN-8913-1", "https://www.cve.org/CVERecord?id=CVE-2026-88806" ], "PublishedDate": "2026-09-21T14:17:22.273Z", "LastModifiedDate": "2026-09-22T19:40:05.87Z" }, { "VulnerabilityID": "CVE-2026-88806", "PkgID": "libx11-xcb1@2:1.8.12-1", "PkgName": "libx11-xcb1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libx11-xcb1@1.8.12-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "fe2eb71291470eee" }, "InstalledVersion": "2:1.8.12-1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-88806", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:62313f386ec54c427c1b4b50c965ed3d6eac613de2ad378329bf4cdd8e9d62c1", "Title": "libX11: libX11: Heap-based buffer overflow via malicious X server", "Description": "A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:91365", "https://access.redhat.com/security/cve/CVE-2026-88806", "https://bugzilla.redhat.com/2538514", "https://bugzilla.redhat.com/show_bug.cgi?id=2538514", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88806", "https://errata.almalinux.org/9/ALSA-2026-91365.html", "https://errata.rockylinux.org/RLSA-2026:91365", "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309", "https://linux.oracle.com/cve/CVE-2026-88806.html", "https://linux.oracle.com/errata/ELSA-2026-91366.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-88806", "https://ubuntu.com/security/notices/USN-8913-1", "https://www.cve.org/CVERecord?id=CVE-2026-88806" ], "PublishedDate": "2026-09-21T14:17:22.273Z", "LastModifiedDate": "2026-09-22T19:40:05.87Z" }, { "VulnerabilityID": "CVE-2026-109089", "PkgID": "libxi6@2:1.8.2-1", "PkgName": "libxi6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxi6@1.8.2-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "f3f24dbe9be44454" }, "InstalledVersion": "2:1.8.2-1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109089", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:909d3c74dcc403040d63c87699c1647d9b3c724dc221ca30f369961e1e206043", "Title": "libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow", "Description": "A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93439", "https://access.redhat.com/security/cve/CVE-2026-109089", "https://bugzilla.redhat.com/show_bug.cgi?id=2562069", "https://bugzilla.redhat.com/show_bug.cgi?id=2562191", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109089", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109090", "https://errata.almalinux.org/9/ALSA-2026-93439.html", "https://errata.rockylinux.org/RLSA-2026:93439", "https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/f7836d0a0", "https://linux.oracle.com/cve/CVE-2026-109089.html", "https://linux.oracle.com/errata/ELSA-2026-93441.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109089", "https://www.cve.org/CVERecord?id=CVE-2026-109089" ], "PublishedDate": "2026-10-27T17:16:57.81Z", "LastModifiedDate": "2026-11-04T21:17:47.61Z" }, { "VulnerabilityID": "CVE-2026-109090", "PkgID": "libxi6@2:1.8.2-1", "PkgName": "libxi6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxi6@1.8.2-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=2", "UID": "f3f24dbe9be44454" }, "InstalledVersion": "2:1.8.2-1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-109090", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5cc6c0c110591f892fae04867b088335668955ea7decd13c831199d278d6ca36", "Title": "libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply", "Description": "A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93439", "https://access.redhat.com/security/cve/CVE-2026-109090", "https://bugzilla.redhat.com/show_bug.cgi?id=2562069", "https://bugzilla.redhat.com/show_bug.cgi?id=2562191", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109089", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109090", "https://errata.almalinux.org/9/ALSA-2026-93439.html", "https://errata.rockylinux.org/RLSA-2026:93439", "https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b6", "https://linux.oracle.com/cve/CVE-2026-109090.html", "https://linux.oracle.com/errata/ELSA-2026-93441.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109090", "https://www.cve.org/CVERecord?id=CVE-2026-109090" ], "PublishedDate": "2026-10-27T17:16:57.93Z", "LastModifiedDate": "2026-11-04T21:17:47.743Z" }, { "VulnerabilityID": "CVE-2026-6653", "PkgID": "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "165365e2b028ae73" }, "InstalledVersion": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6653", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ad222df797d28205ab14fe5815fbaee7aac49b5f33ee7f00d8518a5dcc987da3", "Title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free", "Description": "Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.", "Severity": "CRITICAL", "CweIDs": [ "CWE-416", "CWE-611" ], "VendorSeverity": { "alma": 2, "amazon": 2, "julia": 3, "nvd": 4, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "V3Score": 9.8, "V40Score": 7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:61247", "https://access.redhat.com/security/cve/CVE-2026-6653", "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260", "https://bugzilla.redhat.com/2491354", "https://bugzilla.redhat.com/2494191", "https://bugzilla.redhat.com/show_bug.cgi?id=2491354", "https://bugzilla.redhat.com/show_bug.cgi?id=2494191", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6653", "https://errata.almalinux.org/9/ALSA-2026-61247.html", "https://errata.rockylinux.org/RLSA-2026:61247", "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058", "https://linux.oracle.com/cve/CVE-2026-6653.html", "https://linux.oracle.com/errata/ELSA-2026-69655.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-6653", "https://ubuntu.com/security/notices/USN-8456-1", "https://www.cve.org/CVERecord?id=CVE-2026-6653" ], "PublishedDate": "2026-06-22T14:17:51.113Z", "LastModifiedDate": "2026-10-25T23:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-74860", "PkgID": "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "165365e2b028ae73" }, "InstalledVersion": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-74860", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4066ae5c2431132b126c8dc45434f01811d0fafd73922c273cd0a6c6d158fae0", "Title": "libxml2: double-free/UAF in libxml2 Python bindings", "Description": "A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.", "Severity": "HIGH", "CweIDs": [ "CWE-763" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:64463", "https://access.redhat.com/errata/RHSA-2026:71585", "https://access.redhat.com/errata/RHSA-2026:71586", "https://access.redhat.com/errata/RHSA-2026:71641", "https://access.redhat.com/errata/RHSA-2026:72470", "https://access.redhat.com/errata/RHSA-2026:72475", "https://access.redhat.com/errata/RHSA-2026:72476", "https://access.redhat.com/errata/RHSA-2026:79357", "https://access.redhat.com/errata/RHSA-2026:82939", "https://access.redhat.com/errata/RHSA-2026:89750", "https://access.redhat.com/errata/RHSA-2026:89759", "https://access.redhat.com/errata/RHSA-2026:90309", "https://access.redhat.com/errata/RHSA-2026:91202", "https://access.redhat.com/errata/RHSA-2026:91204", "https://access.redhat.com/errata/RHSA-2026:91206", "https://access.redhat.com/errata/RHSA-2026:91207", "https://access.redhat.com/errata/RHSA-2026:91217", "https://access.redhat.com/errata/RHSA-2026:91218", "https://access.redhat.com/errata/RHSA-2026:91219", "https://access.redhat.com/errata/RHSA-2026:91224", "https://access.redhat.com/errata/RHSA-2026:91232", "https://access.redhat.com/errata/RHSA-2026:91233", "https://access.redhat.com/errata/RHSA-2026:91234", "https://access.redhat.com/errata/RHSA-2026:91235", "https://access.redhat.com/errata/RHSA-2026:91236", "https://access.redhat.com/errata/RHSA-2026:91237", "https://access.redhat.com/errata/RHSA-2026:91238", "https://access.redhat.com/errata/RHSA-2026:91241", "https://access.redhat.com/errata/RHSA-2026:91242", "https://access.redhat.com/errata/RHSA-2026:91243", "https://access.redhat.com/errata/RHSA-2026:91244", "https://access.redhat.com/errata/RHSA-2026:91245", "https://access.redhat.com/errata/RHSA-2026:91246", "https://access.redhat.com/errata/RHSA-2026:91248", "https://access.redhat.com/errata/RHSA-2026:91249", "https://access.redhat.com/errata/RHSA-2026:92352", "https://access.redhat.com/errata/RHSA-2026:92589", "https://access.redhat.com/errata/RHSA-2026:93463", "https://access.redhat.com/errata/RHSA-2026:93473", "https://access.redhat.com/errata/RHSA-2026:93791", "https://access.redhat.com/errata/RHSA-2026:94459", "https://access.redhat.com/errata/RHSA-2026:94468", "https://access.redhat.com/errata/RHSA-2026:94474", "https://access.redhat.com/errata/RHSA-2026:94476", "https://access.redhat.com/security/cve/CVE-2026-74860", "https://bugzilla.redhat.com/2528986", "https://bugzilla.redhat.com/2528987", "https://bugzilla.redhat.com/2528989", "https://bugzilla.redhat.com/2528990", "https://bugzilla.redhat.com/2528992", "https://bugzilla.redhat.com/2529697", "https://bugzilla.redhat.com/show_bug.cgi?id=2528986", "https://bugzilla.redhat.com/show_bug.cgi?id=2528987", "https://bugzilla.redhat.com/show_bug.cgi?id=2528989", "https://bugzilla.redhat.com/show_bug.cgi?id=2528990", "https://bugzilla.redhat.com/show_bug.cgi?id=2528992", "https://bugzilla.redhat.com/show_bug.cgi?id=2529697", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144", "https://errata.almalinux.org/9/ALSA-2026-71585.html", "https://errata.rockylinux.org/RLSA-2026:71585", "https://linux.oracle.com/cve/CVE-2026-74860.html", "https://linux.oracle.com/errata/ELSA-2026-71641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-74860", "https://ubuntu.com/security/notices/USN-8787-1", "https://www.cve.org/CVERecord?id=CVE-2026-74860" ], "PublishedDate": "2026-09-08T12:16:58.083Z", "LastModifiedDate": "2026-11-06T07:17:46.083Z" }, { "VulnerabilityID": "CVE-2026-86138", "PkgID": "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "165365e2b028ae73" }, "InstalledVersion": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86138", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:434e5d20f29fffcd708132a82d0eab5326d58e729cb478a7caeee6bf314be59c", "Title": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow", "Description": "In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71585", "https://access.redhat.com/security/cve/CVE-2026-86138", "https://bugzilla.redhat.com/2528986", "https://bugzilla.redhat.com/2528987", "https://bugzilla.redhat.com/2528989", "https://bugzilla.redhat.com/2528990", "https://bugzilla.redhat.com/2528992", "https://bugzilla.redhat.com/2529697", "https://bugzilla.redhat.com/show_bug.cgi?id=2528986", "https://bugzilla.redhat.com/show_bug.cgi?id=2528987", "https://bugzilla.redhat.com/show_bug.cgi?id=2528989", "https://bugzilla.redhat.com/show_bug.cgi?id=2528990", "https://bugzilla.redhat.com/show_bug.cgi?id=2528992", "https://bugzilla.redhat.com/show_bug.cgi?id=2529697", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144", "https://errata.almalinux.org/9/ALSA-2026-71585.html", "https://errata.rockylinux.org/RLSA-2026:71585", "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://linux.oracle.com/cve/CVE-2026-86138.html", "https://linux.oracle.com/errata/ELSA-2026-71641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86138", "https://ubuntu.com/security/notices/USN-8910-1", "https://www.cve.org/CVERecord?id=CVE-2026-86138" ], "PublishedDate": "2026-09-05T05:17:12.6Z", "LastModifiedDate": "2026-09-15T19:40:47.56Z" }, { "VulnerabilityID": "CVE-2026-86139", "PkgID": "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "165365e2b028ae73" }, "InstalledVersion": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86139", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:723b8347416d909bd4b5683c6621480c58c2b67e6b8cca3609b5a6b6cbc3711f", "Title": "libxml2: libxml2: Integer overflow in xmlURIEscapeStr may lead to arbitrary code execution", "Description": "In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-86139", "https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://nvd.nist.gov/vuln/detail/CVE-2026-86139", "https://ubuntu.com/security/notices/USN-8910-1", "https://www.cve.org/CVERecord?id=CVE-2026-86139" ], "PublishedDate": "2026-09-05T05:17:12.73Z", "LastModifiedDate": "2026-09-15T19:39:45.267Z" }, { "VulnerabilityID": "CVE-2026-86140", "PkgID": "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "165365e2b028ae73" }, "InstalledVersion": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86140", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:710b0b1853146b7941eb4fa69fa1b640ea034f90e2a0e05a20b56fb418896f1a", "Title": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements", "Description": "In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71585", "https://access.redhat.com/security/cve/CVE-2026-86140", "https://bugzilla.redhat.com/2528986", "https://bugzilla.redhat.com/2528987", "https://bugzilla.redhat.com/2528989", "https://bugzilla.redhat.com/2528990", "https://bugzilla.redhat.com/2528992", "https://bugzilla.redhat.com/2529697", "https://bugzilla.redhat.com/show_bug.cgi?id=2528986", "https://bugzilla.redhat.com/show_bug.cgi?id=2528987", "https://bugzilla.redhat.com/show_bug.cgi?id=2528989", "https://bugzilla.redhat.com/show_bug.cgi?id=2528990", "https://bugzilla.redhat.com/show_bug.cgi?id=2528992", "https://bugzilla.redhat.com/show_bug.cgi?id=2529697", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144", "https://errata.almalinux.org/9/ALSA-2026-71585.html", "https://errata.rockylinux.org/RLSA-2026:71585", "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://linux.oracle.com/cve/CVE-2026-86140.html", "https://linux.oracle.com/errata/ELSA-2026-71641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86140", "https://ubuntu.com/security/notices/USN-8787-1", "https://www.cve.org/CVERecord?id=CVE-2026-86140" ], "PublishedDate": "2026-09-05T05:17:12.877Z", "LastModifiedDate": "2026-09-15T19:39:17.01Z" }, { "VulnerabilityID": "CVE-2026-86142", "PkgID": "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "165365e2b028ae73" }, "InstalledVersion": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86142", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:07187bf5dfdf043299e6b5f96ea92544a89bfa67a49baa427e9534e5965d552b", "Title": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation", "Description": "In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71585", "https://access.redhat.com/security/cve/CVE-2026-86142", "https://bugzilla.redhat.com/2528986", "https://bugzilla.redhat.com/2528987", "https://bugzilla.redhat.com/2528989", "https://bugzilla.redhat.com/2528990", "https://bugzilla.redhat.com/2528992", "https://bugzilla.redhat.com/2529697", "https://bugzilla.redhat.com/show_bug.cgi?id=2528986", "https://bugzilla.redhat.com/show_bug.cgi?id=2528987", "https://bugzilla.redhat.com/show_bug.cgi?id=2528989", "https://bugzilla.redhat.com/show_bug.cgi?id=2528990", "https://bugzilla.redhat.com/show_bug.cgi?id=2528992", "https://bugzilla.redhat.com/show_bug.cgi?id=2529697", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144", "https://errata.almalinux.org/9/ALSA-2026-71585.html", "https://errata.rockylinux.org/RLSA-2026:71585", "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113", "https://linux.oracle.com/cve/CVE-2026-86142.html", "https://linux.oracle.com/errata/ELSA-2026-80675.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86142", "https://ubuntu.com/security/notices/USN-8910-1", "https://www.cve.org/CVERecord?id=CVE-2026-86142" ], "PublishedDate": "2026-09-05T05:17:13.133Z", "LastModifiedDate": "2026-09-15T19:35:48.663Z" }, { "VulnerabilityID": "CVE-2026-86143", "PkgID": "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "165365e2b028ae73" }, "InstalledVersion": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7a878c9afad0f2afabe26449bb5ff3135975fa7dbae443279dc3d7b0e6aa44da", "Title": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks", "Description": "In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.", "Severity": "HIGH", "CweIDs": [ "CWE-192" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "V3Score": 7.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71585", "https://access.redhat.com/security/cve/CVE-2026-86143", "https://bugzilla.redhat.com/2528986", "https://bugzilla.redhat.com/2528987", "https://bugzilla.redhat.com/2528989", "https://bugzilla.redhat.com/2528990", "https://bugzilla.redhat.com/2528992", "https://bugzilla.redhat.com/2529697", "https://bugzilla.redhat.com/show_bug.cgi?id=2528986", "https://bugzilla.redhat.com/show_bug.cgi?id=2528987", "https://bugzilla.redhat.com/show_bug.cgi?id=2528989", "https://bugzilla.redhat.com/show_bug.cgi?id=2528990", "https://bugzilla.redhat.com/show_bug.cgi?id=2528992", "https://bugzilla.redhat.com/show_bug.cgi?id=2529697", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144", "https://errata.almalinux.org/9/ALSA-2026-71585.html", "https://errata.rockylinux.org/RLSA-2026:71585", "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111", "https://linux.oracle.com/cve/CVE-2026-86143.html", "https://linux.oracle.com/errata/ELSA-2026-71641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86143", "https://ubuntu.com/security/notices/USN-8910-1", "https://www.cve.org/CVERecord?id=CVE-2026-86143" ], "PublishedDate": "2026-09-05T05:17:13.27Z", "LastModifiedDate": "2026-09-15T19:31:15.857Z" }, { "VulnerabilityID": "CVE-2026-86144", "PkgID": "libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=amd64\u0026distro=debian-13.6", "UID": "165365e2b028ae73" }, "InstalledVersion": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:324bf3334605173dc687ce5e67c6cf7c94856a42c3eac0d26a9e8b06a6a038c8", "Title": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.", "Description": "In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).", "Severity": "HIGH", "CweIDs": [ "CWE-669" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "V3Score": 5.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:71585", "https://access.redhat.com/security/cve/CVE-2026-86144", "https://bugzilla.redhat.com/2528986", "https://bugzilla.redhat.com/2528987", "https://bugzilla.redhat.com/2528989", "https://bugzilla.redhat.com/2528990", "https://bugzilla.redhat.com/2528992", "https://bugzilla.redhat.com/2529697", "https://bugzilla.redhat.com/show_bug.cgi?id=2528986", "https://bugzilla.redhat.com/show_bug.cgi?id=2528987", "https://bugzilla.redhat.com/show_bug.cgi?id=2528989", "https://bugzilla.redhat.com/show_bug.cgi?id=2528990", "https://bugzilla.redhat.com/show_bug.cgi?id=2528992", "https://bugzilla.redhat.com/show_bug.cgi?id=2529697", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144", "https://errata.almalinux.org/9/ALSA-2026-71585.html", "https://errata.rockylinux.org/RLSA-2026:71585", "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61", "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4", "https://linux.oracle.com/cve/CVE-2026-86144.html", "https://linux.oracle.com/errata/ELSA-2026-71641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86144", "https://ubuntu.com/security/notices/USN-8910-1", "https://www.cve.org/CVERecord?id=CVE-2026-86144" ], "PublishedDate": "2026-09-05T05:17:13.407Z", "LastModifiedDate": "2026-09-15T19:20:15.06Z" }, { "VulnerabilityID": "CVE-2026-88807", "PkgID": "libxrender1@1:0.9.12-1", "PkgName": "libxrender1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxrender1@0.9.12-1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "ff1f2940366224c0" }, "InstalledVersion": "1:0.9.12-1", "Status": "affected", "Layer": { "DiffID": "sha256:f797a4acb6066e3de55efb936e1789f04707906a08912dcbd5d63cd30252f4ef" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-88807", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ca7986e827a0c365ea80884f0322f85a81f1961393f94c2eae802e5b8a26e220", "Title": "libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats", "Description": "A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:91057", "https://access.redhat.com/security/cve/CVE-2026-88807", "https://bugzilla.redhat.com/2537924", "https://bugzilla.redhat.com/show_bug.cgi?id=2537924", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88807", "https://errata.almalinux.org/9/ALSA-2026-91057.html", "https://errata.rockylinux.org/RLSA-2026:91057", "https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19", "https://linux.oracle.com/cve/CVE-2026-88807.html", "https://linux.oracle.com/errata/ELSA-2026-91267.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-88807", "https://www.cve.org/CVERecord?id=CVE-2026-88807" ], "PublishedDate": "2026-09-21T14:17:22.41Z", "LastModifiedDate": "2026-09-22T19:40:05.87Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "login@1:4.16.0-2+really2.41.5-0+deb13u1", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "10626ee86f1b653f" }, "InstalledVersion": "1:4.16.0-2+really2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:150cfd5fa1e2bd3c7ecc2c8f0fc09c810116ba6438ae6ae5579682820e14473a", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "login@1:4.16.0-2+really2.41.5-0+deb13u1", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "10626ee86f1b653f" }, "InstalledVersion": "1:4.16.0-2+really2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2ae894b1631f4722fb5959c52da66afb2e8c1a2392373b38a8d195846e4ffa43", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "login@1:4.16.0-2+really2.41.5-0+deb13u1", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "10626ee86f1b653f" }, "InstalledVersion": "1:4.16.0-2+really2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:757ef8f6aef798fc979abf0d6c9647ca37c282484f687e780e6c71da661b515d", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "login@1:4.16.0-2+really2.41.5-0+deb13u1", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.16.0-2%2Breally2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "10626ee86f1b653f" }, "InstalledVersion": "1:4.16.0-2+really2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b5791678dcd0337027348ac2c303de3c598e0c30b4c102909f3a098720e56e1a", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "mount@2.41.5-0+deb13u1", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "d781ec5616a75c78" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7220e12eb260fa6e45efb91ff66f1c54963ff898793bd50aa78e0471791fd6fc", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "mount@2.41.5-0+deb13u1", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "d781ec5616a75c78" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1ddb7e99a9ec26ebbee16a3c3db2122bc1461b3ef27e243d332f6aa6306d1d3c", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "mount@2.41.5-0+deb13u1", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "d781ec5616a75c78" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6c3ac1f3baaa27c985471ee5a6dad15e82d4b9e35db61446447f45a87ae56381", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "mount@2.41.5-0+deb13u1", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "d781ec5616a75c78" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:09ce2025ebea21bfb2ba3e40377621939ff6300270e98fd34f321c42199499da", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "ncurses-base@6.5+20250216-2", "PkgName": "ncurses-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all\u0026distro=debian-13.6", "UID": "767a0231348a5cb5" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d50f8b40c3351ad9f8d3b560dcebb7be8216c4a260425fbe84bd2183dfc3d3ee", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "ncurses-bin@6.5+20250216-2", "PkgName": "ncurses-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64\u0026distro=debian-13.6", "UID": "5b541563cf6587e5" }, "InstalledVersion": "6.5+20250216-2", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:35c9504c62b01e1e1c61fc41570b223dc2e95a0543c44dae32cc89d22bef9363", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://github.com/advisories/GHSA-9952-mrqj-h4jh", "https://invisible-island.net/archives/ncurses/6.5", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DSA-6531-1" ], "PkgID": "openssl@3.5.7-1~deb13u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.5.7-1~deb13u2?arch=amd64\u0026distro=debian-13.6", "UID": "4917554de562b1f6" }, "InstalledVersion": "3.5.7-1~deb13u2", "FixedVersion": "3.5.7-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:4d43b7f98e4c38fd2d37f37f1bf9965d2c4018b01453d3b29d924653c3275f4b" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6b8fa8615a88bca017c017be8a9bdc261091edb9058238d5c66635b46557cc53", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-84782", "VendorIDs": [ "DSA-6531-1" ], "PkgID": "openssl-provider-legacy@3.5.7-1~deb13u2", "PkgName": "openssl-provider-legacy", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl-provider-legacy@3.5.7-1~deb13u2?arch=amd64\u0026distro=debian-13.6", "UID": "9d3dbcbe1f7438f6" }, "InstalledVersion": "3.5.7-1~deb13u2", "FixedVersion": "3.5.7-1~deb13u3", "Status": "fixed", "Layer": { "DiffID": "sha256:4d43b7f98e4c38fd2d37f37f1bf9965d2c4018b01453d3b29d924653c3275f4b" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:452f361b1c49b9f7c548e0d480f6b7b544817cd3fa8bc60089b1a104b836cdd4", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-13221", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.6", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:89de878b5cadcbaf2f29f4fbeffd5c629eed7af412ba55dc6675e4b0a34a6b0a", "Title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://access.redhat.com/errata/RHSA-2026:67155", "https://access.redhat.com/security/cve/CVE-2026-13221", "https://bugzilla.redhat.com/2499727", "https://bugzilla.redhat.com/show_bug.cgi?id=2499727", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13221", "https://errata.almalinux.org/9/ALSA-2026-67155.html", "https://errata.rockylinux.org/RLSA-2026:67155", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://linux.oracle.com/cve/CVE-2026-13221.html", "https://linux.oracle.com/errata/ELSA-2026-67278-0.html", "https://lists.security.metacpan.org/cve-announce/msg/41780104/", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-42496", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.6", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b116f2daec3f30130d25713fa0c00695a47c44b5726dd2f9866e4604ae6fc8e1", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-8376", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.6", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e60c375b63d10405883165b0bd8724316e0b7ec7c2a9597eb4a0d9601ea74131", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-09-08T22:19:18.373Z" }, { "VulnerabilityID": "CVE-2026-42497", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.6", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:70dc5351ba6185b1f1dc53d1286191dd4cb85eccdfbc1b2b4f77837eab0ff6e8", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://lists.security.metacpan.org/cve-announce/msg/40396457/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.6", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5cc923c570ab49002ce5de04b83e55cc51ededd77323a6a447582a207ae9ccc4", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/errata/RHSA-2026:50262", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://lists.security.metacpan.org/cve-announce/msg/40434385/", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-08-05T13:23:22.46Z" }, { "VulnerabilityID": "CVE-2026-57432", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.6", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c26459ed8ad6287ad50075fb434ce0e7f3b7eeb3c809a05063e0d8b3d501445e", "Title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations", "Description": "Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://access.redhat.com/security/cve/CVE-2026-57432", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780102/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57433", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.6", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "FixedVersion": "5.40.1-6+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bea3addf7e6076b56a5b6313e96b5a8cee15de8282921bf0feb1b5122433e028", "Title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://access.redhat.com/security/cve/CVE-2026-57433", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://lists.security.metacpan.org/cve-announce/msg/41780100/", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "https://ubuntu.com/security/notices/USN-8675-1", "https://ubuntu.com/security/notices/USN-8675-2", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-10-24T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "perl-base@5.40.1-6", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.40.1-6?arch=amd64\u0026distro=debian-13.6", "UID": "546ba1bdcd66d61" }, "InstalledVersion": "5.40.1-6", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:192cc1c4c4c017b200c56f766d60dfa4c3ace2e974df5d50fce81545f46c0b2b", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/errata/RHSA-2026:49525", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://bugzilla.redhat.com/2481315", "https://bugzilla.redhat.com/show_bug.cgi?id=2481315", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9538", "https://errata.almalinux.org/9/ALSA-2026-49525.html", "https://errata.rockylinux.org/RLSA-2026:49525", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://linux.oracle.com/cve/CVE-2026-9538.html", "https://linux.oracle.com/errata/ELSA-2026-49525.html", "https://lists.security.metacpan.org/cve-announce/msg/40396448/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://ubuntu.com/security/notices/USN-8684-1", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "util-linux@2.41.5-0+deb13u1", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "e4d9863928456765" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d1fe3c8cecd74e44330fd55f964e4f3a11b8158e1a931f42fb373674ec1826a2", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "util-linux@2.41.5-0+deb13u1", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "e4d9863928456765" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:15c564bff47755c42e467f6bf4c23773bfce4a052d51c00d5cab6166b83446d0", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78409", "PkgID": "util-linux@2.41.5-0+deb13u1", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "e4d9863928456765" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8957945fe833ea53ed16e60f1f8e645361afc79681448f8cde82859de977af06", "Title": "util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks", "Description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv", "https://nvd.nist.gov/vuln/detail/CVE-2026-78409", "https://www.cve.org/CVERecord?id=CVE-2026-78409" ], "PublishedDate": "2026-09-02T16:17:23.833Z", "LastModifiedDate": "2026-11-05T00:17:28.61Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "util-linux@2.41.5-0+deb13u1", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.41.5-0%2Bdeb13u1?arch=amd64\u0026distro=debian-13.6", "UID": "e4d9863928456765" }, "InstalledVersion": "2.41.5-0+deb13u1", "Status": "affected", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:62baba76c5dc3066f352f39b18bb642346ffbc06cd142a87797940a8d110fec4", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-76844", "VendorIDs": [ "DSA-6613-1" ], "PkgID": "zlib1g@1:1.3.dfsg+really1.3.1-1+b1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "ff182eb2a26a8142" }, "InstalledVersion": "1:1.3.dfsg+really1.3.1-1+b1", "FixedVersion": "1:1.3.dfsg+really1.3.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76844", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dae2174ffad935cf0848a5b451cea81e273649f93565cde2f58b2a77801bf3e9", "Title": "webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal", "Description": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76844", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148", "https://github.com/webpack/webpack-dev-middleware", "https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js", "https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b", "https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b", "https://github.com/webpack/webpack-dev-middleware/pull/2404", "https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6", "https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0", "https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c", "https://nvd.nist.gov/vuln/detail/CVE-2026-76844", "https://www.cve.org/CVERecord?id=CVE-2026-76844", "https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-08-24T14:17:02.25Z", "LastModifiedDate": "2026-10-12T17:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-85091", "VendorIDs": [ "DSA-6613-1" ], "PkgID": "zlib1g@1:1.3.dfsg+really1.3.1-1+b1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64\u0026distro=debian-13.6\u0026epoch=1", "UID": "ff182eb2a26a8142" }, "InstalledVersion": "1:1.3.dfsg+really1.3.1-1+b1", "FixedVersion": "1:1.3.dfsg+really1.3.1-1+deb13u1", "Status": "fixed", "Layer": { "DiffID": "sha256:411a86676185cb54d695a805b238194a64e9b77e0c723f3802fbb87d333ea0b3" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9e319bd667a81027ab66e77fb2d883e04110865b949d12b3b8afc6ea6cf209b0", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" } ] }, { "Target": "Python", "Class": "lang-pkgs", "Type": "python-pkg", "Packages": [ { "Name": "Jinja2", "Identifier": { "PURL": "pkg:pypi/jinja2@3.1.6", "UID": "1bee0db7a4a5fe9a" }, "Version": "3.1.6", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/jinja2-3.1.6.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "MarkupSafe", "Identifier": { "PURL": "pkg:pypi/markupsafe@3.0.3", "UID": "ab07bf03739ef86" }, "Version": "3.0.3", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/markupsafe-3.0.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "PyYAML", "Identifier": { "PURL": "pkg:pypi/pyyaml@6.0.3", "UID": "200d8384c5c91a41" }, "Version": "6.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/pyyaml-6.0.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "antlr4-python3-runtime", "Identifier": { "PURL": "pkg:pypi/antlr4-python3-runtime@4.9.3", "UID": "fc6c6321b2e951c" }, "Version": "4.9.3", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/antlr4_python3_runtime-4.9.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "anyio", "Identifier": { "PURL": "pkg:pypi/anyio@4.15.1", "UID": "527b59970faa7cdf" }, "Version": "4.15.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/anyio-4.15.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "autocommand", "Identifier": { "PURL": "pkg:pypi/autocommand@2.2.2", "UID": "de2aeb22213f7255" }, "Version": "2.2.2", "Licenses": [ "LGPL-3.0-only" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/autocommand-2.2.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "av", "Identifier": { "PURL": "pkg:pypi/av@18.1.0", "UID": "cfb23ffeb9978c3d" }, "Version": "18.1.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/av-18.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "backports.tarfile", "Identifier": { "PURL": "pkg:pypi/backports.tarfile@1.2.0", "UID": "1333ca5d453000df" }, "Version": "1.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/backports.tarfile-1.2.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "certifi", "Identifier": { "PURL": "pkg:pypi/certifi@2026.7.22", "UID": "fd504eea95509f7" }, "Version": "2026.7.22", "Licenses": [ "MPL-2.0" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/certifi-2026.7.22.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "chardet", "Identifier": { "PURL": "pkg:pypi/chardet@7.6.0", "UID": "27d9611d1202b684" }, "Version": "7.6.0", "Licenses": [ "0BSD" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/chardet-7.6.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "charset-normalizer", "Identifier": { "PURL": "pkg:pypi/charset-normalizer@3.5.1", "UID": "48c83093cf78ff" }, "Version": "3.5.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/charset_normalizer-3.5.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "click", "Identifier": { "PURL": "pkg:pypi/click@8.5.0", "UID": "fbb719e4c671a20a" }, "Version": "8.5.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/click-8.5.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "cloudpickle", "Identifier": { "PURL": "pkg:pypi/cloudpickle@3.1.2", "UID": "b14e43e8dbc40d02" }, "Version": "3.1.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/cloudpickle-3.1.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "ctranslate2", "Identifier": { "PURL": "pkg:pypi/ctranslate2@4.8.2", "UID": "56795a8b4407b961" }, "Version": "4.8.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/ctranslate2-4.8.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "cuda-bindings", "Identifier": { "PURL": "pkg:pypi/cuda-bindings@13.4.2", "UID": "e8173b08979bb4e6" }, "Version": "13.4.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/cuda_bindings-13.4.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "cuda-pathfinder", "Identifier": { "PURL": "pkg:pypi/cuda-pathfinder@1.8.2", "UID": "f3885dc299b23146" }, "Version": "1.8.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/cuda_pathfinder-1.8.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "cuda-toolkit", "Identifier": { "PURL": "pkg:pypi/cuda-toolkit@13.0.3.0", "UID": "ae897260addc3b2b" }, "Version": "13.0.3.0", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/cuda_toolkit-13.0.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "demucs", "Identifier": { "PURL": "pkg:pypi/demucs@4.0.1", "UID": "30bec4877558220e" }, "Version": "4.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/demucs-4.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "dora_search", "Identifier": { "PURL": "pkg:pypi/dora-search@0.1.13", "UID": "25e19cb8fae60b00" }, "Version": "0.1.13", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/dora_search-0.1.13.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "einops", "Identifier": { "PURL": "pkg:pypi/einops@0.8.2", "UID": "d3e31276c1cf60d1" }, "Version": "0.8.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/einops-0.8.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "faster-whisper", "Identifier": { "PURL": "pkg:pypi/faster-whisper@1.2.1", "UID": "df0a6a89dafd82af" }, "Version": "1.2.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/faster_whisper-1.2.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "filelock", "Identifier": { "PURL": "pkg:pypi/filelock@4.0.0", "UID": "9f520f6a76fcfdcb" }, "Version": "4.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/filelock-4.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "flatbuffers", "Identifier": { "PURL": "pkg:pypi/flatbuffers@25.12.19", "UID": "97339adf4ea7133b" }, "Version": "25.12.19", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/flatbuffers-25.12.19.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "fsspec", "Identifier": { "PURL": "pkg:pypi/fsspec@2026.7.0", "UID": "74de9259d6cec119" }, "Version": "2026.7.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/fsspec-2026.7.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "h11", "Identifier": { "PURL": "pkg:pypi/h11@0.16.0", "UID": "455db3a00bf72" }, "Version": "0.16.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/h11-0.16.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "hf-xet", "Identifier": { "PURL": "pkg:pypi/hf-xet@1.6.0", "UID": "1c5c5d58a45ff9f0" }, "Version": "1.6.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/hf_xet-1.6.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "httpcore", "Identifier": { "PURL": "pkg:pypi/httpcore@1.0.9", "UID": "5f1e35fbdba869a3" }, "Version": "1.0.9", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/httpcore-1.0.9.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "httpx", "Identifier": { "PURL": "pkg:pypi/httpx@0.28.1", "UID": "90b35739e155fb56" }, "Version": "0.28.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/httpx-0.28.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "huggingface_hub", "Identifier": { "PURL": "pkg:pypi/huggingface-hub@1.32.0", "UID": "e211f976fcdfcb3f" }, "Version": "1.32.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/huggingface_hub-1.32.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "idna", "Identifier": { "PURL": "pkg:pypi/idna@3.20", "UID": "f918988c150387c6" }, "Version": "3.20", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/idna-3.20.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "importlib_metadata", "Identifier": { "PURL": "pkg:pypi/importlib-metadata@8.0.0", "UID": "347a36bc9e660761" }, "Version": "8.0.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/importlib_metadata-8.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "inflect", "Identifier": { "PURL": "pkg:pypi/inflect@7.3.1", "UID": "51e7d1c898b69383" }, "Version": "7.3.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/inflect-7.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.collections", "Identifier": { "PURL": "pkg:pypi/jaraco.collections@5.1.0", "UID": "b2e77b8a0b175ddd" }, "Version": "5.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.collections-5.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.context", "Identifier": { "PURL": "pkg:pypi/jaraco.context@5.3.0", "UID": "d6550b81e52efabe" }, "Version": "5.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.context-5.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.functools", "Identifier": { "PURL": "pkg:pypi/jaraco.functools@4.0.1", "UID": "f42118e4940a83a5" }, "Version": "4.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.functools-4.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.text", "Identifier": { "PURL": "pkg:pypi/jaraco.text@3.12.1", "UID": "cac1fcd2d9755e50" }, "Version": "3.12.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.text-3.12.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "julius", "Identifier": { "PURL": "pkg:pypi/julius@0.2.8", "UID": "2cbde11ce831d011" }, "Version": "0.2.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/julius-0.2.8.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "lameenc", "Identifier": { "PURL": "pkg:pypi/lameenc@1.8.4", "UID": "bc6c07b8d13c3f9a" }, "Version": "1.8.4", "Licenses": [ "LGPL-3.0-or-later" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/lameenc-1.8.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "llvmlite", "Identifier": { "PURL": "pkg:pypi/llvmlite@0.49.0", "UID": "6192af86c5cf5a19" }, "Version": "0.49.0", "Licenses": [ "BSD-2-Clause AND Apache-2.0 WITH LLVM-exception" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/llvmlite-0.49.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "more-itertools", "Identifier": { "PURL": "pkg:pypi/more-itertools@10.3.0", "UID": "cab6d07375997e08" }, "Version": "10.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/more_itertools-10.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "more-itertools", "Identifier": { "PURL": "pkg:pypi/more-itertools@11.1.0", "UID": "bb91cd38fa08dad0" }, "Version": "11.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/more_itertools-11.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mpmath", "Identifier": { "PURL": "pkg:pypi/mpmath@1.3.0", "UID": "b7debfa0b0345750" }, "Version": "1.3.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/mpmath-1.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "networkx", "Identifier": { "PURL": "pkg:pypi/networkx@3.6.1", "UID": "df3fc3f75ccaf8cd" }, "Version": "3.6.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/networkx-3.6.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "numba", "Identifier": { "PURL": "pkg:pypi/numba@0.67.0", "UID": "756bfca95bd82be9" }, "Version": "0.67.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/numba-0.67.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "numpy", "Identifier": { "PURL": "pkg:pypi/numpy@2.4.6", "UID": "d9c8d8354bc53af0" }, "Version": "2.4.6", "Licenses": [ "BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/numpy-2.4.6.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-cublas", "Identifier": { "PURL": "pkg:pypi/nvidia-cublas@13.1.1.3", "UID": "871c63cd5ab81b3e" }, "Version": "13.1.1.3", "Licenses": [ "LicenseRef-NVIDIA-Proprietary" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_cublas-13.1.1.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-cuda-cupti", "Identifier": { "PURL": "pkg:pypi/nvidia-cuda-cupti@13.0.85", "UID": "798a7e82ba17b626" }, "Version": "13.0.85", "Licenses": [ "Other/Proprietary License" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_cuda_cupti-13.0.85.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-cuda-nvrtc", "Identifier": { "PURL": "pkg:pypi/nvidia-cuda-nvrtc@13.0.88", "UID": "deeea02686bfbfbe" }, "Version": "13.0.88", "Licenses": [ "Other/Proprietary License" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_cuda_nvrtc-13.0.88.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-cuda-runtime", "Identifier": { "PURL": "pkg:pypi/nvidia-cuda-runtime@13.0.96", "UID": "5aa1038b94a0988c" }, "Version": "13.0.96", "Licenses": [ "LicenseRef-NVIDIA-Proprietary" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_cuda_runtime-13.0.96.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-cudnn-cu13", "Identifier": { "PURL": "pkg:pypi/nvidia-cudnn-cu13@9.24.0.43", "UID": "6c12edc4d350203" }, "Version": "9.24.0.43", "Licenses": [ "LicenseRef-NVIDIA-Proprietary" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_cudnn_cu13-9.24.0.43.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-cufft", "Identifier": { "PURL": "pkg:pypi/nvidia-cufft@12.0.0.61", "UID": "b2890923ab3b3e42" }, "Version": "12.0.0.61", "Licenses": [ "Other/Proprietary License" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_cufft-12.0.0.61.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-cufile", "Identifier": { "PURL": "pkg:pypi/nvidia-cufile@1.15.1.6", "UID": "74abae13c722ef93" }, "Version": "1.15.1.6", "Licenses": [ "Other/Proprietary License" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_cufile-1.15.1.6.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-curand", "Identifier": { "PURL": "pkg:pypi/nvidia-curand@10.4.0.35", "UID": "1941e6cef6be6f6" }, "Version": "10.4.0.35", "Licenses": [ "Other/Proprietary License" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_curand-10.4.0.35.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-cusolver", "Identifier": { "PURL": "pkg:pypi/nvidia-cusolver@12.0.4.66", "UID": "634d8c7289798d16" }, "Version": "12.0.4.66", "Licenses": [ "Other/Proprietary License" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_cusolver-12.0.4.66.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-cusparse", "Identifier": { "PURL": "pkg:pypi/nvidia-cusparse@12.6.3.3", "UID": "1ee784e8c501297c" }, "Version": "12.6.3.3", "Licenses": [ "Other/Proprietary License" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_cusparse-12.6.3.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-cusparselt-cu13", "Identifier": { "PURL": "pkg:pypi/nvidia-cusparselt-cu13@0.8.1", "UID": "d920383772473220" }, "Version": "0.8.1", "Licenses": [ "NVIDIA Proprietary Software" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_cusparselt_cu13-0.8.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-nccl-cu13", "Identifier": { "PURL": "pkg:pypi/nvidia-nccl-cu13@2.30.7", "UID": "4342f55c3d6f452a" }, "Version": "2.30.7", "Licenses": [ "LicenseRef-NVIDIA-Proprietary" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_nccl_cu13-2.30.7.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-nvjitlink", "Identifier": { "PURL": "pkg:pypi/nvidia-nvjitlink@13.4.92", "UID": "a96ccbc97580c875" }, "Version": "13.4.92", "Licenses": [ "LicenseRef-NVIDIA-Proprietary" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_nvjitlink-13.4.92.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-nvshmem-cu13", "Identifier": { "PURL": "pkg:pypi/nvidia-nvshmem-cu13@3.4.5", "UID": "43ce781ebb3a059b" }, "Version": "3.4.5", "Licenses": [ "LicenseRef-NVIDIA-Proprietary" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_nvshmem_cu13-3.4.5.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "nvidia-nvtx", "Identifier": { "PURL": "pkg:pypi/nvidia-nvtx@13.0.85", "UID": "d23fcd4f153be686" }, "Version": "13.0.85", "Licenses": [ "Other/Proprietary License" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/nvidia_nvtx-13.0.85.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "omegaconf", "Identifier": { "PURL": "pkg:pypi/omegaconf@2.3.1", "UID": "c27bc782c6d37bc7" }, "Version": "2.3.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/omegaconf-2.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "onnxruntime", "Identifier": { "PURL": "pkg:pypi/onnxruntime@1.30.0", "UID": "5463334161dcfb13" }, "Version": "1.30.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/onnxruntime-1.30.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "openai-whisper", "Identifier": { "PURL": "pkg:pypi/openai-whisper@20250625", "UID": "dcd70a8cd0369f30" }, "Version": "20250625", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/openai_whisper-20250625.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "openunmix", "Identifier": { "PURL": "pkg:pypi/openunmix@1.3.0", "UID": "61b2f28442f22ec4" }, "Version": "1.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/openunmix-1.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "packaging", "Identifier": { "PURL": "pkg:pypi/packaging@24.2", "UID": "dd0943476d1773a8" }, "Version": "24.2", "Licenses": [ "Apache-2.0", "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/packaging-24.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "packaging", "Identifier": { "PURL": "pkg:pypi/packaging@26.3", "UID": "c2637f54d6182f69" }, "Version": "26.3", "Licenses": [ "Apache-2.0 OR BSD-2-Clause" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/packaging-26.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pillow", "Identifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "Version": "12.3.0", "Licenses": [ "MIT-CMU" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pip", "Identifier": { "PURL": "pkg:pypi/pip@24.0", "UID": "7a4293168b845101" }, "Version": "24.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/pip-24.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "platformdirs", "Identifier": { "PURL": "pkg:pypi/platformdirs@4.2.2", "UID": "f93e5b8c438aeaf6" }, "Version": "4.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/platformdirs-4.2.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "protobuf", "Identifier": { "PURL": "pkg:pypi/protobuf@7.36.2", "UID": "42a2e443a415ad46" }, "Version": "7.36.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/protobuf-7.36.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pysrt", "Identifier": { "PURL": "pkg:pypi/pysrt@1.1.2", "UID": "7f55aea0100ec55c" }, "Version": "1.1.2", "Licenses": [ "GPL-3.0-or-later" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/pysrt-1.1.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "regex", "Identifier": { "PURL": "pkg:pypi/regex@2026.9.10", "UID": "5d4aab85bd7aab95" }, "Version": "2026.9.10", "Licenses": [ "Apache-2.0 AND CNRI-Python" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/regex-2026.9.10.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "requests", "Identifier": { "PURL": "pkg:pypi/requests@2.34.2", "UID": "ce1642bc91e67c8c" }, "Version": "2.34.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/requests-2.34.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "retrying", "Identifier": { "PURL": "pkg:pypi/retrying@1.4.2", "UID": "b1677925dabaf0b2" }, "Version": "1.4.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/retrying-1.4.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "setuptools", "Identifier": { "PURL": "pkg:pypi/setuptools@79.0.1", "UID": "a34f48aa76be299c" }, "Version": "79.0.1", "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools-79.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "stable-ts", "Identifier": { "PURL": "pkg:pypi/stable-ts@2.19.1", "UID": "49e9f8ddc72fd6f0" }, "Version": "2.19.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/stable_ts-2.19.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "submitit", "Identifier": { "PURL": "pkg:pypi/submitit@1.5.4", "UID": "29c0fc27c50c03d6" }, "Version": "1.5.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/submitit-1.5.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "sympy", "Identifier": { "PURL": "pkg:pypi/sympy@1.14.0", "UID": "b54d9a09c694f273" }, "Version": "1.14.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/sympy-1.14.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tiktoken", "Identifier": { "PURL": "pkg:pypi/tiktoken@0.14.0", "UID": "d1f84c52e89a48fa" }, "Version": "0.14.0", "Licenses": [ "text://MIT License Copyright (c) 2022 OpenAI, Shantanu Jain Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/tiktoken-0.14.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tokenizers", "Identifier": { "PURL": "pkg:pypi/tokenizers@0.23.2", "UID": "74d59af936363aa4" }, "Version": "0.23.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/tokenizers-0.23.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tomli", "Identifier": { "PURL": "pkg:pypi/tomli@2.0.1", "UID": "53abaa0d00072d9e" }, "Version": "2.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/tomli-2.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "torch", "Identifier": { "PURL": "pkg:pypi/torch@2.14.0", "UID": "82b6b81df6bf85da" }, "Version": "2.14.0", "Licenses": [ "Apache-2.0 AND Apache-2.0 WITH LLVM-exception AND BSD-2-Clause AND BSD-3-Clause AND BSL-1.0 AND MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/torch-2.14.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "torchaudio", "Identifier": { "PURL": "pkg:pypi/torchaudio@2.11.0", "UID": "33d40fff0e338f9b" }, "Version": "2.11.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/torchaudio-2.11.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "torchcodec", "Identifier": { "PURL": "pkg:pypi/torchcodec@0.16.0", "UID": "c105908bf95142ca" }, "Version": "0.16.0", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/torchcodec-0.16.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tqdm", "Identifier": { "PURL": "pkg:pypi/tqdm@4.70.1", "UID": "429a90c88d760376" }, "Version": "4.70.1", "Licenses": [ "MPL-2.0 AND MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/tqdm-4.70.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "treetable", "Identifier": { "PURL": "pkg:pypi/treetable@0.2.6", "UID": "4d30ec697c5dfdb5" }, "Version": "0.2.6", "Licenses": [ "Unlicense" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/treetable-0.2.6.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "triton", "Identifier": { "PURL": "pkg:pypi/triton@3.8.0", "UID": "4fc147ba15d597e9" }, "Version": "3.8.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/triton-3.8.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typeguard", "Identifier": { "PURL": "pkg:pypi/typeguard@4.3.0", "UID": "f19abdf9377301a1" }, "Version": "4.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/typeguard-4.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typing_extensions", "Identifier": { "PURL": "pkg:pypi/typing-extensions@4.12.2", "UID": "4b1f19157aef399d" }, "Version": "4.12.2", "Licenses": [ "Python Software Foundation License" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/typing_extensions-4.12.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typing_extensions", "Identifier": { "PURL": "pkg:pypi/typing-extensions@4.16.0", "UID": "14e8a5608945c20e" }, "Version": "4.16.0", "Licenses": [ "PSF-2.0" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/typing_extensions-4.16.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "urllib3", "Identifier": { "PURL": "pkg:pypi/urllib3@2.8.0", "UID": "fd06d6786544a545" }, "Version": "2.8.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "FilePath": "usr/local/lib/python3.11/site-packages/urllib3-2.8.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "wheel", "Identifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "68d1f5691b386b62" }, "Version": "0.45.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/wheel-0.45.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "wheel", "Identifier": { "PURL": "pkg:pypi/wheel@0.46.3", "UID": "28350f0a99874b2b" }, "Version": "0.46.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/wheel-0.46.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "zipp", "Identifier": { "PURL": "pkg:pypi/zipp@3.19.2", "UID": "92d9047d0b817060" }, "Version": "3.19.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/zipp-3.19.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "GHSA-6q48-6c7w-9gw2", "PkgName": "certifi", "PkgPath": "usr/local/lib/python3.11/site-packages/certifi-2026.7.22.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/certifi@2026.7.22", "UID": "fd504eea95509f7" }, "InstalledVersion": "2026.7.22", "FixedVersion": "2026.10.18", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0b46d3d9d90d25306c59fd726273bb3b2cf2fd4b2fd65212b417e5017d2e27ac", "Title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "Description": "Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. \n\nAn attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer.\n\nCertifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.", "Severity": "CRITICAL", "VendorSeverity": { "ghsa": 4 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 9.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-6q48-6c7w-9gw2", "https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576", "https://emudhra.we-have-a-problem.com", "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "https://github.com/certifi/python-certifi", "https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2" ], "PublishedDate": "2026-10-20T19:35:05Z", "LastModifiedDate": "2026-10-26T16:02:12Z" }, { "VulnerabilityID": "CVE-2026-112940", "VendorIDs": [ "GHSA-v4x8-3wr5-3wq8" ], "PkgName": "filelock", "PkgPath": "usr/local/lib/python3.11/site-packages/filelock-4.0.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/filelock@4.0.0", "UID": "9f520f6a76fcfdcb" }, "InstalledVersion": "4.0.0", "FixedVersion": "4.2.1", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112940", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:f82cde05e4d9bb8f0f743a24d792d5d7eecbe26329e193c87195f87ab0ca82ae", "Title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening", "Description": "filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1.", "Severity": "HIGH", "CweIDs": [ "CWE-363", "CWE-59" ], "VendorSeverity": { "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112940", "https://advisory.echohq.com/cve/CVE-2026-112940", "https://github.com/tox-dev/filelock", "https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d", "https://github.com/tox-dev/filelock/pull/834", "https://github.com/tox-dev/filelock/releases/tag/4.2.1", "https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8", "https://nvd.nist.gov/vuln/detail/CVE-2026-112940", "https://www.cve.org/CVERecord?id=CVE-2026-112940" ], "PublishedDate": "2026-10-20T15:17:16.827Z", "LastModifiedDate": "2026-10-22T22:18:02.827Z" }, { "VulnerabilityID": "CVE-2026-23949", "VendorIDs": [ "GHSA-58pv-8j8x-9vj2" ], "PkgName": "jaraco.context", "PkgPath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.context-5.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/jaraco.context@5.3.0", "UID": "d6550b81e52efabe" }, "InstalledVersion": "5.3.0", "FixedVersion": "6.1.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23949", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5927b9d09eda931fd617c4aad368e4ee79950efb9debda3911848e17166abdbc", "Title": "jaraco.context: jaraco.context: Path traversal via malicious tar archives", "Description": "jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23949", "https://advisory.echohq.com/cve/CVE-2026-23949", "https://github.com/jaraco/jaraco.context", "https://github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py#L74-L91", "https://github.com/jaraco/jaraco.context/commit/7b26a42b525735e4085d2e994e13802ea339d5f9", "https://github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2", "https://github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py#L55-L76", "https://nvd.nist.gov/vuln/detail/CVE-2026-23949", "https://ubuntu.com/security/notices/USN-7979-1", "https://www.cve.org/CVERecord?id=CVE-2026-23949" ], "PublishedDate": "2026-01-20T01:15:57.723Z", "LastModifiedDate": "2026-06-17T10:22:20.2Z" }, { "VulnerabilityID": "CVE-2026-112393", "VendorIDs": [ "GHSA-332p-7hrc-92wf" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112393", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:8facf27372d2bb4ea17ef0aae37636b3f08a428699697a4515fe8741ffae1858", "Title": "pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO", "Description": "Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64 KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors are unaffected. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 4, "redhat": 3, "rocky": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93077", "https://access.redhat.com/security/cve/CVE-2026-112393", "https://advisory.echohq.com/cve/CVE-2026-112393", "https://bugzilla.redhat.com/2555846", "https://bugzilla.redhat.com/2555867", "https://bugzilla.redhat.com/2555889", "https://bugzilla.redhat.com/show_bug.cgi?id=2555846", "https://bugzilla.redhat.com/show_bug.cgi?id=2555867", "https://bugzilla.redhat.com/show_bug.cgi?id=2555889", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112393", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112900", "https://errata.almalinux.org/8/ALSA-2026-93077.html", "https://errata.rockylinux.org/RLSA-2026:93077", "https://getsafety.com/v/SFTY-20261021-13350/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/11582e5ffbdceb973d5ee593f3105af5a9852b40", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf", "https://linux.oracle.com/cve/CVE-2026-112393.html", "https://linux.oracle.com/errata/ELSA-2026-93077.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112393", "https://www.cve.org/CVERecord?id=CVE-2026-112393" ], "PublishedDate": "2026-10-19T21:17:07.613Z", "LastModifiedDate": "2026-10-26T21:01:35.733Z" }, { "VulnerabilityID": "CVE-2026-112398", "VendorIDs": [ "GHSA-5x8w-8jj5-q52h" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112398", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:cf2414312a7d824ef777d067a25c0dbb93be501f0ba9049ee5444d9e6ebfd297", "Title": "pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-122", "CWE-787" ], "VendorSeverity": { "alma": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 4, "redhat": 3, "rocky": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93077", "https://access.redhat.com/security/cve/CVE-2026-112398", "https://advisory.echohq.com/cve/CVE-2026-112398", "https://bugzilla.redhat.com/2555846", "https://bugzilla.redhat.com/2555867", "https://bugzilla.redhat.com/2555889", "https://bugzilla.redhat.com/show_bug.cgi?id=2555846", "https://bugzilla.redhat.com/show_bug.cgi?id=2555867", "https://bugzilla.redhat.com/show_bug.cgi?id=2555889", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112393", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112900", "https://errata.almalinux.org/8/ALSA-2026-93077.html", "https://errata.rockylinux.org/RLSA-2026:93077", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h", "https://linux.oracle.com/cve/CVE-2026-112398.html", "https://linux.oracle.com/errata/ELSA-2026-93077.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112398", "https://www.cve.org/CVERecord?id=CVE-2026-112398" ], "PublishedDate": "2026-10-19T22:17:07.107Z", "LastModifiedDate": "2026-10-27T21:01:25.823Z" }, { "VulnerabilityID": "CVE-2026-112403", "VendorIDs": [ "GHSA-8g5g-8vmr-9782" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112403", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:bf61d3a4782bd927043341e255aae9b87a5289ababd4eb0987046721fd0218ff", "Title": "pillow: Pillow: Heap buffer overflow in ImagingJpegDecode", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "bitnami": 4, "ghsa": 4, "nvd": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112403", "https://advisory.echohq.com/cve/CVE-2026-112403", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782", "https://nvd.nist.gov/vuln/detail/CVE-2026-112403", "https://www.cve.org/CVERecord?id=CVE-2026-112403" ], "PublishedDate": "2026-10-19T22:17:07.77Z", "LastModifiedDate": "2026-10-27T15:00:15.043Z" }, { "VulnerabilityID": "CVE-2026-112900", "VendorIDs": [ "GHSA-w889-685w-c8fh" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112900", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:b1dd4e4c12bc5d431981d89c296a9ec71bb89a1f063a34ce13f1dc1d48ae1ba9", "Title": "pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE", "Description": "Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading @ argument-file filename and control of the referenced text file containing additional Ghostscript arguments; the reported chain reproduces with the default -dSAFER invocation. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-78", "CWE-88" ], "VendorSeverity": { "alma": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 4, "redhat": 4, "rocky": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93077", "https://access.redhat.com/security/cve/CVE-2026-112900", "https://advisory.echohq.com/cve/CVE-2026-112900", "https://bugzilla.redhat.com/2555846", "https://bugzilla.redhat.com/2555867", "https://bugzilla.redhat.com/2555889", "https://bugzilla.redhat.com/show_bug.cgi?id=2555846", "https://bugzilla.redhat.com/show_bug.cgi?id=2555867", "https://bugzilla.redhat.com/show_bug.cgi?id=2555889", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112393", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112900", "https://errata.almalinux.org/8/ALSA-2026-93077.html", "https://errata.rockylinux.org/RLSA-2026:93077", "https://getsafety.com/v/SFTY-20261021-11431/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/a2c363141da31a265dd536c945677db4b64f3ec9", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh", "https://linux.oracle.com/cve/CVE-2026-112900.html", "https://linux.oracle.com/errata/ELSA-2026-93077.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112900", "https://www.cve.org/CVERecord?id=CVE-2026-112900" ], "PublishedDate": "2026-10-19T22:17:10.16Z", "LastModifiedDate": "2026-10-27T14:55:00.937Z" }, { "VulnerabilityID": "CVE-2026-96639", "VendorIDs": [ "GHSA-v9pv-5gc8-w2m6" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96639", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:602c4d2796e82372bc1998d1fb4bb473b7b7ebf076982b61ac813a0f77234c1a", "Title": "pillow: Pillow multi-frame loaders can reuse stale native image storage after mode transitions", "Description": "Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-125", "CWE-787" ], "VendorSeverity": { "bitnami": 4, "ghsa": 4, "redhat": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96639", "https://advisory.echohq.com/cve/CVE-2026-96639", "https://github.com/advisories/GHSA-v9pv-5gc8-w2m6", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/78d97d994579aef81aafe123773d525f40f2522a", "https://github.com/python-pillow/Pillow/pull/10105", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-v9pv-5gc8-w2m6", "https://nvd.nist.gov/vuln/detail/CVE-2026-96639", "https://www.cve.org/CVERecord?id=CVE-2026-96639" ], "PublishedDate": "2026-10-21T21:20:32.217Z", "LastModifiedDate": "2026-10-29T11:17:39.023Z" }, { "VulnerabilityID": "CVE-2026-112390", "VendorIDs": [ "GHSA-22hg-r758-rrw9" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112390", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:b942d48ba41eef84eb5668e228ded1a79488e084426b3229194fe2b1c46d819e", "Title": "pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing", "Description": "Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112390", "https://advisory.echohq.com/cve/CVE-2026-112390", "https://getsafety.com/v/SFTY-20261021-15476/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9", "https://nvd.nist.gov/vuln/detail/CVE-2026-112390", "https://www.cve.org/CVERecord?id=CVE-2026-112390" ], "PublishedDate": "2026-10-19T21:17:07.34Z", "LastModifiedDate": "2026-10-23T17:01:18.697Z" }, { "VulnerabilityID": "CVE-2026-112392", "VendorIDs": [ "GHSA-27h8-gf7j-v5hc" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112392", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:cd28ab3a390850fbd15fa5c6a2ac7db1c5b502afa559c1aff0bbbeafbde393da", "Title": "pillow: pillow: Denial of Service via zero-size images in rank filters", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112392", "https://advisory.echohq.com/cve/CVE-2026-112392", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-39022/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc", "https://linux.oracle.com/cve/CVE-2026-112392.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112392", "https://www.cve.org/CVERecord?id=CVE-2026-112392" ], "PublishedDate": "2026-10-19T22:17:06.587Z", "LastModifiedDate": "2026-10-26T20:52:03.5Z" }, { "VulnerabilityID": "CVE-2026-112397", "VendorIDs": [ "GHSA-58r4-6rv3-gfh8" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112397", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:42b25c1c2f270b2dee31e8c40104e630e82b65d13f6b8f9a650b74622ac43172", "Title": "pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry. An attacker can supply such an image to an application that applies a morphology operation. This can crash the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112397", "https://advisory.echohq.com/cve/CVE-2026-112397", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8", "https://linux.oracle.com/cve/CVE-2026-112397.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112397", "https://www.cve.org/CVERecord?id=CVE-2026-112397" ], "PublishedDate": "2026-10-19T22:17:06.97Z", "LastModifiedDate": "2026-10-27T21:00:11.173Z" }, { "VulnerabilityID": "CVE-2026-112399", "VendorIDs": [ "GHSA-5xm2-6676-qcp9" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112399", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:7deb957898feeefec3e8afeda21de978abc27ac8deeb9a3cc23ab8141772b599", "Title": "pillow: pillow: Denial of service via crafted APNG image", "Description": "Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112399", "https://advisory.echohq.com/cve/CVE-2026-112399", "https://getsafety.com/v/SFTY-20261021-76942/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9", "https://nvd.nist.gov/vuln/detail/CVE-2026-112399", "https://www.cve.org/CVERecord?id=CVE-2026-112399" ], "PublishedDate": "2026-10-19T22:17:07.24Z", "LastModifiedDate": "2026-10-28T16:17:02.13Z" }, { "VulnerabilityID": "CVE-2026-112400", "VendorIDs": [ "GHSA-65qm-jvmh-6pqg" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112400", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:950cf3fe6745e2590847fd2980d869642f9b4c985f7b2dbd66e12649d4a4c0db", "Title": "pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image", "Description": "Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112400", "https://advisory.echohq.com/cve/CVE-2026-112400", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg", "https://nvd.nist.gov/vuln/detail/CVE-2026-112400", "https://www.cve.org/CVERecord?id=CVE-2026-112400" ], "PublishedDate": "2026-10-19T22:17:07.367Z", "LastModifiedDate": "2026-10-27T21:02:32.24Z" }, { "VulnerabilityID": "CVE-2026-112402", "VendorIDs": [ "GHSA-7mwm-ghpf-9vrm" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112402", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:47593654f165157b09d9dbf318618ccdc152bc793b9adf8dd1e386b0233bfaf3", "Title": "pillow: pillow: Denial of service via double free during image transformation", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112402", "https://advisory.echohq.com/cve/CVE-2026-112402", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-43268/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm", "https://linux.oracle.com/cve/CVE-2026-112402.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112402", "https://www.cve.org/CVERecord?id=CVE-2026-112402" ], "PublishedDate": "2026-10-19T22:17:07.633Z", "LastModifiedDate": "2026-10-27T21:03:13.88Z" }, { "VulnerabilityID": "CVE-2026-112404", "VendorIDs": [ "GHSA-c6hw-5grf-ff96" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112404", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:03827ea0c0d3d25d1bd93a83148397d979578065135f3759760f44d82f4a334e", "Title": "pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding", "Description": "Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112404", "https://advisory.echohq.com/cve/CVE-2026-112404", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96", "https://nvd.nist.gov/vuln/detail/CVE-2026-112404", "https://www.cve.org/CVERecord?id=CVE-2026-112404" ], "PublishedDate": "2026-10-19T22:17:07.9Z", "LastModifiedDate": "2026-10-28T16:17:02.273Z" }, { "VulnerabilityID": "CVE-2026-112405", "VendorIDs": [ "GHSA-cp9v-662q-vvx9" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112405", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:24813385cdbd8b88db6c912b5d3a7777d3cbd35db017443650f58ebbfcce2f09", "Title": "pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()", "Description": "Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band. This causes a native process crash. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112405", "https://advisory.echohq.com/cve/CVE-2026-112405", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-10844/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cp9v-662q-vvx9", "https://linux.oracle.com/cve/CVE-2026-112405.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112405", "https://www.cve.org/CVERecord?id=CVE-2026-112405" ], "PublishedDate": "2026-10-19T22:17:08.027Z", "LastModifiedDate": "2026-10-27T14:59:59.923Z" }, { "VulnerabilityID": "CVE-2026-112406", "VendorIDs": [ "GHSA-f2g6-542v-9j58" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112406", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:76937708b406e3cc80e60a191e10ce8d33090c36afd4cfbc54cb2558714131d4", "Title": "pillow: pillow: Denial of Service via infinite loop during PDF page rewriting", "Description": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112406", "https://advisory.echohq.com/cve/CVE-2026-112406", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-82408/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58", "https://linux.oracle.com/cve/CVE-2026-112406.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112406", "https://www.cve.org/CVERecord?id=CVE-2026-112406" ], "PublishedDate": "2026-10-19T22:17:08.153Z", "LastModifiedDate": "2026-10-27T14:59:51.513Z" }, { "VulnerabilityID": "CVE-2026-112892", "VendorIDs": [ "GHSA-gg2r-wvfm-q9rx" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112892", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:945225e9bb2b129f7226c68b89af7a5f91a39b92f3f5d83cee71648a9b54b4d3", "Title": "pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder", "Description": "Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-409" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112892", "https://advisory.echohq.com/cve/CVE-2026-112892", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-81271/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx", "https://linux.oracle.com/cve/CVE-2026-112892.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112892", "https://www.cve.org/CVERecord?id=CVE-2026-112892" ], "PublishedDate": "2026-10-19T22:17:09.21Z", "LastModifiedDate": "2026-10-27T14:59:30.563Z" }, { "VulnerabilityID": "CVE-2026-112893", "VendorIDs": [ "GHSA-j4m9-6w36-pw47" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112893", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:47f2869e57acef2a86ecb6e4606e82151c663b9f5bc85c59b0a9acb908eedcda", "Title": "pillow: Pillow: Denial of Service via invalid pointer free during font rendering", "Description": "Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-457", "CWE-763" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112893", "https://advisory.echohq.com/cve/CVE-2026-112893", "https://getsafety.com/v/SFTY-20261021-31867/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47", "https://nvd.nist.gov/vuln/detail/CVE-2026-112893", "https://www.cve.org/CVERecord?id=CVE-2026-112893" ], "PublishedDate": "2026-10-19T22:17:09.35Z", "LastModifiedDate": "2026-10-28T16:17:02.413Z" }, { "VulnerabilityID": "CVE-2026-112894", "VendorIDs": [ "GHSA-jg86-v3jv-hrpm" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112894", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0425287569745a52f61782557225cfe342482e5319322a7d018e248caf5a6a89", "Title": "pillow: pillow: Denial of Service via crafted multi-frame image conversion", "Description": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112894", "https://advisory.echohq.com/cve/CVE-2026-112894", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-17221/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm", "https://linux.oracle.com/cve/CVE-2026-112894.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112894", "https://www.cve.org/CVERecord?id=CVE-2026-112894" ], "PublishedDate": "2026-10-19T22:17:09.483Z", "LastModifiedDate": "2026-10-27T14:56:28.823Z" }, { "VulnerabilityID": "CVE-2026-112895", "VendorIDs": [ "GHSA-p4wg-p73j-c528" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112895", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:63f8909ebf0f3bb65547c795f0e04e4479cb08bbd435f66fb0cad50efda3503d", "Title": "pillow: pillow: Denial of service via crafted PDF during append operations", "Description": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-cyclic /Kids references can also cause super-linear CPU and memory use. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled. This can raise an uncaught RecursionError or consume excessive CPU and memory before output is written, causing denial of service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112895", "https://advisory.echohq.com/cve/CVE-2026-112895", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/e2ae7eacad6de68c37eb28b633a97bebacf2c5bf", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-p4wg-p73j-c528", "https://linux.oracle.com/cve/CVE-2026-112895.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112895", "https://www.cve.org/CVERecord?id=CVE-2026-112895" ], "PublishedDate": "2026-10-19T22:17:09.62Z", "LastModifiedDate": "2026-10-27T14:56:20.7Z" }, { "VulnerabilityID": "CVE-2026-112896", "VendorIDs": [ "GHSA-pchr-8j38-3x4p" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112896", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:e585fcad88abf0b33dfbbbb768af2d349636e86c4e9c7da86d8c6d1555621b30", "Title": "pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112896", "https://advisory.echohq.com/cve/CVE-2026-112896", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p", "https://nvd.nist.gov/vuln/detail/CVE-2026-112896", "https://www.cve.org/CVERecord?id=CVE-2026-112896" ], "PublishedDate": "2026-10-19T22:17:09.76Z", "LastModifiedDate": "2026-10-27T14:55:49.017Z" }, { "VulnerabilityID": "CVE-2026-112897", "VendorIDs": [ "GHSA-q45j-58j2-45rg" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112897", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5ff85a4177128d68014cef3e02139ea769e6d290e6955634c5ba9d5d97686a3c", "Title": "pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding", "Description": "Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-908" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 6.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112897", "https://advisory.echohq.com/cve/CVE-2026-112897", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-q45j-58j2-45rg", "https://nvd.nist.gov/vuln/detail/CVE-2026-112897", "https://www.cve.org/CVERecord?id=CVE-2026-112897" ], "PublishedDate": "2026-10-19T22:17:09.9Z", "LastModifiedDate": "2026-10-27T14:55:26.993Z" }, { "VulnerabilityID": "CVE-2026-112902", "VendorIDs": [ "GHSA-xvh5-g6gv-559v" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112902", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:530af91503567219cce9bd699c6a0ee5a605e1ed568de034c98231cd56fc77fe", "Title": "Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags", "Description": "Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to  TIFFSetField()  that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-686" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112902", "https://advisory.echohq.com/cve/CVE-2026-112902", "https://getsafety.com/v/SFTY-20261021-68388/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/570df030c0d30c2bf5336b2ab59f3902d8ab0b6d", "https://github.com/python-pillow/Pillow/commit/af56ace297b0991d02988fcc2ea933e4824b4fb3", "https://github.com/python-pillow/Pillow/pull/10227", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v", "https://nvd.nist.gov/vuln/detail/CVE-2026-112902", "https://www.cve.org/CVERecord?id=CVE-2026-112902" ], "PublishedDate": "2026-11-05T21:18:36.713Z", "LastModifiedDate": "2026-11-05T21:18:36.84Z" }, { "VulnerabilityID": "CVE-2026-96637", "VendorIDs": [ "GHSA-g842-9rc4-69pw" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96637", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:d0e6b9aef2c314f3b28678896a1e076a5c6fb37357fb0bf509055b8388e944d8", "Title": "pillow: pillow: Denial of Service via decompression bomb bypass in SPIDER images", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-409" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96637", "https://advisory.echohq.com/cve/CVE-2026-96637", "https://getsafety.com/v/SFTY-20261022-38655/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/7cb0e02389d8aac2a60896a490f572db0b07b841", "https://github.com/python-pillow/Pillow/pull/10076", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g842-9rc4-69pw", "https://nvd.nist.gov/vuln/detail/CVE-2026-96637", "https://www.cve.org/CVERecord?id=CVE-2026-96637" ], "PublishedDate": "2026-10-21T21:20:31.927Z", "LastModifiedDate": "2026-10-27T14:24:56.513Z" }, { "VulnerabilityID": "CVE-2026-96640", "VendorIDs": [ "GHSA-mrfp-p49p-3hf2" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96640", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5101837a22c0ed1d86f459788ca5f37b8edce6b1721c9c3643bc8381d2803b8f", "Title": "pillow: pillow: Denial of Service via duplicate page references in PDF files", "Description": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format=\"PDF\", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many page references and consume disproportionate CPU before the append completes. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-407" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-96640", "https://advisory.echohq.com/cve/CVE-2026-96640", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://github.com/advisories/GHSA-mrfp-p49p-3hf2", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7", "https://github.com/python-pillow/Pillow/pull/10093", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2", "https://linux.oracle.com/cve/CVE-2026-96640.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-96640", "https://www.cve.org/CVERecord?id=CVE-2026-96640" ], "PublishedDate": "2026-10-21T21:20:32.357Z", "LastModifiedDate": "2026-10-28T02:17:07.99Z" }, { "VulnerabilityID": "CVE-2026-96642", "VendorIDs": [ "GHSA-3j72-p6qg-6xp7" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96642", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:574697c73a972e7d407108a6cbdbbbae0f041886b8e100ce230964fbaff85491", "Title": "pillow: Pillow: Denial of Service via negative archive member size in TarIO", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96642", "https://advisory.echohq.com/cve/CVE-2026-96642", "https://github.com/advisories/GHSA-3j72-p6qg-6xp7", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d", "https://github.com/python-pillow/Pillow/pull/10012", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7", "https://nvd.nist.gov/vuln/detail/CVE-2026-96642", "https://www.cve.org/CVERecord?id=CVE-2026-96642" ], "PublishedDate": "2026-10-21T21:20:32.65Z", "LastModifiedDate": "2026-10-30T17:17:32.24Z" }, { "VulnerabilityID": "CVE-2026-96643", "VendorIDs": [ "GHSA-g4qv-2jxx-769h" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96643", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:b33f0f6ab96380f5b2a4921b4f4d15a45844f8379f8f23576e7dfdebfb0da81f", "Title": "pillow: pillow: Denial of Service via repeated EXIF headers", "Description": "Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96643", "https://advisory.echohq.com/cve/CVE-2026-96643", "https://github.com/advisories/GHSA-g4qv-2jxx-769h", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c", "https://github.com/python-pillow/Pillow/pull/10073", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h", "https://nvd.nist.gov/vuln/detail/CVE-2026-96643", "https://www.cve.org/CVERecord?id=CVE-2026-96643" ], "PublishedDate": "2026-10-21T21:20:32.797Z", "LastModifiedDate": "2026-10-27T14:26:51.563Z" }, { "VulnerabilityID": "CVE-2026-96644", "VendorIDs": [ "GHSA-9v9v-9qvf-h2hj" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96644", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0eb43a941f4af2bbed798ab3646f9c702f4f6835fc67ed63a2123423d1b37948", "Title": "pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser", "Description": "Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using the original full dimensions. A crafted wide, short metafile can pass the pixel-count decompression-bomb check and make the Windows-only renderer read beyond the heap buffer, potentially disclosing memory or crashing the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96644", "https://advisory.echohq.com/cve/CVE-2026-96644", "https://github.com/advisories/GHSA-9v9v-9qvf-h2hj", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/4cf46bee338304c5c8968fd7f132ba0d40c428b7", "https://github.com/python-pillow/Pillow/pull/10120", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9v9v-9qvf-h2hj", "https://nvd.nist.gov/vuln/detail/CVE-2026-96644", "https://www.cve.org/CVERecord?id=CVE-2026-96644" ], "PublishedDate": "2026-10-21T21:20:32.943Z", "LastModifiedDate": "2026-10-28T19:19:28.633Z" }, { "VulnerabilityID": "CVE-2026-96778", "VendorIDs": [ "GHSA-g7cr-3p24-7wf7" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96778", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:c7ef1d8cf85827520ec7b968dd84d73956b4ab665f63df203d9e8acf7a051d4f", "Title": "pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow", "Description": "Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted free_in_buffer counter, which then wraps and permits the attacker-controlled comment and subsequent compressed image data to overwrite adjacent heap memory. Re-saving an untrusted image as JPEG while preserving its ICC profile and forwarded comment can crash the process and may enable code execution in suitable runtime and heap layouts. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96778", "https://advisory.echohq.com/cve/CVE-2026-96778", "https://github.com/advisories/GHSA-g7cr-3p24-7wf7", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/02561b8dc6117d5670d4b469fecdd02c70854f9b", "https://github.com/python-pillow/Pillow/pull/10124", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7", "https://nvd.nist.gov/vuln/detail/CVE-2026-96778", "https://www.cve.org/CVERecord?id=CVE-2026-96778" ], "PublishedDate": "2026-10-21T21:20:33.093Z", "LastModifiedDate": "2026-10-28T02:17:08.253Z" }, { "VulnerabilityID": "GHSA-78g4-xqwv-q3g8", "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-12.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@12.3.0", "UID": "b5d384751a625b3" }, "InstalledVersion": "12.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:d7292be3bb254218b0489a80ac80ad8c5dc98e9eb1cce321d7d747cd6a49ad4e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-78g4-xqwv-q3g8", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:83022a5a94a3230e81861c945bacb1746cb5187a8f5f8fee8ed0dee3b56dc66e", "Title": "Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()", "Description": "### Summary\n\nEvery Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow **write** that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219\n\nBecause the wheel bundles its own copy, a patched host OS does not help. It is reachable from `Image.open(fp); im.load()` with default settings.\n\nI am reporting it here rather than only upstream because Pillow is where the vulnerable binary actually reaches users.\n\nNote the inversion that makes this easy to miss: **OpenJPEG 2.5.2 and earlier are safe.** The bug was introduced in `954c6e3c` (2024-06-25), so keeping the dependency current is what creates the exposure.\n\n### Details\n\n## Affected wheels\n\nFrom `.github/dependencies.json` (`openjpeg`) at each tag:\n\n| Pillow | bundled OpenJPEG | status |\n|---|---|---|\n| 10.4.0 | 2.5.2 | safe |\n| 11.0.0 | 2.5.2 | safe |\n| **11.1.0, 11.2.1, 11.3.0** | **2.5.3** | **affected** |\n| **12.0.0 … 12.3.0** | **2.5.4** | **affected** |\n\nConfirmed on an installed wheel: `PIL.features.version_codec('jpg_2000')` → `2.5.4`, bundled file `pillow.libs/libopenjp2-*.so.2.5.4`. `main` still pins `2.5.4` as of 2026-10-06.\n\n## The defect\n\n`src/lib/openjp2/j2k.c`, in `opj_j2k_read_sod`:\n\n```c\nOPJ_UINT32 l_current_tile_part =\n l_cstr_index-\u003etile_index[p_j2k-\u003em_current_tile_number].current_tpsno;\nl_cstr_index-\u003etile_index[...].tp_index[l_current_tile_part].end_header = l_current_pos;\nl_cstr_index-\u003etile_index[...].tp_index[l_current_tile_part].end_pos =\n l_current_pos + p_j2k-\u003em_specific_param.m_decoder.m_sot_length + 2;\n```\n\n`tp_index` is neither null-checked nor bounds-checked, and `l_current_tile_part` comes directly from the one-byte `TPsot` field of the SOT marker.\n\nThe correct guard already exists a few lines later in `opj_j2k_add_tlmarker` (j2k.c:8459), writing the **same array at the same index** behind `if (tp_index \u0026\u0026 l_current_tile_part \u003c nb_tps)`. One writer checked, its sibling not.\n\nReached by giving the codestream a *valid* TLM marker — so `tp_index` is allocated once by `opj_j2k_build_tp_index_from_tlm`, sized to the TLM entry count, and `opj_j2k_read_sot` then skips all resizing — while setting `TNsot = 0` in every SOT, which keeps the TLM \"valid\" and lets `TPsot` walk past the allocation.\n\n## Patch status\n\nFixed upstream in `91d08b11` (\"Fix heap buffer overlfow in opj_j2k_read_sod\", 2026-02-10).\n\nThe newest OpenJPEG tag is **v2.5.4 (2025-09-20)**, and `compare/v2.5.4...91d08b11` reports *ahead 6, behind 0* — the fix is **in no release, 8 months on**.\n\n## Suggested remediation\n\n1. Carry `91d08b11` as a patch in the wheel build until an OpenJPEG release includes it — three lines, identical to a guard already present in the same file.\n2. Consider asking OpenJPEG to cut a release; they have had an unreleased memory-corruption fix on master since February 2026, and every distro is shipping the vulnerable code.\n3. Your security handbook already tells applications to block EPS at the application layer. A similarly explicit note that `Image.open()` ignores filename/Content-Type and will reach any compiled-in codec unless `formats=` is passed would help downstream apps a lot.\n\n## Not a Pillow bug, but relevant: the extension allowlist most apps rely on does not apply\n\n`Image.open()` sniffs magic bytes, so a JPEG 2000 codestream in a file named `avatar.png` declared `Content-Type: image/png` reaches the JP2 decoder anyway.\n\nI verified this against a production service documenting PNG/JPEG-only uploads: it accepted and fully decoded a JP2 through exactly that path, with 16 formats reachable from one upload endpoint against 43 registered openers. That service has since fixed it by passing `formats=` and validating on the detected format rather than the client's `Content-Type`.\n\nThat is the reason a decoder-level issue like this one has much wider reach than downstream maintainers tend to assume.\n\n### Proof of concept\n\nASan build of OpenJPEG 2.5.4 interposed under a **stock Pillow 12.3.0**, running `Image.open(p); im.load()`:\n\n```\n==766332==ERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 8\n #0 opj_j2k_read_sod j2k.c:5086\n #1 opj_j2k_read_tile_header j2k.c:9912\n #2 opj_read_tile_header openjpeg.c:575\n #3 j2k_decode_entry src/libImaging/Jpeg2KDecode.c:793\n #4 ImagingJpeg2KDecode src/libImaging/Jpeg2KDecode.c:949\n #5 _decode src/decode.c:132\nlocated 8 bytes to the right of a 24-byte region allocated by\n opj_j2k_build_tp_index_from_tlm j2k.c:8939\n```\n\nFrames 3–5 are Pillow's own decoder, not a synthetic harness. No non-default decoder options are involved; strict mode is on, which is Pillow's behaviour since Pillow never calls `opj_decoder_set_strict_mode`. A benign twin image runs the same path cleanly and returns a valid image, so this is the payload and not a parse failure.\n\nI have deliberately **not** attached the PoC file to this initial report. I'm happy to attach the PoC, the builder script and the RIP-control harness here on request, or hold everything until a fix is ready.\n\nNo disclosure deadline from me; I will not publish anything while this is being worked on.\n\n### Impact\n\nAny application that calls `Image.open()` / `im.load()` on an image it did not produce — the overwhelmingly common case for upload handlers, thumbnailers and preview pipelines — can be made to perform an out-of-bounds heap write by supplying one crafted file.\n\n**Floor, already certain.** On a stock non-sanitised wheel the overflow performs 245 writes walking to +5856 bytes past a 24-byte allocation, and glibc's own heap-metadata checker aborts the process (`corrupted size vs. prev_size`, `corrupted double-linked list`, SIGABRT). One file reliably kills a long-lived worker.\n\n**Ceiling, demonstrated as a primitive but not as a finished exploit.** With same-size-class objects alive on both sides — an ordinary busy heap — the walk crosses `opj_event_mgr_t`, which holds three `opj_msg_callback` function pointers, and `opj_event_msg` then calls one (event.c:136):\n\n```\nrip 0x4000 \u003c- value chosen by the attacker's file layout\nrsi 0x3ff2 \u003c- m_error_data, written by the same walk\n```\n\nShifting the codestream with a COM marker moves `rip` with it (`0x16ce` → `0x4000`), so the instruction pointer is attacker-**chosen** rather than incidentally invalid. A benign control image leaves the same groomed heap untouched.\n\nTo be explicit about what I did not do: I have **not** built a working exploit. That additionally needs remote heap grooming and an ASLR defeat, and I attempted neither. I am reporting a controlled control-flow primitive, not a finished chain. The CVSS AC:H reflects that.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-78g4-xqwv-q3g8", "https://github.com/advisories/GHSA-78g4-xqwv-q3g8", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/5f8114c8096b181fae493543cd3837d9f9a971cc", "https://github.com/python-pillow/Pillow/commit/d3470c327840f4c216a1610f30e7091dfd0b97c0", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-78g4-xqwv-q3g8", "https://github.com/uclouvain/openjpeg/commit/91d08b11a72764f6d199f32fa0c1b1abd4edc2ad", "https://osv.dev/vulnerability/OSV-2025-219" ], "PublishedDate": "2026-10-22T17:01:08Z", "LastModifiedDate": "2026-10-22T17:01:08Z" }, { "VulnerabilityID": "CVE-2026-24049", "VendorIDs": [ "GHSA-8rrh-rw8j-w5fx" ], "PkgName": "wheel", "PkgPath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/wheel-0.45.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "68d1f5691b386b62" }, "InstalledVersion": "0.45.1", "FixedVersion": "0.46.2", "Status": "fixed", "Layer": { "DiffID": "sha256:7895f75e926a456464bbd0f1285738ba25e7d70aad4aa94c32c1d274b3b9e85e" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-24049", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:612c65b1d07ba9a8713999e1f5e2291254fd1e3ecc467ffb0a73a510100de682", "Title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking", "Description": "wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.", "Severity": "HIGH", "CweIDs": [ "CWE-22", "CWE-732" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "ghsa": 3, "nvd": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:1504", "https://access.redhat.com/errata/RHSA-2026:17599", "https://access.redhat.com/errata/RHSA-2026:1902", "https://access.redhat.com/errata/RHSA-2026:1939", "https://access.redhat.com/errata/RHSA-2026:1942", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20089", "https://access.redhat.com/errata/RHSA-2026:2090", "https://access.redhat.com/errata/RHSA-2026:2106", "https://access.redhat.com/errata/RHSA-2026:2139", "https://access.redhat.com/errata/RHSA-2026:2675", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2694", "https://access.redhat.com/errata/RHSA-2026:2695", "https://access.redhat.com/errata/RHSA-2026:2710", "https://access.redhat.com/errata/RHSA-2026:2754", "https://access.redhat.com/errata/RHSA-2026:2762", "https://access.redhat.com/errata/RHSA-2026:2823", "https://access.redhat.com/errata/RHSA-2026:2865", "https://access.redhat.com/errata/RHSA-2026:2866", "https://access.redhat.com/errata/RHSA-2026:2900", "https://access.redhat.com/errata/RHSA-2026:2925", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3958", "https://access.redhat.com/errata/RHSA-2026:3959", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:4185", "https://access.redhat.com/errata/RHSA-2026:4215", "https://access.redhat.com/errata/RHSA-2026:4271", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:5119", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:6192", "https://access.redhat.com/errata/RHSA-2026:62115", "https://access.redhat.com/errata/RHSA-2026:6555", "https://access.redhat.com/errata/RHSA-2026:6562", "https://access.redhat.com/errata/RHSA-2026:6565", "https://access.redhat.com/errata/RHSA-2026:7250", "https://access.redhat.com/security/cve/CVE-2026-24049", "https://advisory.echohq.com/cve/CVE-2026-24049", "https://bugzilla.redhat.com/2431959", "https://bugzilla.redhat.com/show_bug.cgi?id=2431959", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24049", "https://errata.almalinux.org/9/ALSA-2026-1939.html", "https://errata.rockylinux.org/RLSA-2026:1939", "https://github.com/pypa/wheel", "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef", "https://github.com/pypa/wheel/commit/934fe177ff912c8e03d5ae951d3805e1fd90ba5e", "https://github.com/pypa/wheel/releases/tag/0.46.2", "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx", "https://linux.oracle.com/cve/CVE-2026-24049.html", "https://linux.oracle.com/errata/ELSA-2026-2090.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-24049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24049.json", "https://ubuntu.com/security/notices/USN-8221-1", "https://www.cve.org/CVERecord?id=CVE-2026-24049" ], "PublishedDate": "2026-01-22T05:16:23.157Z", "LastModifiedDate": "2026-09-10T13:17:45.017Z" } ] } ] }