{ "SchemaVersion": 2, "Trivy": { "Version": "0.72.0" }, "ReportID": "019fa8b9-d41e-762a-b1ba-4261e5c2e188", "CreatedAt": "2026-07-28T13:36:18.59040673+01:00", "ArtifactID": "sha256:acfd46b2aa2d8ae0b1ac2c3086430776dd59c845e3a54c83e5e159c3a2e035d4", "ArtifactName": "/tmp/finetic-trust-scan/0.1.92/finetic-0.1.92-published-amd64.tar", "ArtifactType": "container_image", "Metadata": { "Size": 836809216, "OS": { "Family": "debian", "Name": "12.15" }, "ImageID": "sha256:bbca295cdced227b280855bf40be478ad7ff5e96ee70b4281e42374e46cd2a15", "DiffIDs": [ "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a", "sha256:e8e8bcb08674cd0ecf9850d66bc246bb95fa086eb6c988ab48d0404501029ddc", "sha256:ec5d0255c8bf10ce4313e611ec0a35f9de699c6284e69e4c4fdcc5ea6e82adbf", "sha256:625ca884ca91515900d06a970e88957ac4d2e8963c4a0cc699e069ef7e3c7371", "sha256:7ad824b880674ec5cd6d6ef28d7d4783bcd5194ccf30ae225d5eeed0093ff31a", "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee", "sha256:556640d21aeb0a0c14eae8d14adcec71b507d776f59838a0750dc89eeaf6bfe9", "sha256:a90fdd1491bbbbbb6935b02b0278000af1ac8528216740d10d2922d8893840f4", "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03", "sha256:6e34b79a11bc6a16694520b031c33ad999cdb512460e492871038209b003bab6", "sha256:c12ee0b2d8a0e826e365f743dfce3b3066d052963dfa557ff90e3e4f1c68a306", "sha256:55eb071193f7d6c07cf128be0f9176ecca38319c44ba9b8451cd3c1b294954b9", "sha256:7cbf13b17726dbb35117d3a060626e84d8fcc43ffbca24ee1f3c32e3ef2289f0" ], "RepoTags": [ "finetic-published:0.1.92" ], "Reference": "finetic-published:0.1.92", "ImageConfig": { "architecture": "amd64", "created": "2026-07-28T12:28:42.445178154Z", "history": [ { "created": "2026-07-13T00:00:00Z", "created_by": "# debian.sh --arch 'amd64' out/ 'bookworm' '@1783900800'", "comment": "debuerreotype 0.17" }, { "created": "2026-07-14T01:47:34.173816324Z", "created_by": "RUN /bin/sh -c groupadd --gid 1000 node \u0026\u0026 useradd --uid 1000 --gid node --shell /bin/bash --create-home node # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-07-14T01:47:52.523051311Z", "created_by": "ENV NODE_VERSION=24.18.0", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-07-14T01:47:52.523051311Z", "created_by": "RUN /bin/sh -c ARCH= OPENSSL_ARCH= \u0026\u0026 dpkgArch=\"$(dpkg --print-architecture)\" \u0026\u0026 case \"${dpkgArch##*-}\" in amd64) ARCH='x64' OPENSSL_ARCH='linux-x86_64';; ppc64el) ARCH='ppc64le' OPENSSL_ARCH='linux-ppc64le';; s390x) ARCH='s390x' OPENSSL_ARCH='linux*-s390x';; arm64) ARCH='arm64' OPENSSL_ARCH='linux-aarch64';; armhf) ARCH='armv7l' OPENSSL_ARCH='linux-armv4';; *) echo \"unsupported architecture\"; exit 1 ;; esac \u0026\u0026 set -ex \u0026\u0026 apt-get update \u0026\u0026 apt-get install -y ca-certificates curl wget gnupg dirmngr xz-utils libatomic1 --no-install-recommends \u0026\u0026 rm -rf /var/lib/apt/lists/* \u0026\u0026 export GNUPGHOME=\"$(mktemp -d)\" \u0026\u0026 for key in 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 CC68F5A3106FF448322E48ED27F5E38D5B0A215F 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C 108F52B48DB57BB0CC439B2997B01419BD92F80A A363A499291CBBC940DD62E41F10027AF002F8B0 ; do { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$key\" \u0026\u0026 gpg --batch --fingerprint \"$key\"; } || { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys \"$key\" \u0026\u0026 gpg --batch --fingerprint \"$key\"; } ; done \u0026\u0026 curl -fsSLO --compressed \"https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH.tar.xz\" \u0026\u0026 curl -fsSLO --compressed \"https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc\" \u0026\u0026 gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \u0026\u0026 gpgconf --kill all \u0026\u0026 rm -rf \"$GNUPGHOME\" \u0026\u0026 grep \" node-v$NODE_VERSION-linux-$ARCH.tar.xz\\$\" SHASUMS256.txt | sha256sum -c - \u0026\u0026 tar -xJf \"node-v$NODE_VERSION-linux-$ARCH.tar.xz\" -C /usr/local --strip-components=1 --no-same-owner \u0026\u0026 rm \"node-v$NODE_VERSION-linux-$ARCH.tar.xz\" SHASUMS256.txt.asc SHASUMS256.txt \u0026\u0026 find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name \"$OPENSSL_ARCH\" -exec rm -rf {} \\; \u0026\u0026 apt-mark auto '.*' \u003e /dev/null \u0026\u0026 find /usr/local -type f -executable -exec ldd '{}' ';' | awk '/=\u003e/ { so = $(NF-1); if (index(so, \"/usr/local/\") == 1) { next }; gsub(\"^/(usr/)?\", \"\", so); print so }' | sort -u | xargs -r dpkg-query --search | cut -d: -f1 | sort -u | xargs -r apt-mark manual \u0026\u0026 apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \u0026\u0026 ln -s /usr/local/bin/node /usr/local/bin/nodejs \u0026\u0026 node --version \u0026\u0026 npm --version \u0026\u0026 rm -rf /tmp/* # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-07-14T01:47:52.523051311Z", "created_by": "ENV YARN_VERSION=1.22.22", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-07-14T01:48:03.892467434Z", "created_by": "RUN /bin/sh -c set -ex \u0026\u0026 savedAptMark=\"$(apt-mark showmanual)\" \u0026\u0026 apt-get update \u0026\u0026 apt-get install -y ca-certificates curl wget gnupg dirmngr --no-install-recommends \u0026\u0026 rm -rf /var/lib/apt/lists/* \u0026\u0026 export GNUPGHOME=\"$(mktemp -d)\" \u0026\u0026 for key in 6A010C5166006599AA17F08146C2130DFD2497F5 ; do { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$key\" \u0026\u0026 gpg --batch --fingerprint \"$key\"; } || { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys \"$key\" \u0026\u0026 gpg --batch --fingerprint \"$key\"; } ; done \u0026\u0026 curl -fsSLO --compressed \"https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz\" \u0026\u0026 curl -fsSLO --compressed \"https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc\" \u0026\u0026 gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \u0026\u0026 gpgconf --kill all \u0026\u0026 rm -rf \"$GNUPGHOME\" \u0026\u0026 mkdir -p /opt \u0026\u0026 tar -xzf yarn-v$YARN_VERSION.tar.gz -C /opt/ \u0026\u0026 ln -s /opt/yarn-v$YARN_VERSION/bin/yarn /usr/local/bin/yarn \u0026\u0026 ln -s /opt/yarn-v$YARN_VERSION/bin/yarnpkg /usr/local/bin/yarnpkg \u0026\u0026 rm yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \u0026\u0026 apt-mark auto '.*' \u003e /dev/null \u0026\u0026 { [ -z \"$savedAptMark\" ] || apt-mark manual $savedAptMark \u003e /dev/null; } \u0026\u0026 find /usr/local -type f -executable -exec ldd '{}' ';' | awk '/=\u003e/ { so = $(NF-1); if (index(so, \"/usr/local/\") == 1) { next }; gsub(\"^/(usr/)?\", \"\", so); print so }' | sort -u | xargs -r dpkg-query --search | cut -d: -f1 | sort -u | xargs -r apt-mark manual \u0026\u0026 apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \u0026\u0026 yarn --version \u0026\u0026 rm -rf /tmp/* # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-07-14T01:48:03.920026999Z", "created_by": "COPY docker-entrypoint.sh /usr/local/bin/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-07-14T01:48:03.920026999Z", "created_by": "ENTRYPOINT [\"docker-entrypoint.sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-07-14T01:48:03.920026999Z", "created_by": "CMD [\"node\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-07-28T12:28:37.018769241Z", "created_by": "ARG FINETIC_VERSION=0.1.92", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-07-28T12:28:37.018769241Z", "created_by": "ARG FINETIC_REVISION=b456ca9f4e51d41f1aa392968b7fa01bb3d8e149", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-07-28T12:28:37.018769241Z", "created_by": "RUN |2 FINETIC_VERSION=0.1.92 FINETIC_REVISION=b456ca9f4e51d41f1aa392968b7fa01bb3d8e149 /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends ca-certificates ffmpeg gosu libva2 mesa-va-drivers postgresql-client tini vainfo; if [ \"$(dpkg --print-architecture)\" = \"amd64\" ]; then apt-get install -y --no-install-recommends intel-media-va-driver; fi; rm -rf /var/lib/apt/lists/* # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-07-28T12:28:37.115752712Z", "created_by": "WORKDIR /opt/finetic", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-07-28T12:28:37.130318887Z", "created_by": "COPY package.json package-lock.json ./ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-07-28T12:28:42.050237081Z", "created_by": "RUN |2 FINETIC_VERSION=0.1.92 FINETIC_REVISION=b456ca9f4e51d41f1aa392968b7fa01bb3d8e149 /bin/sh -c set -eux; npm ci --omit=dev --no-audit --no-fund; npm cache clean --force; for path in /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/pnpm /usr/local/bin/pnpx /usr/local/bin/yarn /usr/local/bin/yarnpkg /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack; do if [ -e \"$path\" ] || [ -L \"$path\" ]; then find -P \"$path\" -depth -delete; fi; done; ! command -v npm; ! command -v npx # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-07-28T12:28:42.266369795Z", "created_by": "COPY dist ./dist # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-07-28T12:28:42.289857326Z", "created_by": "COPY README.md LICENSE RELEASE.json finetic-entitlement-public.pem ./ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-07-28T12:28:42.302108204Z", "created_by": "COPY container-entrypoint.sh /usr/local/bin/finetic-container-entrypoint # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-07-28T12:28:42.445178154Z", "created_by": "RUN |2 FINETIC_VERSION=0.1.92 FINETIC_REVISION=b456ca9f4e51d41f1aa392968b7fa01bb3d8e149 /bin/sh -c set -eux; chmod 0755 /usr/local/bin/finetic-container-entrypoint; mkdir -p /var/lib/finetic/.media-cache /var/lib/finetic/artwork /var/cache/finetic /var/lib/finetic/backups; ln -s /var/lib/finetic/.media-cache /opt/finetic/.media-cache; chmod 0750 /var/lib/finetic /var/lib/finetic/.media-cache /var/lib/finetic/artwork /var/cache/finetic /var/lib/finetic/backups # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-07-28T12:28:42.445178154Z", "created_by": "ENV NODE_ENV=production HOST=0.0.0.0 PORT=3000 HOME=/var/lib/finetic FINETIC_ACCESS_PROGRAM=public-preview FINETIC_UPDATE_MODE=external FINETIC_UPDATE_SUPERVISOR=external FINETIC_UPDATE_API_URL=https://youngstudio.uk/control FINETIC_UPDATE_PUBLIC_KEY_FILE=/opt/finetic/finetic-entitlement-public.pem FINETIC_NATIVE_ARTWORK_CACHE_PATH=/var/lib/finetic/artwork FINETIC_NATIVE_CACHE_PATH=/var/cache/finetic FINETIC_NATIVE_HLS_CACHE_PATH=/var/cache/finetic/hls FINETIC_NATIVE_KEYFRAME_CACHE_PATH=/var/cache/finetic/keyframes FINETIC_FFMPEG_REGISTRY_PATH=/var/cache/finetic/ffmpeg-processes.json FINETIC_BACKUP_PATH=/var/lib/finetic/backups", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-07-28T12:28:42.445178154Z", "created_by": "LABEL org.opencontainers.image.title=Finetic org.opencontainers.image.description=Finetic compiled media-server runtime org.opencontainers.image.version=0.1.92 org.opencontainers.image.revision=b456ca9f4e51d41f1aa392968b7fa01bb3d8e149 org.opencontainers.image.vendor=Finetic org.opencontainers.image.licenses=LicenseRef-Finetic-Public-Preview", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-07-28T12:28:42.445178154Z", "created_by": "EXPOSE [3000/tcp]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-07-28T12:28:42.445178154Z", "created_by": "VOLUME [/var/lib/finetic/.media-cache /var/lib/finetic/artwork /var/cache/finetic /var/lib/finetic/backups]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-07-28T12:28:42.445178154Z", "created_by": "HEALTHCHECK {Test:[CMD-SHELL node -e \"fetch('http://127.0.0.1:3000/api/app/version').then(r=\u003e{if(!r.ok)process.exit(1)}).catch(()=\u003eprocess.exit(1))\"] Interval:15s Timeout:5s StartPeriod:45s StartInterval:0s Retries:5}", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-07-28T12:28:42.445178154Z", "created_by": "ENTRYPOINT [\"/usr/local/bin/finetic-container-entrypoint\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-07-28T12:28:42.445178154Z", "created_by": "CMD [\"node\" \"dist/server.cjs\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a", "sha256:e8e8bcb08674cd0ecf9850d66bc246bb95fa086eb6c988ab48d0404501029ddc", "sha256:ec5d0255c8bf10ce4313e611ec0a35f9de699c6284e69e4c4fdcc5ea6e82adbf", "sha256:625ca884ca91515900d06a970e88957ac4d2e8963c4a0cc699e069ef7e3c7371", "sha256:7ad824b880674ec5cd6d6ef28d7d4783bcd5194ccf30ae225d5eeed0093ff31a", "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee", "sha256:556640d21aeb0a0c14eae8d14adcec71b507d776f59838a0750dc89eeaf6bfe9", "sha256:a90fdd1491bbbbbb6935b02b0278000af1ac8528216740d10d2922d8893840f4", "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03", "sha256:6e34b79a11bc6a16694520b031c33ad999cdb512460e492871038209b003bab6", "sha256:c12ee0b2d8a0e826e365f743dfce3b3066d052963dfa557ff90e3e4f1c68a306", "sha256:55eb071193f7d6c07cf128be0f9176ecca38319c44ba9b8451cd3c1b294954b9", "sha256:7cbf13b17726dbb35117d3a060626e84d8fcc43ffbca24ee1f3c32e3ef2289f0" ] }, "config": { "Cmd": [ "node", "dist/server.cjs" ], "Healthcheck": { "Test": [ "CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3000/api/app/version').then(r=\u003e{if(!r.ok)process.exit(1)}).catch(()=\u003eprocess.exit(1))\"" ], "Interval": 15000000000, "Timeout": 5000000000, "StartPeriod": 45000000000, "Retries": 5 }, "Entrypoint": [ "/usr/local/bin/finetic-container-entrypoint" ], "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "NODE_VERSION=24.18.0", "YARN_VERSION=1.22.22", "NODE_ENV=production", "HOST=0.0.0.0", "PORT=3000", "HOME=/var/lib/finetic", "FINETIC_ACCESS_PROGRAM=public-preview", "FINETIC_UPDATE_MODE=external", "FINETIC_UPDATE_SUPERVISOR=external", "FINETIC_UPDATE_API_URL=https://youngstudio.uk/control", "FINETIC_UPDATE_PUBLIC_KEY_FILE=/opt/finetic/finetic-entitlement-public.pem", "FINETIC_NATIVE_ARTWORK_CACHE_PATH=/var/lib/finetic/artwork", "FINETIC_NATIVE_CACHE_PATH=/var/cache/finetic", "FINETIC_NATIVE_HLS_CACHE_PATH=/var/cache/finetic/hls", "FINETIC_NATIVE_KEYFRAME_CACHE_PATH=/var/cache/finetic/keyframes", "FINETIC_FFMPEG_REGISTRY_PATH=/var/cache/finetic/ffmpeg-processes.json", "FINETIC_BACKUP_PATH=/var/lib/finetic/backups" ], "Labels": { "org.opencontainers.image.description": "Finetic compiled media-server runtime", "org.opencontainers.image.licenses": "LicenseRef-Finetic-Public-Preview", "org.opencontainers.image.revision": "b456ca9f4e51d41f1aa392968b7fa01bb3d8e149", "org.opencontainers.image.title": "Finetic", "org.opencontainers.image.vendor": "Finetic", "org.opencontainers.image.version": "0.1.92" }, "Volumes": { "/var/cache/finetic": {}, "/var/lib/finetic/.media-cache": {}, "/var/lib/finetic/artwork": {}, "/var/lib/finetic/backups": {} }, "WorkingDir": "/opt/finetic", "ExposedPorts": { "3000/tcp": {} }, "ArgsEscaped": true } }, "Layers": [ { "Size": 77895680, "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, { "Size": 21504, "Digest": "sha256:af54a8f1f08bff19af42c05615745e74742a74437bb1c5e1e99bf0dcb8048257", "DiffID": "sha256:e8e8bcb08674cd0ecf9850d66bc246bb95fa086eb6c988ab48d0404501029ddc" }, { "Size": 146762752, "Digest": "sha256:35e38e1826d7cdf22ea45a4223741e4cc126db5a2a07cf2072b229270180f920", "DiffID": "sha256:ec5d0255c8bf10ce4313e611ec0a35f9de699c6284e69e4c4fdcc5ea6e82adbf" }, { "Size": 7214592, "Digest": "sha256:15f27b93c93d3aaa4df09438a96bad3709b6cbbc38659014d17cc61d8d4fabb9", "DiffID": "sha256:625ca884ca91515900d06a970e88957ac4d2e8963c4a0cc699e069ef7e3c7371" }, { "Size": 3584, "Digest": "sha256:3f4664f9b20d6f144b2674c2c40de02509aabd87eae0a2d31a62de37444d13e8", "DiffID": "sha256:7ad824b880674ec5cd6d6ef28d7d4783bcd5194ccf30ae225d5eeed0093ff31a" }, { "Size": 553861632, "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, { "Size": 2048, "DiffID": "sha256:556640d21aeb0a0c14eae8d14adcec71b507d776f59838a0750dc89eeaf6bfe9" }, { "Size": 65024, "DiffID": "sha256:a90fdd1491bbbbbb6935b02b0278000af1ac8528216740d10d2922d8893840f4" }, { "Size": 45381632, "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, { "Size": 5547008, "DiffID": "sha256:6e34b79a11bc6a16694520b031c33ad999cdb512460e492871038209b003bab6" }, { "Size": 42496, "DiffID": "sha256:c12ee0b2d8a0e826e365f743dfce3b3066d052963dfa557ff90e3e4f1c68a306" }, { "Size": 4608, "DiffID": "sha256:55eb071193f7d6c07cf128be0f9176ecca38319c44ba9b8451cd3c1b294954b9" }, { "Size": 6656, "DiffID": "sha256:7cbf13b17726dbb35117d3a060626e84d8fcc43ffbca24ee1f3c32e3ef2289f0" } ] }, "Results": [ { "Target": "/tmp/finetic-trust-scan/0.1.92/finetic-0.1.92-published-amd64.tar (debian 12.15)", "Class": "os-pkgs", "Type": "debian", "Packages": [ { "ID": "adduser@3.134", "Name": "adduser", "Identifier": { "PURL": "pkg:deb/debian/adduser@3.134?arch=all\u0026distro=debian-12.15", "UID": "93cd263bba1f52c7" }, "Version": "3.134", "Arch": "all", "SrcName": "adduser", "SrcVersion": "3.134", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Adduser Developers \u003cadduser@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "passwd@1:4.13+dfsg1-1+deb12u2" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/sbin/adduser", "/usr/sbin/deluser", "/usr/share/doc/adduser/NEWS.Debian.gz", "/usr/share/doc/adduser/README.gz", "/usr/share/doc/adduser/TODO", "/usr/share/doc/adduser/changelog.gz", "/usr/share/doc/adduser/copyright", "/usr/share/doc/adduser/examples/INSTALL", "/usr/share/doc/adduser/examples/README", "/usr/share/doc/adduser/examples/adduser.conf", "/usr/share/doc/adduser/examples/adduser.local", "/usr/share/doc/adduser/examples/adduser.local.conf", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/bash.bashrc", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/profile", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel.other/index.html", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bash_logout", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bash_profile", "/usr/share/doc/adduser/examples/adduser.local.conf.examples/skel/dot.bashrc", "/usr/share/doc/adduser/examples/deluser.conf", "/usr/share/locale/ca/LC_MESSAGES/adduser.mo", "/usr/share/locale/cs/LC_MESSAGES/adduser.mo", "/usr/share/locale/da/LC_MESSAGES/adduser.mo", "/usr/share/locale/de/LC_MESSAGES/adduser.mo", "/usr/share/locale/es/LC_MESSAGES/adduser.mo", "/usr/share/locale/eu/LC_MESSAGES/adduser.mo", "/usr/share/locale/fr/LC_MESSAGES/adduser.mo", "/usr/share/locale/gl/LC_MESSAGES/adduser.mo", "/usr/share/locale/hu/LC_MESSAGES/adduser.mo", "/usr/share/locale/it/LC_MESSAGES/adduser.mo", "/usr/share/locale/ja/LC_MESSAGES/adduser.mo", "/usr/share/locale/ko/LC_MESSAGES/adduser.mo", "/usr/share/locale/nb/LC_MESSAGES/adduser.mo", "/usr/share/locale/nl/LC_MESSAGES/adduser.mo", "/usr/share/locale/pl/LC_MESSAGES/adduser.mo", "/usr/share/locale/pt/LC_MESSAGES/adduser.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/adduser.mo", "/usr/share/locale/ru/LC_MESSAGES/adduser.mo", "/usr/share/locale/sk/LC_MESSAGES/adduser.mo", "/usr/share/locale/sv/LC_MESSAGES/adduser.mo", "/usr/share/locale/uk/LC_MESSAGES/adduser.mo", "/usr/share/locale/vi/LC_MESSAGES/adduser.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/adduser.mo", "/usr/share/man/de/man5/adduser.conf.5.gz", "/usr/share/man/de/man5/deluser.conf.5.gz", "/usr/share/man/de/man8/adduser.8.gz", "/usr/share/man/de/man8/deluser.8.gz", "/usr/share/man/fr/man5/adduser.conf.5.gz", "/usr/share/man/fr/man5/deluser.conf.5.gz", "/usr/share/man/fr/man8/adduser.8.gz", "/usr/share/man/fr/man8/deluser.8.gz", "/usr/share/man/man5/adduser.conf.5.gz", "/usr/share/man/man5/deluser.conf.5.gz", "/usr/share/man/man8/adduser.8.gz", "/usr/share/man/man8/adduser.local.8.gz", "/usr/share/man/man8/deluser.8.gz", "/usr/share/man/nl/man5/adduser.conf.5.gz", "/usr/share/man/nl/man5/deluser.conf.5.gz", "/usr/share/man/nl/man8/adduser.8.gz", "/usr/share/man/nl/man8/deluser.8.gz", "/usr/share/man/pt/man5/adduser.conf.5.gz", "/usr/share/man/pt/man5/deluser.conf.5.gz", "/usr/share/man/pt/man8/adduser.8.gz", "/usr/share/man/pt/man8/deluser.8.gz", "/usr/share/perl5/Debian/AdduserCommon.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "apt@2.6.1", "Name": "apt", "Identifier": { "PURL": "pkg:deb/debian/apt@2.6.1?arch=amd64\u0026distro=debian-12.15", "UID": "48017cded9d6e9b5" }, "Version": "2.6.1", "Arch": "amd64", "SrcName": "apt", "SrcVersion": "2.6.1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "BSD-3-Clause", "MIT" ], "Maintainer": "APT Development Team \u003cdeity@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "adduser@3.134", "debian-archive-keyring@2023.3+deb12u2", "gpgv@2.2.40-1.1+deb12u2", "libapt-pkg6.0@2.6.1", "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libgnutls30@3.7.9-2+deb12u7", "libseccomp2@2.5.4-1+deb12u1", "libstdc++6@12.2.0-14+deb12u1", "libsystemd0@252.39-1~deb12u2" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/systemd/system/apt-daily-upgrade.service", "/lib/systemd/system/apt-daily-upgrade.timer", "/lib/systemd/system/apt-daily.service", "/lib/systemd/system/apt-daily.timer", "/usr/bin/apt", "/usr/bin/apt-cache", "/usr/bin/apt-cdrom", "/usr/bin/apt-config", "/usr/bin/apt-get", "/usr/bin/apt-key", "/usr/bin/apt-mark", "/usr/lib/apt/apt-helper", "/usr/lib/apt/apt.systemd.daily", "/usr/lib/apt/methods/cdrom", "/usr/lib/apt/methods/copy", "/usr/lib/apt/methods/file", "/usr/lib/apt/methods/ftp", "/usr/lib/apt/methods/gpgv", "/usr/lib/apt/methods/http", "/usr/lib/apt/methods/mirror", "/usr/lib/apt/methods/rred", "/usr/lib/apt/methods/rsh", "/usr/lib/apt/methods/store", "/usr/lib/apt/solvers/dump", "/usr/lib/dpkg/methods/apt/desc.apt", "/usr/lib/dpkg/methods/apt/install", "/usr/lib/dpkg/methods/apt/names", "/usr/lib/dpkg/methods/apt/setup", "/usr/lib/dpkg/methods/apt/update", "/usr/lib/x86_64-linux-gnu/libapt-private.so.0.0.0", "/usr/share/bash-completion/completions/apt", "/usr/share/bug/apt/script", "/usr/share/doc/apt/NEWS.Debian.gz", "/usr/share/doc/apt/README.md.gz", "/usr/share/doc/apt/changelog.gz", "/usr/share/doc/apt/copyright", "/usr/share/doc/apt/examples/apt.conf", "/usr/share/doc/apt/examples/configure-index", "/usr/share/doc/apt/examples/preferences", "/usr/share/doc/apt/examples/sources.list", "/usr/share/lintian/overrides/apt", "/usr/share/locale/ar/LC_MESSAGES/apt.mo", "/usr/share/locale/ast/LC_MESSAGES/apt.mo", "/usr/share/locale/bg/LC_MESSAGES/apt.mo", "/usr/share/locale/bs/LC_MESSAGES/apt.mo", "/usr/share/locale/ca/LC_MESSAGES/apt.mo", "/usr/share/locale/cs/LC_MESSAGES/apt.mo", "/usr/share/locale/cy/LC_MESSAGES/apt.mo", "/usr/share/locale/da/LC_MESSAGES/apt.mo", "/usr/share/locale/de/LC_MESSAGES/apt.mo", "/usr/share/locale/dz/LC_MESSAGES/apt.mo", "/usr/share/locale/el/LC_MESSAGES/apt.mo", "/usr/share/locale/es/LC_MESSAGES/apt.mo", "/usr/share/locale/eu/LC_MESSAGES/apt.mo", "/usr/share/locale/fi/LC_MESSAGES/apt.mo", "/usr/share/locale/fr/LC_MESSAGES/apt.mo", "/usr/share/locale/gl/LC_MESSAGES/apt.mo", "/usr/share/locale/hu/LC_MESSAGES/apt.mo", "/usr/share/locale/it/LC_MESSAGES/apt.mo", "/usr/share/locale/ja/LC_MESSAGES/apt.mo", "/usr/share/locale/km/LC_MESSAGES/apt.mo", "/usr/share/locale/ko/LC_MESSAGES/apt.mo", "/usr/share/locale/ku/LC_MESSAGES/apt.mo", "/usr/share/locale/lt/LC_MESSAGES/apt.mo", "/usr/share/locale/mr/LC_MESSAGES/apt.mo", "/usr/share/locale/nb/LC_MESSAGES/apt.mo", "/usr/share/locale/ne/LC_MESSAGES/apt.mo", "/usr/share/locale/nl/LC_MESSAGES/apt.mo", "/usr/share/locale/nn/LC_MESSAGES/apt.mo", "/usr/share/locale/pl/LC_MESSAGES/apt.mo", "/usr/share/locale/pt/LC_MESSAGES/apt.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/apt.mo", "/usr/share/locale/ro/LC_MESSAGES/apt.mo", "/usr/share/locale/ru/LC_MESSAGES/apt.mo", "/usr/share/locale/sk/LC_MESSAGES/apt.mo", "/usr/share/locale/sl/LC_MESSAGES/apt.mo", "/usr/share/locale/sv/LC_MESSAGES/apt.mo", "/usr/share/locale/th/LC_MESSAGES/apt.mo", "/usr/share/locale/tl/LC_MESSAGES/apt.mo", "/usr/share/locale/tr/LC_MESSAGES/apt.mo", "/usr/share/locale/uk/LC_MESSAGES/apt.mo", "/usr/share/locale/vi/LC_MESSAGES/apt.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/apt.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/apt.mo", "/usr/share/man/de/man1/apt-transport-http.1.gz", "/usr/share/man/de/man1/apt-transport-https.1.gz", "/usr/share/man/de/man1/apt-transport-mirror.1.gz", "/usr/share/man/de/man5/apt.conf.5.gz", "/usr/share/man/de/man5/apt_auth.conf.5.gz", "/usr/share/man/de/man5/apt_preferences.5.gz", "/usr/share/man/de/man5/sources.list.5.gz", "/usr/share/man/de/man7/apt-patterns.7.gz", "/usr/share/man/de/man8/apt-cache.8.gz", "/usr/share/man/de/man8/apt-cdrom.8.gz", "/usr/share/man/de/man8/apt-config.8.gz", "/usr/share/man/de/man8/apt-get.8.gz", "/usr/share/man/de/man8/apt-mark.8.gz", "/usr/share/man/de/man8/apt-secure.8.gz", "/usr/share/man/de/man8/apt.8.gz", "/usr/share/man/es/man5/apt_preferences.5.gz", "/usr/share/man/es/man8/apt-cache.8.gz", "/usr/share/man/es/man8/apt-cdrom.8.gz", "/usr/share/man/es/man8/apt-config.8.gz", "/usr/share/man/fr/man1/apt-transport-http.1.gz", "/usr/share/man/fr/man1/apt-transport-https.1.gz", "/usr/share/man/fr/man1/apt-transport-mirror.1.gz", "/usr/share/man/fr/man5/apt.conf.5.gz", "/usr/share/man/fr/man5/apt_auth.conf.5.gz", "/usr/share/man/fr/man5/apt_preferences.5.gz", "/usr/share/man/fr/man5/sources.list.5.gz", "/usr/share/man/fr/man8/apt-cache.8.gz", "/usr/share/man/fr/man8/apt-cdrom.8.gz", "/usr/share/man/fr/man8/apt-config.8.gz", "/usr/share/man/fr/man8/apt-get.8.gz", "/usr/share/man/fr/man8/apt-mark.8.gz", "/usr/share/man/fr/man8/apt-secure.8.gz", "/usr/share/man/fr/man8/apt.8.gz", "/usr/share/man/it/man5/apt.conf.5.gz", "/usr/share/man/it/man5/apt_preferences.5.gz", "/usr/share/man/it/man5/sources.list.5.gz", "/usr/share/man/it/man8/apt-cache.8.gz", "/usr/share/man/it/man8/apt-cdrom.8.gz", "/usr/share/man/it/man8/apt-config.8.gz", "/usr/share/man/it/man8/apt-get.8.gz", "/usr/share/man/it/man8/apt-mark.8.gz", "/usr/share/man/it/man8/apt-secure.8.gz", "/usr/share/man/it/man8/apt.8.gz", "/usr/share/man/ja/man5/apt.conf.5.gz", "/usr/share/man/ja/man5/apt_preferences.5.gz", "/usr/share/man/ja/man5/sources.list.5.gz", "/usr/share/man/ja/man8/apt-cache.8.gz", "/usr/share/man/ja/man8/apt-cdrom.8.gz", "/usr/share/man/ja/man8/apt-config.8.gz", "/usr/share/man/ja/man8/apt-get.8.gz", "/usr/share/man/ja/man8/apt-mark.8.gz", "/usr/share/man/ja/man8/apt-secure.8.gz", "/usr/share/man/ja/man8/apt.8.gz", "/usr/share/man/man1/apt-transport-http.1.gz", "/usr/share/man/man1/apt-transport-https.1.gz", "/usr/share/man/man1/apt-transport-mirror.1.gz", "/usr/share/man/man5/apt.conf.5.gz", "/usr/share/man/man5/apt_auth.conf.5.gz", "/usr/share/man/man5/apt_preferences.5.gz", "/usr/share/man/man5/sources.list.5.gz", "/usr/share/man/man7/apt-patterns.7.gz", "/usr/share/man/man8/apt-cache.8.gz", "/usr/share/man/man8/apt-cdrom.8.gz", "/usr/share/man/man8/apt-config.8.gz", "/usr/share/man/man8/apt-get.8.gz", "/usr/share/man/man8/apt-key.8.gz", "/usr/share/man/man8/apt-mark.8.gz", "/usr/share/man/man8/apt-secure.8.gz", "/usr/share/man/man8/apt.8.gz", "/usr/share/man/nl/man1/apt-transport-http.1.gz", "/usr/share/man/nl/man1/apt-transport-https.1.gz", "/usr/share/man/nl/man1/apt-transport-mirror.1.gz", "/usr/share/man/nl/man5/apt.conf.5.gz", "/usr/share/man/nl/man5/apt_auth.conf.5.gz", "/usr/share/man/nl/man5/apt_preferences.5.gz", "/usr/share/man/nl/man5/sources.list.5.gz", "/usr/share/man/nl/man7/apt-patterns.7.gz", "/usr/share/man/nl/man8/apt-cache.8.gz", "/usr/share/man/nl/man8/apt-cdrom.8.gz", "/usr/share/man/nl/man8/apt-config.8.gz", "/usr/share/man/nl/man8/apt-get.8.gz", "/usr/share/man/nl/man8/apt-key.8.gz", "/usr/share/man/nl/man8/apt-mark.8.gz", "/usr/share/man/nl/man8/apt-secure.8.gz", "/usr/share/man/nl/man8/apt.8.gz", "/usr/share/man/pl/man5/apt_preferences.5.gz", "/usr/share/man/pl/man8/apt-cache.8.gz", "/usr/share/man/pl/man8/apt-cdrom.8.gz", "/usr/share/man/pl/man8/apt-config.8.gz", "/usr/share/man/pt/man1/apt-transport-http.1.gz", "/usr/share/man/pt/man1/apt-transport-https.1.gz", "/usr/share/man/pt/man1/apt-transport-mirror.1.gz", "/usr/share/man/pt/man5/apt.conf.5.gz", "/usr/share/man/pt/man5/apt_auth.conf.5.gz", "/usr/share/man/pt/man5/apt_preferences.5.gz", "/usr/share/man/pt/man5/sources.list.5.gz", "/usr/share/man/pt/man7/apt-patterns.7.gz", "/usr/share/man/pt/man8/apt-cache.8.gz", "/usr/share/man/pt/man8/apt-cdrom.8.gz", "/usr/share/man/pt/man8/apt-config.8.gz", "/usr/share/man/pt/man8/apt-get.8.gz", "/usr/share/man/pt/man8/apt-key.8.gz", "/usr/share/man/pt/man8/apt-mark.8.gz", "/usr/share/man/pt/man8/apt-secure.8.gz", "/usr/share/man/pt/man8/apt.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "base-files@12.4+deb12u15", "Name": "base-files", "Identifier": { "PURL": "pkg:deb/debian/base-files@12.4%2Bdeb12u15?arch=amd64\u0026distro=debian-12.15", "UID": "54cf880c47356c6e" }, "Version": "12.4+deb12u15", "Arch": "amd64", "SrcName": "base-files", "SrcVersion": "12.4+deb12u15", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Santiago Vila \u003csanvila@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/os-release", "/usr/share/base-files/dot.bashrc", "/usr/share/base-files/dot.profile", "/usr/share/base-files/dot.profile.md5sums", "/usr/share/base-files/info.dir", "/usr/share/base-files/motd", "/usr/share/base-files/profile", "/usr/share/base-files/profile.md5sums", "/usr/share/base-files/staff-group-for-usr-local", "/usr/share/common-licenses/Apache-2.0", "/usr/share/common-licenses/Artistic", "/usr/share/common-licenses/BSD", "/usr/share/common-licenses/CC0-1.0", "/usr/share/common-licenses/GFDL-1.2", "/usr/share/common-licenses/GFDL-1.3", "/usr/share/common-licenses/GPL-1", "/usr/share/common-licenses/GPL-2", "/usr/share/common-licenses/GPL-3", "/usr/share/common-licenses/LGPL-2", "/usr/share/common-licenses/LGPL-2.1", "/usr/share/common-licenses/LGPL-3", "/usr/share/common-licenses/MPL-1.1", "/usr/share/common-licenses/MPL-2.0", "/usr/share/doc/base-files/README", "/usr/share/doc/base-files/README.FHS", "/usr/share/doc/base-files/changelog.gz", "/usr/share/doc/base-files/copyright", "/usr/share/lintian/overrides/base-files" ], "AnalyzedBy": "dpkg" }, { "ID": "base-passwd@3.6.1", "Name": "base-passwd", "Identifier": { "PURL": "pkg:deb/debian/base-passwd@3.6.1?arch=amd64\u0026distro=debian-12.15", "UID": "256ec184a02b999c" }, "Version": "3.6.1", "Arch": "amd64", "SrcName": "base-passwd", "SrcVersion": "3.6.1", "Licenses": [ "GPL-2.0-only", "public-domain" ], "Maintainer": "Colin Watson \u003ccjwatson@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdebconfclient0@0.270", "libselinux1@3.4-1+b6" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/sbin/update-passwd", "/usr/share/base-passwd/group.master", "/usr/share/base-passwd/passwd.master", "/usr/share/doc-base/base-passwd.users-and-groups", "/usr/share/doc/base-passwd/README", "/usr/share/doc/base-passwd/changelog.gz", "/usr/share/doc/base-passwd/copyright", "/usr/share/doc/base-passwd/users-and-groups.html", "/usr/share/doc/base-passwd/users-and-groups.txt.gz", "/usr/share/lintian/overrides/base-passwd", "/usr/share/man/de/man8/update-passwd.8.gz", "/usr/share/man/es/man8/update-passwd.8.gz", "/usr/share/man/fr/man8/update-passwd.8.gz", "/usr/share/man/ja/man8/update-passwd.8.gz", "/usr/share/man/man8/update-passwd.8.gz", "/usr/share/man/pl/man8/update-passwd.8.gz", "/usr/share/man/ru/man8/update-passwd.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "bash@5.2.15-2+b13", "Name": "bash", "Identifier": { "PURL": "pkg:deb/debian/bash@5.2.15-2%2Bb13?arch=amd64\u0026distro=debian-12.15", "UID": "571283fff037d17a" }, "Version": "5.2.15", "Release": "2+b13", "Arch": "amd64", "SrcName": "bash", "SrcVersion": "5.2.15", "SrcRelease": "2", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-3+ with Bison exception", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only", "Latex2e", "BSD-4-Clause-UC", "MIT", "permissive" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "base-files@12.4+deb12u15", "debianutils@5.7-0.5~deb12u1" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/bin/bash", "/usr/bin/bashbug", "/usr/bin/clear_console", "/usr/share/debianutils/shells.d/bash", "/usr/share/doc/bash/CHANGES.gz", "/usr/share/doc/bash/COMPAT.gz", "/usr/share/doc/bash/INTRO.gz", "/usr/share/doc/bash/NEWS.gz", "/usr/share/doc/bash/POSIX.gz", "/usr/share/doc/bash/RBASH", "/usr/share/doc/bash/README.Debian.gz", "/usr/share/doc/bash/README.abs-guide", "/usr/share/doc/bash/README.commands.gz", "/usr/share/doc/bash/README.gz", "/usr/share/doc/bash/changelog.Debian.amd64.gz", "/usr/share/doc/bash/changelog.Debian.gz", "/usr/share/doc/bash/changelog.gz", "/usr/share/doc/bash/copyright", "/usr/share/doc/bash/inputrc.arrows", "/usr/share/lintian/overrides/bash", "/usr/share/locale/af/LC_MESSAGES/bash.mo", "/usr/share/locale/bg/LC_MESSAGES/bash.mo", "/usr/share/locale/ca/LC_MESSAGES/bash.mo", "/usr/share/locale/cs/LC_MESSAGES/bash.mo", "/usr/share/locale/da/LC_MESSAGES/bash.mo", "/usr/share/locale/de/LC_MESSAGES/bash.mo", "/usr/share/locale/el/LC_MESSAGES/bash.mo", "/usr/share/locale/en@boldquot/LC_MESSAGES/bash.mo", "/usr/share/locale/en@quot/LC_MESSAGES/bash.mo", "/usr/share/locale/eo/LC_MESSAGES/bash.mo", "/usr/share/locale/es/LC_MESSAGES/bash.mo", "/usr/share/locale/et/LC_MESSAGES/bash.mo", "/usr/share/locale/fi/LC_MESSAGES/bash.mo", "/usr/share/locale/fr/LC_MESSAGES/bash.mo", "/usr/share/locale/ga/LC_MESSAGES/bash.mo", "/usr/share/locale/gl/LC_MESSAGES/bash.mo", "/usr/share/locale/hr/LC_MESSAGES/bash.mo", "/usr/share/locale/hu/LC_MESSAGES/bash.mo", "/usr/share/locale/id/LC_MESSAGES/bash.mo", "/usr/share/locale/it/LC_MESSAGES/bash.mo", "/usr/share/locale/ja/LC_MESSAGES/bash.mo", "/usr/share/locale/ko/LC_MESSAGES/bash.mo", "/usr/share/locale/lt/LC_MESSAGES/bash.mo", "/usr/share/locale/nb/LC_MESSAGES/bash.mo", "/usr/share/locale/nl/LC_MESSAGES/bash.mo", "/usr/share/locale/pl/LC_MESSAGES/bash.mo", "/usr/share/locale/pt/LC_MESSAGES/bash.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/bash.mo", "/usr/share/locale/ro/LC_MESSAGES/bash.mo", "/usr/share/locale/ru/LC_MESSAGES/bash.mo", "/usr/share/locale/sk/LC_MESSAGES/bash.mo", "/usr/share/locale/sl/LC_MESSAGES/bash.mo", "/usr/share/locale/sr/LC_MESSAGES/bash.mo", "/usr/share/locale/sv/LC_MESSAGES/bash.mo", "/usr/share/locale/tr/LC_MESSAGES/bash.mo", "/usr/share/locale/uk/LC_MESSAGES/bash.mo", "/usr/share/locale/vi/LC_MESSAGES/bash.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/bash.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/bash.mo", "/usr/share/man/man1/bash.1.gz", "/usr/share/man/man1/bashbug.1.gz", "/usr/share/man/man1/clear_console.1.gz", "/usr/share/man/man1/rbash.1.gz", "/usr/share/man/man7/bash-builtins.7.gz", "/usr/share/menu/bash" ], "AnalyzedBy": "dpkg" }, { "ID": "bsdutils@1:2.38.1-5+deb12u3", "Name": "bsdutils", "Identifier": { "PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "af5a434542493ff" }, "Version": "2.38.1", "Release": "5+deb12u3", "Epoch": 1, "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/bin/logger", "/usr/bin/renice", "/usr/bin/script", "/usr/bin/scriptlive", "/usr/bin/scriptreplay", "/usr/bin/wall", "/usr/share/bash-completion/completions/logger", "/usr/share/bash-completion/completions/renice", "/usr/share/bash-completion/completions/script", "/usr/share/bash-completion/completions/scriptlive", "/usr/share/bash-completion/completions/scriptreplay", "/usr/share/bash-completion/completions/wall", "/usr/share/doc/bsdutils/changelog.Debian.gz", "/usr/share/doc/bsdutils/changelog.gz", "/usr/share/doc/bsdutils/copyright", "/usr/share/lintian/overrides/bsdutils", "/usr/share/man/man1/logger.1.gz", "/usr/share/man/man1/renice.1.gz", "/usr/share/man/man1/script.1.gz", "/usr/share/man/man1/scriptlive.1.gz", "/usr/share/man/man1/scriptreplay.1.gz", "/usr/share/man/man1/wall.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ca-certificates@20230311+deb12u1", "Name": "ca-certificates", "Identifier": { "PURL": "pkg:deb/debian/ca-certificates@20230311%2Bdeb12u1?arch=all\u0026distro=debian-12.15", "UID": "a1ea087f69a23f3e" }, "Version": "20230311+deb12u1", "Arch": "all", "SrcName": "ca-certificates", "SrcVersion": "20230311+deb12u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "MPL-2.0" ], "Maintainer": "Julien Cristau \u003cjcristau@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.82", "openssl@3.0.20-1~deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/sbin/update-ca-certificates", "/usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", "/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", "/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", "/usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt", "/usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", "/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", "/usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", "/usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068_2.crt", "/usr/share/ca-certificates/mozilla/Baltimore_CyberTrust_Root.crt", "/usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", "/usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", "/usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", "/usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", "/usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", "/usr/share/ca-certificates/mozilla/Certigna.crt", "/usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", "/usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", "/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", "/usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt", "/usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", "/usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", "/usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", "/usr/share/ca-certificates/mozilla/E-Tugra_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/E-Tugra_Global_Root_CA_ECC_v3.crt", "/usr/share/ca-certificates/mozilla/E-Tugra_Global_Root_CA_RSA_v3.crt", "/usr/share/ca-certificates/mozilla/Entrust.net_Premium_2048_Secure_Server_CA.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G4.crt", "/usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", "/usr/share/ca-certificates/mozilla/GLOBALTRUST_2020.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R2.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", "/usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", "/usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", "/usr/share/ca-certificates/mozilla/Go_Daddy_Class_2_CA.crt", "/usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", "/usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", "/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", "/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", "/usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", "/usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", "/usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", "/usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", "/usr/share/ca-certificates/mozilla/Izenpe.com.crt", "/usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", "/usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", "/usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", "/usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", "/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", "/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt", "/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", "/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", "/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", "/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", "/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", "/usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", "/usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", "/usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", "/usr/share/ca-certificates/mozilla/SecureSign_RootCA11.crt", "/usr/share/ca-certificates/mozilla/SecureTrust_CA.crt", "/usr/share/ca-certificates/mozilla/Secure_Global_CA.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_RootCA3.crt", "/usr/share/ca-certificates/mozilla/Security_Communication_Root_CA.crt", "/usr/share/ca-certificates/mozilla/Starfield_Class_2_CA.crt", "/usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", "/usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt", "/usr/share/ca-certificates/mozilla/SwissSign_Silver_CA_-_G2.crt", "/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", "/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", "/usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", "/usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", "/usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt", "/usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", "/usr/share/ca-certificates/mozilla/TrustCor_ECA-1.crt", "/usr/share/ca-certificates/mozilla/TrustCor_RootCert_CA-1.crt", "/usr/share/ca-certificates/mozilla/TrustCor_RootCert_CA-2.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P256_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P384_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", "/usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", "/usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", "/usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/XRamp_Global_CA_Root.crt", "/usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt", "/usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", "/usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", "/usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", "/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", "/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", "/usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", "/usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", "/usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", "/usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt", "/usr/share/doc/ca-certificates/README.Debian", "/usr/share/doc/ca-certificates/changelog.gz", "/usr/share/doc/ca-certificates/copyright", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/Makefile", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/README", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/ca-certificates-local.triggers", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/changelog", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/compat", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/control", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/copyright", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/postrm", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/rules", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/source/format", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/local/Local_Root_CA.crt", "/usr/share/doc/ca-certificates/examples/ca-certificates-local/local/Makefile", "/usr/share/man/man8/update-ca-certificates.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "coreutils@9.1-1", "Name": "coreutils", "Identifier": { "PURL": "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12.15", "UID": "4dcfd69f3b62ab36" }, "Version": "9.1", "Release": "1", "Arch": "amd64", "SrcName": "coreutils", "SrcVersion": "9.1", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "BSD-4-Clause-UC", "GPL-3.0-only", "ISC", "FSFULLR", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only" ], "Maintainer": "Michael Stone \u003cmstone@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/bin/cat", "/bin/chgrp", "/bin/chmod", "/bin/chown", "/bin/cp", "/bin/date", "/bin/dd", "/bin/df", "/bin/dir", "/bin/echo", "/bin/false", "/bin/ln", "/bin/ls", "/bin/mkdir", "/bin/mknod", "/bin/mktemp", "/bin/mv", "/bin/pwd", "/bin/readlink", "/bin/rm", "/bin/rmdir", "/bin/sleep", "/bin/stty", "/bin/sync", "/bin/touch", "/bin/true", "/bin/uname", "/bin/vdir", "/usr/bin/[", "/usr/bin/arch", "/usr/bin/b2sum", "/usr/bin/base32", "/usr/bin/base64", "/usr/bin/basename", "/usr/bin/basenc", "/usr/bin/chcon", "/usr/bin/cksum", "/usr/bin/comm", "/usr/bin/csplit", "/usr/bin/cut", "/usr/bin/dircolors", "/usr/bin/dirname", "/usr/bin/du", "/usr/bin/env", "/usr/bin/expand", "/usr/bin/expr", "/usr/bin/factor", "/usr/bin/fmt", "/usr/bin/fold", "/usr/bin/groups", "/usr/bin/head", "/usr/bin/hostid", "/usr/bin/id", "/usr/bin/install", "/usr/bin/join", "/usr/bin/link", "/usr/bin/logname", "/usr/bin/md5sum", "/usr/bin/mkfifo", "/usr/bin/nice", "/usr/bin/nl", "/usr/bin/nohup", "/usr/bin/nproc", "/usr/bin/numfmt", "/usr/bin/od", "/usr/bin/paste", "/usr/bin/pathchk", "/usr/bin/pinky", "/usr/bin/pr", "/usr/bin/printenv", "/usr/bin/printf", "/usr/bin/ptx", "/usr/bin/realpath", "/usr/bin/runcon", "/usr/bin/seq", "/usr/bin/sha1sum", "/usr/bin/sha224sum", "/usr/bin/sha256sum", "/usr/bin/sha384sum", "/usr/bin/sha512sum", "/usr/bin/shred", "/usr/bin/shuf", "/usr/bin/sort", "/usr/bin/split", "/usr/bin/stat", "/usr/bin/stdbuf", "/usr/bin/sum", "/usr/bin/tac", "/usr/bin/tail", "/usr/bin/tee", "/usr/bin/test", "/usr/bin/timeout", "/usr/bin/tr", "/usr/bin/truncate", "/usr/bin/tsort", "/usr/bin/tty", "/usr/bin/unexpand", "/usr/bin/uniq", "/usr/bin/unlink", "/usr/bin/users", "/usr/bin/wc", "/usr/bin/who", "/usr/bin/whoami", "/usr/bin/yes", "/usr/libexec/coreutils/libstdbuf.so", "/usr/sbin/chroot", "/usr/share/doc/coreutils/AUTHORS", "/usr/share/doc/coreutils/NEWS.Debian.gz", "/usr/share/doc/coreutils/NEWS.gz", "/usr/share/doc/coreutils/README.Debian", "/usr/share/doc/coreutils/README.gz", "/usr/share/doc/coreutils/THANKS.gz", "/usr/share/doc/coreutils/TODO.gz", "/usr/share/doc/coreutils/changelog.Debian.gz", "/usr/share/doc/coreutils/changelog.gz", "/usr/share/doc/coreutils/copyright", "/usr/share/info/coreutils.info.gz", "/usr/share/locale/af/LC_MESSAGES/coreutils.mo", "/usr/share/locale/be/LC_MESSAGES/coreutils.mo", "/usr/share/locale/bg/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ca/LC_MESSAGES/coreutils.mo", "/usr/share/locale/cs/LC_MESSAGES/coreutils.mo", "/usr/share/locale/da/LC_MESSAGES/coreutils.mo", "/usr/share/locale/de/LC_MESSAGES/coreutils.mo", "/usr/share/locale/el/LC_MESSAGES/coreutils.mo", "/usr/share/locale/eo/LC_MESSAGES/coreutils.mo", "/usr/share/locale/es/LC_MESSAGES/coreutils.mo", "/usr/share/locale/et/LC_MESSAGES/coreutils.mo", "/usr/share/locale/eu/LC_MESSAGES/coreutils.mo", "/usr/share/locale/fi/LC_MESSAGES/coreutils.mo", "/usr/share/locale/fr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ga/LC_MESSAGES/coreutils.mo", "/usr/share/locale/gl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/hr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/hu/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ia/LC_MESSAGES/coreutils.mo", "/usr/share/locale/id/LC_MESSAGES/coreutils.mo", "/usr/share/locale/it/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ja/LC_MESSAGES/coreutils.mo", "/usr/share/locale/kk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ko/LC_MESSAGES/coreutils.mo", "/usr/share/locale/lg/LC_MESSAGES/coreutils.mo", "/usr/share/locale/lt/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ms/LC_MESSAGES/coreutils.mo", "/usr/share/locale/nb/LC_MESSAGES/coreutils.mo", "/usr/share/locale/nl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pt/LC_MESSAGES/coreutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ro/LC_MESSAGES/coreutils.mo", "/usr/share/locale/ru/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sl/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/sv/LC_MESSAGES/coreutils.mo", "/usr/share/locale/tr/LC_MESSAGES/coreutils.mo", "/usr/share/locale/uk/LC_MESSAGES/coreutils.mo", "/usr/share/locale/vi/LC_MESSAGES/coreutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/coreutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/coreutils.mo", "/usr/share/man/man1/arch.1.gz", "/usr/share/man/man1/b2sum.1.gz", "/usr/share/man/man1/base32.1.gz", "/usr/share/man/man1/base64.1.gz", "/usr/share/man/man1/basename.1.gz", "/usr/share/man/man1/basenc.1.gz", "/usr/share/man/man1/cat.1.gz", "/usr/share/man/man1/chcon.1.gz", "/usr/share/man/man1/chgrp.1.gz", "/usr/share/man/man1/chmod.1.gz", "/usr/share/man/man1/chown.1.gz", "/usr/share/man/man1/cksum.1.gz", "/usr/share/man/man1/comm.1.gz", "/usr/share/man/man1/cp.1.gz", "/usr/share/man/man1/csplit.1.gz", "/usr/share/man/man1/cut.1.gz", "/usr/share/man/man1/date.1.gz", "/usr/share/man/man1/dd.1.gz", "/usr/share/man/man1/df.1.gz", "/usr/share/man/man1/dir.1.gz", "/usr/share/man/man1/dircolors.1.gz", "/usr/share/man/man1/dirname.1.gz", "/usr/share/man/man1/du.1.gz", "/usr/share/man/man1/echo.1.gz", "/usr/share/man/man1/env.1.gz", "/usr/share/man/man1/expand.1.gz", "/usr/share/man/man1/expr.1.gz", "/usr/share/man/man1/factor.1.gz", "/usr/share/man/man1/false.1.gz", "/usr/share/man/man1/fmt.1.gz", "/usr/share/man/man1/fold.1.gz", "/usr/share/man/man1/groups.1.gz", "/usr/share/man/man1/head.1.gz", "/usr/share/man/man1/hostid.1.gz", "/usr/share/man/man1/id.1.gz", "/usr/share/man/man1/install.1.gz", "/usr/share/man/man1/join.1.gz", "/usr/share/man/man1/link.1.gz", "/usr/share/man/man1/ln.1.gz", "/usr/share/man/man1/logname.1.gz", "/usr/share/man/man1/ls.1.gz", "/usr/share/man/man1/md5sum.1.gz", "/usr/share/man/man1/mkdir.1.gz", "/usr/share/man/man1/mkfifo.1.gz", "/usr/share/man/man1/mknod.1.gz", "/usr/share/man/man1/mktemp.1.gz", "/usr/share/man/man1/mv.1.gz", "/usr/share/man/man1/nice.1.gz", "/usr/share/man/man1/nl.1.gz", "/usr/share/man/man1/nohup.1.gz", "/usr/share/man/man1/nproc.1.gz", "/usr/share/man/man1/numfmt.1.gz", "/usr/share/man/man1/od.1.gz", "/usr/share/man/man1/paste.1.gz", "/usr/share/man/man1/pathchk.1.gz", "/usr/share/man/man1/pinky.1.gz", "/usr/share/man/man1/pr.1.gz", "/usr/share/man/man1/printenv.1.gz", "/usr/share/man/man1/printf.1.gz", "/usr/share/man/man1/ptx.1.gz", "/usr/share/man/man1/pwd.1.gz", "/usr/share/man/man1/readlink.1.gz", "/usr/share/man/man1/realpath.1.gz", "/usr/share/man/man1/rm.1.gz", "/usr/share/man/man1/rmdir.1.gz", "/usr/share/man/man1/runcon.1.gz", "/usr/share/man/man1/seq.1.gz", "/usr/share/man/man1/sha1sum.1.gz", "/usr/share/man/man1/sha224sum.1.gz", "/usr/share/man/man1/sha256sum.1.gz", "/usr/share/man/man1/sha384sum.1.gz", "/usr/share/man/man1/sha512sum.1.gz", "/usr/share/man/man1/shred.1.gz", "/usr/share/man/man1/shuf.1.gz", "/usr/share/man/man1/sleep.1.gz", "/usr/share/man/man1/sort.1.gz", "/usr/share/man/man1/split.1.gz", "/usr/share/man/man1/stat.1.gz", "/usr/share/man/man1/stdbuf.1.gz", "/usr/share/man/man1/stty.1.gz", "/usr/share/man/man1/sum.1.gz", "/usr/share/man/man1/sync.1.gz", "/usr/share/man/man1/tac.1.gz", "/usr/share/man/man1/tail.1.gz", "/usr/share/man/man1/tee.1.gz", "/usr/share/man/man1/test.1.gz", "/usr/share/man/man1/timeout.1.gz", "/usr/share/man/man1/touch.1.gz", "/usr/share/man/man1/tr.1.gz", "/usr/share/man/man1/true.1.gz", "/usr/share/man/man1/truncate.1.gz", "/usr/share/man/man1/tsort.1.gz", "/usr/share/man/man1/tty.1.gz", "/usr/share/man/man1/uname.1.gz", "/usr/share/man/man1/unexpand.1.gz", "/usr/share/man/man1/uniq.1.gz", "/usr/share/man/man1/unlink.1.gz", "/usr/share/man/man1/users.1.gz", "/usr/share/man/man1/vdir.1.gz", "/usr/share/man/man1/wc.1.gz", "/usr/share/man/man1/who.1.gz", "/usr/share/man/man1/whoami.1.gz", "/usr/share/man/man1/yes.1.gz", "/usr/share/man/man8/chroot.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "dash@0.5.12-2", "Name": "dash", "Identifier": { "PURL": "pkg:deb/debian/dash@0.5.12-2?arch=amd64\u0026distro=debian-12.15", "UID": "6af8d86712be6c51" }, "Version": "0.5.12", "Release": "2", "Arch": "amd64", "SrcName": "dash", "SrcVersion": "0.5.12", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Andrej Shadura \u003candrewsh@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debianutils@5.7-0.5~deb12u1", "dpkg@1.21.23" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/bin/dash", "/usr/share/debianutils/shells.d/dash", "/usr/share/doc/dash/NEWS.Debian.gz", "/usr/share/doc/dash/README.Debian.diet", "/usr/share/doc/dash/README.source", "/usr/share/doc/dash/changelog.Debian.gz", "/usr/share/doc/dash/changelog.gz", "/usr/share/doc/dash/copyright", "/usr/share/lintian/overrides/dash", "/usr/share/man/man1/dash.1.gz", "/usr/share/menu/dash" ], "AnalyzedBy": "dpkg" }, { "ID": "debconf@1.5.82", "Name": "debconf", "Identifier": { "PURL": "pkg:deb/debian/debconf@1.5.82?arch=all\u0026distro=debian-12.15", "UID": "7031db14643b8375" }, "Version": "1.5.82", "Arch": "all", "SrcName": "debconf", "SrcVersion": "1.5.82", "Licenses": [ "BSD-2-Clause" ], "Maintainer": "Debconf Developers \u003cdebconf-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/bin/debconf", "/usr/bin/debconf-apt-progress", "/usr/bin/debconf-communicate", "/usr/bin/debconf-copydb", "/usr/bin/debconf-escape", "/usr/bin/debconf-set-selections", "/usr/bin/debconf-show", "/usr/sbin/dpkg-preconfigure", "/usr/sbin/dpkg-reconfigure", "/usr/share/bash-completion/completions/debconf", "/usr/share/debconf/confmodule", "/usr/share/debconf/confmodule.sh", "/usr/share/debconf/debconf.conf", "/usr/share/debconf/fix_db.pl", "/usr/share/debconf/frontend", "/usr/share/doc/debconf/NEWS.Debian.gz", "/usr/share/doc/debconf/README.Debian", "/usr/share/doc/debconf/changelog.gz", "/usr/share/doc/debconf/copyright", "/usr/share/lintian/overrides/debconf", "/usr/share/man/man1/debconf-apt-progress.1.gz", "/usr/share/man/man1/debconf-communicate.1.gz", "/usr/share/man/man1/debconf-copydb.1.gz", "/usr/share/man/man1/debconf-escape.1.gz", "/usr/share/man/man1/debconf-set-selections.1.gz", "/usr/share/man/man1/debconf-show.1.gz", "/usr/share/man/man1/debconf.1.gz", "/usr/share/man/man8/dpkg-preconfigure.8.gz", "/usr/share/man/man8/dpkg-reconfigure.8.gz", "/usr/share/perl5/Debconf/AutoSelect.pm", "/usr/share/perl5/Debconf/Base.pm", "/usr/share/perl5/Debconf/Client/ConfModule.pm", "/usr/share/perl5/Debconf/ConfModule.pm", "/usr/share/perl5/Debconf/Config.pm", "/usr/share/perl5/Debconf/Db.pm", "/usr/share/perl5/Debconf/DbDriver.pm", "/usr/share/perl5/Debconf/DbDriver/Backup.pm", "/usr/share/perl5/Debconf/DbDriver/Cache.pm", "/usr/share/perl5/Debconf/DbDriver/Copy.pm", "/usr/share/perl5/Debconf/DbDriver/Debug.pm", "/usr/share/perl5/Debconf/DbDriver/DirTree.pm", "/usr/share/perl5/Debconf/DbDriver/Directory.pm", "/usr/share/perl5/Debconf/DbDriver/File.pm", "/usr/share/perl5/Debconf/DbDriver/LDAP.pm", "/usr/share/perl5/Debconf/DbDriver/PackageDir.pm", "/usr/share/perl5/Debconf/DbDriver/Pipe.pm", "/usr/share/perl5/Debconf/DbDriver/Stack.pm", "/usr/share/perl5/Debconf/Element.pm", "/usr/share/perl5/Debconf/Element/Dialog/Boolean.pm", "/usr/share/perl5/Debconf/Element/Dialog/Error.pm", "/usr/share/perl5/Debconf/Element/Dialog/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Dialog/Note.pm", "/usr/share/perl5/Debconf/Element/Dialog/Password.pm", "/usr/share/perl5/Debconf/Element/Dialog/Progress.pm", "/usr/share/perl5/Debconf/Element/Dialog/Select.pm", "/usr/share/perl5/Debconf/Element/Dialog/String.pm", "/usr/share/perl5/Debconf/Element/Dialog/Text.pm", "/usr/share/perl5/Debconf/Element/Editor/Boolean.pm", "/usr/share/perl5/Debconf/Element/Editor/Error.pm", "/usr/share/perl5/Debconf/Element/Editor/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Editor/Note.pm", "/usr/share/perl5/Debconf/Element/Editor/Password.pm", "/usr/share/perl5/Debconf/Element/Editor/Progress.pm", "/usr/share/perl5/Debconf/Element/Editor/Select.pm", "/usr/share/perl5/Debconf/Element/Editor/String.pm", "/usr/share/perl5/Debconf/Element/Editor/Text.pm", "/usr/share/perl5/Debconf/Element/Gnome.pm", "/usr/share/perl5/Debconf/Element/Gnome/Boolean.pm", "/usr/share/perl5/Debconf/Element/Gnome/Error.pm", "/usr/share/perl5/Debconf/Element/Gnome/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Gnome/Note.pm", "/usr/share/perl5/Debconf/Element/Gnome/Password.pm", "/usr/share/perl5/Debconf/Element/Gnome/Progress.pm", "/usr/share/perl5/Debconf/Element/Gnome/Select.pm", "/usr/share/perl5/Debconf/Element/Gnome/String.pm", "/usr/share/perl5/Debconf/Element/Gnome/Text.pm", "/usr/share/perl5/Debconf/Element/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Noninteractive.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Boolean.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Error.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Note.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Password.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Progress.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Select.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/String.pm", "/usr/share/perl5/Debconf/Element/Noninteractive/Text.pm", "/usr/share/perl5/Debconf/Element/Select.pm", "/usr/share/perl5/Debconf/Element/Teletype/Boolean.pm", "/usr/share/perl5/Debconf/Element/Teletype/Error.pm", "/usr/share/perl5/Debconf/Element/Teletype/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Teletype/Note.pm", "/usr/share/perl5/Debconf/Element/Teletype/Password.pm", "/usr/share/perl5/Debconf/Element/Teletype/Progress.pm", "/usr/share/perl5/Debconf/Element/Teletype/Select.pm", "/usr/share/perl5/Debconf/Element/Teletype/String.pm", "/usr/share/perl5/Debconf/Element/Teletype/Text.pm", "/usr/share/perl5/Debconf/Element/Web/Boolean.pm", "/usr/share/perl5/Debconf/Element/Web/Error.pm", "/usr/share/perl5/Debconf/Element/Web/Multiselect.pm", "/usr/share/perl5/Debconf/Element/Web/Note.pm", "/usr/share/perl5/Debconf/Element/Web/Password.pm", "/usr/share/perl5/Debconf/Element/Web/Progress.pm", "/usr/share/perl5/Debconf/Element/Web/Select.pm", "/usr/share/perl5/Debconf/Element/Web/String.pm", "/usr/share/perl5/Debconf/Element/Web/Text.pm", "/usr/share/perl5/Debconf/Encoding.pm", "/usr/share/perl5/Debconf/Format.pm", "/usr/share/perl5/Debconf/Format/822.pm", "/usr/share/perl5/Debconf/FrontEnd.pm", "/usr/share/perl5/Debconf/FrontEnd/Dialog.pm", "/usr/share/perl5/Debconf/FrontEnd/Editor.pm", "/usr/share/perl5/Debconf/FrontEnd/Gnome.pm", "/usr/share/perl5/Debconf/FrontEnd/Kde.pm", "/usr/share/perl5/Debconf/FrontEnd/Noninteractive.pm", "/usr/share/perl5/Debconf/FrontEnd/Passthrough.pm", "/usr/share/perl5/Debconf/FrontEnd/Readline.pm", "/usr/share/perl5/Debconf/FrontEnd/ScreenSize.pm", "/usr/share/perl5/Debconf/FrontEnd/Teletype.pm", "/usr/share/perl5/Debconf/FrontEnd/Text.pm", "/usr/share/perl5/Debconf/FrontEnd/Web.pm", "/usr/share/perl5/Debconf/Gettext.pm", "/usr/share/perl5/Debconf/Iterator.pm", "/usr/share/perl5/Debconf/Log.pm", "/usr/share/perl5/Debconf/Path.pm", "/usr/share/perl5/Debconf/Priority.pm", "/usr/share/perl5/Debconf/Question.pm", "/usr/share/perl5/Debconf/Template.pm", "/usr/share/perl5/Debconf/Template/Transient.pm", "/usr/share/perl5/Debconf/TmpFile.pm", "/usr/share/perl5/Debian/DebConf/Client/ConfModule.pm", "/usr/share/pixmaps/debian-logo.png" ], "AnalyzedBy": "dpkg" }, { "ID": "debian-archive-keyring@2023.3+deb12u2", "Name": "debian-archive-keyring", "Identifier": { "PURL": "pkg:deb/debian/debian-archive-keyring@2023.3%2Bdeb12u2?arch=all\u0026distro=debian-12.15", "UID": "eaf3ce116c1e926d" }, "Version": "2023.3+deb12u2", "Arch": "all", "SrcName": "debian-archive-keyring", "SrcVersion": "2023.3+deb12u2", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian Release Team \u003cpackages@release.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/share/doc/debian-archive-keyring/README", "/usr/share/doc/debian-archive-keyring/changelog.gz", "/usr/share/doc/debian-archive-keyring/copyright", "/usr/share/keyrings/debian-archive-bookworm-automatic.gpg", "/usr/share/keyrings/debian-archive-bookworm-security-automatic.gpg", "/usr/share/keyrings/debian-archive-bookworm-stable.gpg", "/usr/share/keyrings/debian-archive-bullseye-automatic.gpg", "/usr/share/keyrings/debian-archive-bullseye-security-automatic.gpg", "/usr/share/keyrings/debian-archive-bullseye-stable.gpg", "/usr/share/keyrings/debian-archive-keyring.gpg", "/usr/share/keyrings/debian-archive-removed-keys.gpg", "/usr/share/keyrings/debian-archive-trixie-automatic.gpg", "/usr/share/keyrings/debian-archive-trixie-security-automatic.gpg", "/usr/share/keyrings/debian-archive-trixie-stable.gpg" ], "AnalyzedBy": "dpkg" }, { "ID": "debianutils@5.7-0.5~deb12u1", "Name": "debianutils", "Identifier": { "PURL": "pkg:deb/debian/debianutils@5.7-0.5~deb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "e0076698ca6b7339" }, "Version": "5.7", "Release": "0.5~deb12u1", "Arch": "amd64", "SrcName": "debianutils", "SrcVersion": "5.7", "SrcRelease": "0.5~deb12u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "public-domain", "SMAIL-GPL" ], "Maintainer": "Clint Adams \u003cclint@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/bin/run-parts", "/bin/tempfile", "/sbin/installkernel", "/usr/bin/ischroot", "/usr/bin/savelog", "/usr/bin/which.debianutils", "/usr/sbin/add-shell", "/usr/sbin/remove-shell", "/usr/sbin/update-shells", "/usr/share/debianutils/shells", "/usr/share/doc/debianutils/README.shells.gz", "/usr/share/doc/debianutils/changelog.Debian.gz", "/usr/share/doc/debianutils/changelog.gz", "/usr/share/doc/debianutils/copyright", "/usr/share/man/de/man1/which.debianutils.1.gz", "/usr/share/man/de/man8/add-shell.8.gz", "/usr/share/man/de/man8/installkernel.8.gz", "/usr/share/man/de/man8/remove-shell.8.gz", "/usr/share/man/de/man8/run-parts.8.gz", "/usr/share/man/de/man8/savelog.8.gz", "/usr/share/man/es/man1/which.debianutils.1.gz", "/usr/share/man/es/man8/add-shell.8.gz", "/usr/share/man/es/man8/installkernel.8.gz", "/usr/share/man/es/man8/remove-shell.8.gz", "/usr/share/man/es/man8/run-parts.8.gz", "/usr/share/man/es/man8/savelog.8.gz", "/usr/share/man/fr/man1/which.debianutils.1.gz", "/usr/share/man/fr/man8/add-shell.8.gz", "/usr/share/man/fr/man8/installkernel.8.gz", "/usr/share/man/fr/man8/remove-shell.8.gz", "/usr/share/man/fr/man8/run-parts.8.gz", "/usr/share/man/fr/man8/savelog.8.gz", "/usr/share/man/it/man1/which.debianutils.1.gz", "/usr/share/man/it/man8/add-shell.8.gz", "/usr/share/man/it/man8/installkernel.8.gz", "/usr/share/man/it/man8/remove-shell.8.gz", "/usr/share/man/it/man8/run-parts.8.gz", "/usr/share/man/it/man8/savelog.8.gz", "/usr/share/man/ja/man1/which.debianutils.1.gz", "/usr/share/man/ja/man8/add-shell.8.gz", "/usr/share/man/ja/man8/installkernel.8.gz", "/usr/share/man/ja/man8/remove-shell.8.gz", "/usr/share/man/ja/man8/run-parts.8.gz", "/usr/share/man/ja/man8/savelog.8.gz", "/usr/share/man/man1/ischroot.1.gz", "/usr/share/man/man1/tempfile.1.gz", "/usr/share/man/man1/which.debianutils.1.gz", "/usr/share/man/man8/add-shell.8.gz", "/usr/share/man/man8/installkernel.8.gz", "/usr/share/man/man8/remove-shell.8.gz", "/usr/share/man/man8/run-parts.8.gz", "/usr/share/man/man8/savelog.8.gz", "/usr/share/man/man8/update-shells.8.gz", "/usr/share/man/pl/man1/which.debianutils.1.gz", "/usr/share/man/pl/man8/add-shell.8.gz", "/usr/share/man/pl/man8/installkernel.8.gz", "/usr/share/man/pl/man8/remove-shell.8.gz", "/usr/share/man/pl/man8/run-parts.8.gz", "/usr/share/man/pl/man8/savelog.8.gz", "/usr/share/man/pt/man1/which.1.gz", "/usr/share/man/pt/man8/add-shell.8.gz", "/usr/share/man/pt/man8/installkernel.8.gz", "/usr/share/man/pt/man8/remove-shell.8.gz", "/usr/share/man/pt/man8/run-parts.8.gz", "/usr/share/man/pt/man8/savelog.8.gz", "/usr/share/man/sl/man1/which.debianutils.1.gz", "/usr/share/man/sl/man8/add-shell.8.gz", "/usr/share/man/sl/man8/installkernel.8.gz", "/usr/share/man/sl/man8/remove-shell.8.gz", "/usr/share/man/sl/man8/run-parts.8.gz", "/usr/share/man/sl/man8/savelog.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "diffutils@1:3.8-4", "Name": "diffutils", "Identifier": { "PURL": "pkg:deb/debian/diffutils@3.8-4?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "88676a587026548b" }, "Version": "3.8", "Release": "4", "Epoch": 1, "Arch": "amd64", "SrcName": "diffutils", "SrcVersion": "3.8", "SrcRelease": "4", "SrcEpoch": 1, "Licenses": [ "GPL-3.0-or-later", "FSFULLR", "LGPL-2.1-or-later", "GPL-3.0-with-autoconf-exception+", "GPL-3.0-only", "GPL-3+ with texinfo exception", "LGPL-2.0-or-later", "GPL-2.0-or-later", "X11", "FSFAP", "GFDL-1.3-no-invariants-only", "LGPL-3.0-or-later", "LGPL-3.0-only", "public-domain", "LGPL-2.0-only", "LGPL-2.1-only", "GPL-2.0-only", "GFDL-1.3-only" ], "Maintainer": "Santiago Vila \u003csanvila@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/bin/cmp", "/usr/bin/diff", "/usr/bin/diff3", "/usr/bin/sdiff", "/usr/share/doc/diffutils/NEWS.gz", "/usr/share/doc/diffutils/changelog.Debian.gz", "/usr/share/doc/diffutils/changelog.gz", "/usr/share/doc/diffutils/copyright", "/usr/share/info/diffutils.info.gz", "/usr/share/locale/bg/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ca/LC_MESSAGES/diffutils.mo", "/usr/share/locale/cs/LC_MESSAGES/diffutils.mo", "/usr/share/locale/da/LC_MESSAGES/diffutils.mo", "/usr/share/locale/de/LC_MESSAGES/diffutils.mo", "/usr/share/locale/el/LC_MESSAGES/diffutils.mo", "/usr/share/locale/eo/LC_MESSAGES/diffutils.mo", "/usr/share/locale/es/LC_MESSAGES/diffutils.mo", "/usr/share/locale/fi/LC_MESSAGES/diffutils.mo", "/usr/share/locale/fr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ga/LC_MESSAGES/diffutils.mo", "/usr/share/locale/gl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/he/LC_MESSAGES/diffutils.mo", "/usr/share/locale/hr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/hu/LC_MESSAGES/diffutils.mo", "/usr/share/locale/id/LC_MESSAGES/diffutils.mo", "/usr/share/locale/it/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ja/LC_MESSAGES/diffutils.mo", "/usr/share/locale/lv/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ms/LC_MESSAGES/diffutils.mo", "/usr/share/locale/nb/LC_MESSAGES/diffutils.mo", "/usr/share/locale/nl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pl/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pt/LC_MESSAGES/diffutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ro/LC_MESSAGES/diffutils.mo", "/usr/share/locale/ru/LC_MESSAGES/diffutils.mo", "/usr/share/locale/sr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/sv/LC_MESSAGES/diffutils.mo", "/usr/share/locale/tr/LC_MESSAGES/diffutils.mo", "/usr/share/locale/uk/LC_MESSAGES/diffutils.mo", "/usr/share/locale/vi/LC_MESSAGES/diffutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/diffutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/diffutils.mo", "/usr/share/man/man1/cmp.1.gz", "/usr/share/man/man1/diff.1.gz", "/usr/share/man/man1/diff3.1.gz", "/usr/share/man/man1/sdiff.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "dpkg@1.21.23", "Name": "dpkg", "Identifier": { "PURL": "pkg:deb/debian/dpkg@1.21.23?arch=amd64\u0026distro=debian-12.15", "UID": "2e1d958a3913bf70" }, "Version": "1.21.23", "Arch": "amd64", "SrcName": "dpkg", "SrcVersion": "1.21.23", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "BSD-2-Clause", "public-domain-s-s-d" ], "Maintainer": "Dpkg Developers \u003cdebian-dpkg@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "tar@1.34+dfsg-1.2+deb12u1" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/systemd/system/dpkg-db-backup.service", "/lib/systemd/system/dpkg-db-backup.timer", "/sbin/start-stop-daemon", "/usr/bin/dpkg", "/usr/bin/dpkg-deb", "/usr/bin/dpkg-divert", "/usr/bin/dpkg-maintscript-helper", "/usr/bin/dpkg-query", "/usr/bin/dpkg-realpath", "/usr/bin/dpkg-split", "/usr/bin/dpkg-statoverride", "/usr/bin/dpkg-trigger", "/usr/bin/update-alternatives", "/usr/libexec/dpkg/dpkg-db-backup", "/usr/sbin/dpkg-fsys-usrunmess", "/usr/share/bug/dpkg", "/usr/share/doc/dpkg/AUTHORS", "/usr/share/doc/dpkg/README.api", "/usr/share/doc/dpkg/README.bug-usertags.gz", "/usr/share/doc/dpkg/README.feature-removal-schedule.gz", "/usr/share/doc/dpkg/THANKS.gz", "/usr/share/doc/dpkg/changelog.gz", "/usr/share/doc/dpkg/copyright", "/usr/share/dpkg/abitable", "/usr/share/dpkg/cputable", "/usr/share/dpkg/ostable", "/usr/share/dpkg/sh/dpkg-error.sh", "/usr/share/dpkg/tupletable", "/usr/share/lintian/overrides/dpkg", "/usr/share/lintian/profiles/dpkg/main.profile", "/usr/share/locale/ast/LC_MESSAGES/dpkg.mo", "/usr/share/locale/bs/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ca/LC_MESSAGES/dpkg.mo", "/usr/share/locale/cs/LC_MESSAGES/dpkg.mo", "/usr/share/locale/da/LC_MESSAGES/dpkg.mo", "/usr/share/locale/de/LC_MESSAGES/dpkg.mo", "/usr/share/locale/dz/LC_MESSAGES/dpkg.mo", "/usr/share/locale/el/LC_MESSAGES/dpkg.mo", "/usr/share/locale/eo/LC_MESSAGES/dpkg.mo", "/usr/share/locale/es/LC_MESSAGES/dpkg.mo", "/usr/share/locale/et/LC_MESSAGES/dpkg.mo", "/usr/share/locale/eu/LC_MESSAGES/dpkg.mo", "/usr/share/locale/fr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/gl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/hu/LC_MESSAGES/dpkg.mo", "/usr/share/locale/id/LC_MESSAGES/dpkg.mo", "/usr/share/locale/it/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ja/LC_MESSAGES/dpkg.mo", "/usr/share/locale/km/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ko/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ku/LC_MESSAGES/dpkg.mo", "/usr/share/locale/lt/LC_MESSAGES/dpkg.mo", "/usr/share/locale/mr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nb/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ne/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/nn/LC_MESSAGES/dpkg.mo", "/usr/share/locale/oc/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pa/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pt/LC_MESSAGES/dpkg.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ro/LC_MESSAGES/dpkg.mo", "/usr/share/locale/ru/LC_MESSAGES/dpkg.mo", "/usr/share/locale/sk/LC_MESSAGES/dpkg.mo", "/usr/share/locale/sv/LC_MESSAGES/dpkg.mo", "/usr/share/locale/th/LC_MESSAGES/dpkg.mo", "/usr/share/locale/tl/LC_MESSAGES/dpkg.mo", "/usr/share/locale/tr/LC_MESSAGES/dpkg.mo", "/usr/share/locale/vi/LC_MESSAGES/dpkg.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/dpkg.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/dpkg.mo", "/usr/share/man/de/man1/dpkg-deb.1.gz", "/usr/share/man/de/man1/dpkg-divert.1.gz", "/usr/share/man/de/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/de/man1/dpkg-query.1.gz", "/usr/share/man/de/man1/dpkg-realpath.1.gz", "/usr/share/man/de/man1/dpkg-split.1.gz", "/usr/share/man/de/man1/dpkg-statoverride.1.gz", "/usr/share/man/de/man1/dpkg-trigger.1.gz", "/usr/share/man/de/man1/dpkg.1.gz", "/usr/share/man/de/man1/update-alternatives.1.gz", "/usr/share/man/de/man5/dpkg.cfg.5.gz", "/usr/share/man/de/man8/dpkg-fsys-usrunmess.8.gz", "/usr/share/man/de/man8/start-stop-daemon.8.gz", "/usr/share/man/es/man1/dpkg-split.1.gz", "/usr/share/man/es/man5/dpkg.cfg.5.gz", "/usr/share/man/fr/man1/dpkg-deb.1.gz", "/usr/share/man/fr/man1/dpkg-divert.1.gz", "/usr/share/man/fr/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/fr/man1/dpkg-query.1.gz", "/usr/share/man/fr/man1/dpkg-realpath.1.gz", "/usr/share/man/fr/man1/dpkg-split.1.gz", "/usr/share/man/fr/man1/dpkg-statoverride.1.gz", "/usr/share/man/fr/man1/dpkg-trigger.1.gz", "/usr/share/man/fr/man1/dpkg.1.gz", "/usr/share/man/fr/man1/update-alternatives.1.gz", "/usr/share/man/fr/man5/dpkg.cfg.5.gz", "/usr/share/man/fr/man8/dpkg-fsys-usrunmess.8.gz", "/usr/share/man/fr/man8/start-stop-daemon.8.gz", "/usr/share/man/hu/man5/dpkg.cfg.5.gz", "/usr/share/man/it/man1/dpkg-split.1.gz", "/usr/share/man/it/man5/dpkg.cfg.5.gz", "/usr/share/man/ja/man1/dpkg-split.1.gz", "/usr/share/man/ja/man5/dpkg.cfg.5.gz", "/usr/share/man/man1/dpkg-deb.1.gz", "/usr/share/man/man1/dpkg-divert.1.gz", "/usr/share/man/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/man1/dpkg-query.1.gz", "/usr/share/man/man1/dpkg-realpath.1.gz", "/usr/share/man/man1/dpkg-split.1.gz", "/usr/share/man/man1/dpkg-statoverride.1.gz", "/usr/share/man/man1/dpkg-trigger.1.gz", "/usr/share/man/man1/dpkg.1.gz", "/usr/share/man/man1/update-alternatives.1.gz", "/usr/share/man/man5/dpkg.cfg.5.gz", "/usr/share/man/man8/dpkg-fsys-usrunmess.8.gz", "/usr/share/man/man8/start-stop-daemon.8.gz", "/usr/share/man/nl/man1/dpkg-deb.1.gz", "/usr/share/man/nl/man1/dpkg-divert.1.gz", "/usr/share/man/nl/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/nl/man1/dpkg-query.1.gz", "/usr/share/man/nl/man1/dpkg-realpath.1.gz", "/usr/share/man/nl/man1/dpkg-split.1.gz", "/usr/share/man/nl/man1/dpkg-statoverride.1.gz", "/usr/share/man/nl/man1/dpkg-trigger.1.gz", "/usr/share/man/nl/man1/dpkg.1.gz", "/usr/share/man/nl/man1/update-alternatives.1.gz", "/usr/share/man/nl/man5/dpkg.cfg.5.gz", "/usr/share/man/nl/man8/dpkg-fsys-usrunmess.8.gz", "/usr/share/man/nl/man8/start-stop-daemon.8.gz", "/usr/share/man/pl/man1/dpkg-split.1.gz", "/usr/share/man/pl/man5/dpkg.cfg.5.gz", "/usr/share/man/pt/man1/dpkg-deb.1.gz", "/usr/share/man/pt/man1/dpkg-divert.1.gz", "/usr/share/man/pt/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/pt/man1/dpkg-query.1.gz", "/usr/share/man/pt/man1/dpkg-realpath.1.gz", "/usr/share/man/pt/man1/dpkg-split.1.gz", "/usr/share/man/pt/man1/dpkg-statoverride.1.gz", "/usr/share/man/pt/man1/dpkg-trigger.1.gz", "/usr/share/man/pt/man1/dpkg.1.gz", "/usr/share/man/pt/man1/update-alternatives.1.gz", "/usr/share/man/pt/man5/dpkg.cfg.5.gz", "/usr/share/man/pt/man8/dpkg-fsys-usrunmess.8.gz", "/usr/share/man/pt/man8/start-stop-daemon.8.gz", "/usr/share/man/sv/man1/dpkg-deb.1.gz", "/usr/share/man/sv/man1/dpkg-divert.1.gz", "/usr/share/man/sv/man1/dpkg-maintscript-helper.1.gz", "/usr/share/man/sv/man1/dpkg-query.1.gz", "/usr/share/man/sv/man1/dpkg-realpath.1.gz", "/usr/share/man/sv/man1/dpkg-split.1.gz", "/usr/share/man/sv/man1/dpkg-statoverride.1.gz", "/usr/share/man/sv/man1/dpkg-trigger.1.gz", "/usr/share/man/sv/man1/dpkg.1.gz", "/usr/share/man/sv/man1/update-alternatives.1.gz", "/usr/share/man/sv/man5/dpkg.cfg.5.gz", "/usr/share/man/sv/man8/dpkg-fsys-usrunmess.8.gz", "/usr/share/man/sv/man8/start-stop-daemon.8.gz", "/usr/share/polkit-1/actions/org.dpkg.pkexec.update-alternatives.policy" ], "AnalyzedBy": "dpkg" }, { "ID": "e2fsprogs@1.47.0-2+b2", "Name": "e2fsprogs", "Identifier": { "PURL": "pkg:deb/debian/e2fsprogs@1.47.0-2%2Bb2?arch=amd64\u0026distro=debian-12.15", "UID": "6fae48e2d7b7859d" }, "Version": "1.47.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.0", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.0-only", "BSD-3-Clause", "Apache-2.0", "ISC", "GPL-2.0-or-later", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "logsave@1.47.0-2+b2" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/systemd/system/e2scrub@.service", "/lib/systemd/system/e2scrub_all.service", "/lib/systemd/system/e2scrub_all.timer", "/lib/systemd/system/e2scrub_fail@.service", "/lib/systemd/system/e2scrub_reap.service", "/lib/udev/rules.d/96-e2scrub.rules", "/sbin/badblocks", "/sbin/debugfs", "/sbin/dumpe2fs", "/sbin/e2fsck", "/sbin/e2image", "/sbin/e2scrub", "/sbin/e2scrub_all", "/sbin/e2undo", "/sbin/mke2fs", "/sbin/resize2fs", "/sbin/tune2fs", "/usr/bin/chattr", "/usr/bin/lsattr", "/usr/lib/x86_64-linux-gnu/e2fsprogs/e2scrub_all_cron", "/usr/lib/x86_64-linux-gnu/e2fsprogs/e2scrub_fail", "/usr/sbin/e2freefrag", "/usr/sbin/e4crypt", "/usr/sbin/e4defrag", "/usr/sbin/filefrag", "/usr/sbin/mklost+found", "/usr/share/doc/e2fsprogs/NEWS.gz", "/usr/share/doc/e2fsprogs/README", "/usr/share/doc/e2fsprogs/changelog.Debian.amd64.gz", "/usr/share/doc/e2fsprogs/changelog.Debian.gz", "/usr/share/doc/e2fsprogs/copyright", "/usr/share/lintian/overrides/e2fsprogs", "/usr/share/man/man1/chattr.1.gz", "/usr/share/man/man1/lsattr.1.gz", "/usr/share/man/man5/e2fsck.conf.5.gz", "/usr/share/man/man5/ext4.5.gz", "/usr/share/man/man5/mke2fs.conf.5.gz", "/usr/share/man/man8/badblocks.8.gz", "/usr/share/man/man8/debugfs.8.gz", "/usr/share/man/man8/dumpe2fs.8.gz", "/usr/share/man/man8/e2freefrag.8.gz", "/usr/share/man/man8/e2fsck.8.gz", "/usr/share/man/man8/e2image.8.gz", "/usr/share/man/man8/e2label.8.gz", "/usr/share/man/man8/e2mmpstatus.8.gz", "/usr/share/man/man8/e2scrub.8.gz", "/usr/share/man/man8/e2scrub_all.8.gz", "/usr/share/man/man8/e2undo.8.gz", "/usr/share/man/man8/e4crypt.8.gz", "/usr/share/man/man8/e4defrag.8.gz", "/usr/share/man/man8/filefrag.8.gz", "/usr/share/man/man8/mke2fs.8.gz", "/usr/share/man/man8/mklost+found.8.gz", "/usr/share/man/man8/resize2fs.8.gz", "/usr/share/man/man8/tune2fs.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ffmpeg@7:5.1.9-0+deb12u1", "Name": "ffmpeg", "Identifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "Version": "5.1.9", "Release": "0+deb12u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "5.1.9", "SrcRelease": "0+deb12u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavcodec59@7:5.1.9-0+deb12u1", "libavdevice59@7:5.1.9-0+deb12u1", "libavfilter8@7:5.1.9-0+deb12u1", "libavformat59@7:5.1.9-0+deb12u1", "libavutil57@7:5.1.9-0+deb12u1", "libc6@2.36-9+deb12u14", "libpostproc56@7:5.1.9-0+deb12u1", "libsdl2-2.0-0@2.26.5+dfsg-1", "libswresample4@7:5.1.9-0+deb12u1", "libswscale6@7:5.1.9-0+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/bin/ffmpeg", "/usr/bin/ffplay", "/usr/bin/ffprobe", "/usr/bin/qt-faststart", "/usr/share/doc/ffmpeg/README.Debian", "/usr/share/doc/ffmpeg/RELEASE_NOTES", "/usr/share/doc/ffmpeg/TODO.Debian", "/usr/share/doc/ffmpeg/changelog.Debian.gz", "/usr/share/doc/ffmpeg/changelog.gz", "/usr/share/doc/ffmpeg/copyright", "/usr/share/ffmpeg/ffprobe.xsd", "/usr/share/ffmpeg/libvpx-1080p.ffpreset", "/usr/share/ffmpeg/libvpx-1080p50_60.ffpreset", "/usr/share/ffmpeg/libvpx-360p.ffpreset", "/usr/share/ffmpeg/libvpx-720p.ffpreset", "/usr/share/ffmpeg/libvpx-720p50_60.ffpreset", "/usr/share/lintian/overrides/ffmpeg", "/usr/share/man/man1/ffmpeg-all.1.gz", "/usr/share/man/man1/ffmpeg-bitstream-filters.1.gz", "/usr/share/man/man1/ffmpeg-codecs.1.gz", "/usr/share/man/man1/ffmpeg-devices.1.gz", "/usr/share/man/man1/ffmpeg-filters.1.gz", "/usr/share/man/man1/ffmpeg-formats.1.gz", "/usr/share/man/man1/ffmpeg-protocols.1.gz", "/usr/share/man/man1/ffmpeg-resampler.1.gz", "/usr/share/man/man1/ffmpeg-scaler.1.gz", "/usr/share/man/man1/ffmpeg-utils.1.gz", "/usr/share/man/man1/ffmpeg.1.gz", "/usr/share/man/man1/ffplay-all.1.gz", "/usr/share/man/man1/ffplay.1.gz", "/usr/share/man/man1/ffprobe-all.1.gz", "/usr/share/man/man1/ffprobe.1.gz", "/usr/share/man/man1/qt-faststart.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "findutils@4.9.0-4", "Name": "findutils", "Identifier": { "PURL": "pkg:deb/debian/findutils@4.9.0-4?arch=amd64\u0026distro=debian-12.15", "UID": "bd0eb429e40f4af1" }, "Version": "4.9.0", "Release": "4", "Arch": "amd64", "SrcName": "findutils", "SrcVersion": "4.9.0", "SrcRelease": "4", "Licenses": [ "GFDL-1.3-no-invariants-or-later", "GPL-3.0-or-later", "FSFAP", "GPL-3+ with Autoconf-data exception", "FSFULLR", "GPL-2+ with Autoconf-data exception", "GPL-2.0-or-later", "X11", "public-domain", "GPL with automake exception", "LGPL-2.1-or-later", "LGPL-2.0-or-later", "LGPL-3.0-or-later", "BSD-3-clause and/or GPL-3+", "GPL-3+ with Bison-2.2 exception", "LGPL-3.0-only", "ISC and/or LGPL-2.1+", "BSD-3-Clause", "GFDL-1.3-only", "GPL-2.0-only", "GPL-3.0-only", "ISC", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Andreas Metzler \u003cametzler@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/bin/find", "/usr/bin/xargs", "/usr/share/doc-base/findutils.findutils", "/usr/share/doc/findutils/NEWS.Debian.gz", "/usr/share/doc/findutils/NEWS.gz", "/usr/share/doc/findutils/README.gz", "/usr/share/doc/findutils/TODO", "/usr/share/doc/findutils/changelog.Debian.gz", "/usr/share/doc/findutils/changelog.gz", "/usr/share/doc/findutils/copyright", "/usr/share/info/find-maint.info.gz", "/usr/share/info/find.info-1.gz", "/usr/share/info/find.info-2.gz", "/usr/share/info/find.info.gz", "/usr/share/locale/be/LC_MESSAGES/findutils.mo", "/usr/share/locale/bg/LC_MESSAGES/findutils.mo", "/usr/share/locale/ca/LC_MESSAGES/findutils.mo", "/usr/share/locale/cs/LC_MESSAGES/findutils.mo", "/usr/share/locale/da/LC_MESSAGES/findutils.mo", "/usr/share/locale/de/LC_MESSAGES/findutils.mo", "/usr/share/locale/el/LC_MESSAGES/findutils.mo", "/usr/share/locale/eo/LC_MESSAGES/findutils.mo", "/usr/share/locale/es/LC_MESSAGES/findutils.mo", "/usr/share/locale/et/LC_MESSAGES/findutils.mo", "/usr/share/locale/fi/LC_MESSAGES/findutils.mo", "/usr/share/locale/fr/LC_MESSAGES/findutils.mo", "/usr/share/locale/ga/LC_MESSAGES/findutils.mo", "/usr/share/locale/gl/LC_MESSAGES/findutils.mo", "/usr/share/locale/hr/LC_MESSAGES/findutils.mo", "/usr/share/locale/hu/LC_MESSAGES/findutils.mo", "/usr/share/locale/id/LC_MESSAGES/findutils.mo", "/usr/share/locale/it/LC_MESSAGES/findutils.mo", "/usr/share/locale/ja/LC_MESSAGES/findutils.mo", "/usr/share/locale/ko/LC_MESSAGES/findutils.mo", "/usr/share/locale/lg/LC_MESSAGES/findutils.mo", "/usr/share/locale/lt/LC_MESSAGES/findutils.mo", "/usr/share/locale/ms/LC_MESSAGES/findutils.mo", "/usr/share/locale/nb/LC_MESSAGES/findutils.mo", "/usr/share/locale/nl/LC_MESSAGES/findutils.mo", "/usr/share/locale/pl/LC_MESSAGES/findutils.mo", "/usr/share/locale/pt/LC_MESSAGES/findutils.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/findutils.mo", "/usr/share/locale/ro/LC_MESSAGES/findutils.mo", "/usr/share/locale/ru/LC_MESSAGES/findutils.mo", "/usr/share/locale/sk/LC_MESSAGES/findutils.mo", "/usr/share/locale/sl/LC_MESSAGES/findutils.mo", "/usr/share/locale/sr/LC_MESSAGES/findutils.mo", "/usr/share/locale/sv/LC_MESSAGES/findutils.mo", "/usr/share/locale/tr/LC_MESSAGES/findutils.mo", "/usr/share/locale/uk/LC_MESSAGES/findutils.mo", "/usr/share/locale/vi/LC_MESSAGES/findutils.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/findutils.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/findutils.mo", "/usr/share/man/man1/find.1.gz", "/usr/share/man/man1/xargs.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "fontconfig@2.14.1-4", "Name": "fontconfig", "Identifier": { "PURL": "pkg:deb/debian/fontconfig@2.14.1-4?arch=amd64\u0026distro=debian-12.15", "UID": "fad0534fcb790605" }, "Version": "2.14.1", "Release": "4", "Arch": "amd64", "SrcName": "fontconfig", "SrcVersion": "2.14.1", "SrcRelease": "4", "Maintainer": "Debian freedesktop.org maintainers \u003cpkg-freedesktop-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "fontconfig-config@2.14.1-4", "libc6@2.36-9+deb12u14", "libfontconfig1@2.14.1-4", "libfreetype6@2.12.1+dfsg-5+deb12u4" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/bin/fc-cache", "/usr/bin/fc-cat", "/usr/bin/fc-conflist", "/usr/bin/fc-list", "/usr/bin/fc-match", "/usr/bin/fc-pattern", "/usr/bin/fc-query", "/usr/bin/fc-scan", "/usr/bin/fc-validate", "/usr/share/doc-base/fontconfig.fontconfig-user", "/usr/share/doc/fontconfig/README.Debian", "/usr/share/doc/fontconfig/changelog.Debian.gz", "/usr/share/doc/fontconfig/changelog.gz", "/usr/share/doc/fontconfig/copyright", "/usr/share/doc/fontconfig/fontconfig-user.html", "/usr/share/doc/fontconfig/fontconfig-user.pdf.gz", "/usr/share/doc/fontconfig/fontconfig-user.txt.gz", "/usr/share/man/man1/fc-cache.1.gz", "/usr/share/man/man1/fc-cat.1.gz", "/usr/share/man/man1/fc-conflist.1.gz", "/usr/share/man/man1/fc-list.1.gz", "/usr/share/man/man1/fc-match.1.gz", "/usr/share/man/man1/fc-pattern.1.gz", "/usr/share/man/man1/fc-query.1.gz", "/usr/share/man/man1/fc-scan.1.gz", "/usr/share/man/man1/fc-validate.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "fontconfig-config@2.14.1-4", "Name": "fontconfig-config", "Identifier": { "PURL": "pkg:deb/debian/fontconfig-config@2.14.1-4?arch=amd64\u0026distro=debian-12.15", "UID": "878fa807428afd8c" }, "Version": "2.14.1", "Release": "4", "Arch": "amd64", "SrcName": "fontconfig", "SrcVersion": "2.14.1", "SrcRelease": "4", "Maintainer": "Debian freedesktop.org maintainers \u003cpkg-freedesktop-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.82", "fonts-dejavu-core@2.37-6" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/fontconfig-config/NEWS.Debian.gz", "/usr/share/doc/fontconfig-config/changelog.Debian.gz", "/usr/share/doc/fontconfig-config/changelog.gz", "/usr/share/doc/fontconfig-config/copyright", "/usr/share/fontconfig/conf.avail/05-reset-dirs-sample.conf", "/usr/share/fontconfig/conf.avail/09-autohint-if-no-hinting.conf", "/usr/share/fontconfig/conf.avail/10-autohint.conf", "/usr/share/fontconfig/conf.avail/10-hinting-full.conf", "/usr/share/fontconfig/conf.avail/10-hinting-medium.conf", "/usr/share/fontconfig/conf.avail/10-hinting-none.conf", "/usr/share/fontconfig/conf.avail/10-hinting-slight.conf", "/usr/share/fontconfig/conf.avail/10-no-antialias.conf", "/usr/share/fontconfig/conf.avail/10-no-sub-pixel.conf", "/usr/share/fontconfig/conf.avail/10-scale-bitmap-fonts.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-bgr.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-rgb.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-vbgr.conf", "/usr/share/fontconfig/conf.avail/10-sub-pixel-vrgb.conf", "/usr/share/fontconfig/conf.avail/10-unhinted.conf", "/usr/share/fontconfig/conf.avail/10-yes-antialias.conf", "/usr/share/fontconfig/conf.avail/11-lcdfilter-default.conf", "/usr/share/fontconfig/conf.avail/11-lcdfilter-legacy.conf", "/usr/share/fontconfig/conf.avail/11-lcdfilter-light.conf", "/usr/share/fontconfig/conf.avail/20-unhint-small-vera.conf", "/usr/share/fontconfig/conf.avail/25-unhint-nonlatin.conf", "/usr/share/fontconfig/conf.avail/30-metric-aliases.conf", "/usr/share/fontconfig/conf.avail/35-lang-normalize.conf", "/usr/share/fontconfig/conf.avail/40-nonlatin.conf", "/usr/share/fontconfig/conf.avail/45-generic.conf", "/usr/share/fontconfig/conf.avail/45-latin.conf", "/usr/share/fontconfig/conf.avail/48-spacing.conf", "/usr/share/fontconfig/conf.avail/49-sansserif.conf", "/usr/share/fontconfig/conf.avail/50-user.conf", "/usr/share/fontconfig/conf.avail/51-local.conf", "/usr/share/fontconfig/conf.avail/60-generic.conf", "/usr/share/fontconfig/conf.avail/60-latin.conf", "/usr/share/fontconfig/conf.avail/65-fonts-persian.conf", "/usr/share/fontconfig/conf.avail/65-khmer.conf", "/usr/share/fontconfig/conf.avail/65-nonlatin.conf", "/usr/share/fontconfig/conf.avail/69-unifont.conf", "/usr/share/fontconfig/conf.avail/70-force-bitmaps.conf", "/usr/share/fontconfig/conf.avail/70-no-bitmaps.conf", "/usr/share/fontconfig/conf.avail/70-yes-bitmaps.conf", "/usr/share/fontconfig/conf.avail/80-delicious.conf", "/usr/share/fontconfig/conf.avail/90-synthetic.conf", "/usr/share/man/man5/fonts-conf.5.gz", "/usr/share/xml/fontconfig/fonts.dtd" ], "AnalyzedBy": "dpkg" }, { "ID": "fonts-dejavu-core@2.37-6", "Name": "fonts-dejavu-core", "Identifier": { "PURL": "pkg:deb/debian/fonts-dejavu-core@2.37-6?arch=all\u0026distro=debian-12.15", "UID": "b1484bda53ff6818" }, "Version": "2.37", "Release": "6", "Arch": "all", "SrcName": "fonts-dejavu", "SrcVersion": "2.37", "SrcRelease": "6", "Licenses": [ "Bitstream-Vera", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Fonts Task Force \u003cdebian-fonts@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/fonts-dejavu-core/AUTHORS", "/usr/share/doc/fonts-dejavu-core/BUGS", "/usr/share/doc/fonts-dejavu-core/README.md", "/usr/share/doc/fonts-dejavu-core/changelog.Debian.gz", "/usr/share/doc/fonts-dejavu-core/changelog.gz", "/usr/share/doc/fonts-dejavu-core/copyright", "/usr/share/doc/fonts-dejavu-core/langcover.txt.gz", "/usr/share/doc/fonts-dejavu-core/status.txt.gz", "/usr/share/doc/fonts-dejavu-core/unicover.txt.gz", "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf", "/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf", "/usr/share/fonts/truetype/dejavu/DejaVuSansMono-Bold.ttf", "/usr/share/fonts/truetype/dejavu/DejaVuSansMono.ttf", "/usr/share/fonts/truetype/dejavu/DejaVuSerif-Bold.ttf", "/usr/share/fonts/truetype/dejavu/DejaVuSerif.ttf" ], "AnalyzedBy": "dpkg" }, { "ID": "gcc-12-base@12.2.0-14+deb12u1", "Name": "gcc-12-base", "Identifier": { "PURL": "pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "4cdf3a9f4926a4" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Licenses": [ "GPL-2.0-or-later", "GPL-3.0-only", "GFDL-1.2-only", "GPL-2.0-only", "Artistic-2.0", "LGPL-2.0-or-later" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/share/doc/gcc-12-base/README.Debian.amd64.gz", "/usr/share/doc/gcc-12-base/TODO.Debian", "/usr/share/doc/gcc-12-base/changelog.Debian.gz", "/usr/share/doc/gcc-12-base/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "gosu@1.14-1+b10", "Name": "gosu", "Identifier": { "PURL": "pkg:deb/debian/gosu@1.14-1%2Bb10?arch=amd64\u0026distro=debian-12.15", "UID": "b29f954eed6436d6" }, "Version": "1.14", "Release": "1+b10", "Arch": "amd64", "SrcName": "gosu", "SrcVersion": "1.14", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "Apache-2.0", "GPL-3.0-only" ], "Maintainer": "pkg-go \u003cpkg-go-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/sbin/gosu", "/usr/share/doc/gosu/changelog.Debian.amd64.gz", "/usr/share/doc/gosu/changelog.Debian.gz", "/usr/share/doc/gosu/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "gpgv@2.2.40-1.1+deb12u2", "Name": "gpgv", "Identifier": { "PURL": "pkg:deb/debian/gpgv@2.2.40-1.1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "64286f6c7d0c92ee" }, "Version": "2.2.40", "Release": "1.1+deb12u2", "Arch": "amd64", "SrcName": "gnupg2", "SrcVersion": "2.2.40", "SrcRelease": "1.1+deb12u2", "Licenses": [ "GPL-3.0-or-later", "permissive", "LGPL-2.1-or-later", "MIT", "BSD-3-Clause", "LGPL-3.0-or-later", "RFC-Reference", "TinySCHEME", "CC0-1.0", "GPL-3.0-only", "LGPL-3.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GnuPG Maintainers \u003cpkg-gnupg-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-5+b1", "libc6@2.36-9+deb12u14", "libgcrypt20@1.10.1-3+deb12u1", "libgpg-error0@1.46-1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/bin/gpgv", "/usr/share/doc/gpgv/NEWS.Debian.gz", "/usr/share/doc/gpgv/changelog.Debian.gz", "/usr/share/doc/gpgv/changelog.gz", "/usr/share/doc/gpgv/copyright", "/usr/share/man/man1/gpgv.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "grep@3.8-5", "Name": "grep", "Identifier": { "PURL": "pkg:deb/debian/grep@3.8-5?arch=amd64\u0026distro=debian-12.15", "UID": "6bd0b786cc1d6e8f" }, "Version": "3.8", "Release": "5", "Arch": "amd64", "SrcName": "grep", "SrcVersion": "3.8", "SrcRelease": "5", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "dpkg@1.21.23" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/bin/egrep", "/bin/fgrep", "/bin/grep", "/usr/bin/rgrep", "/usr/share/doc/grep/AUTHORS", "/usr/share/doc/grep/NEWS.Debian.gz", "/usr/share/doc/grep/NEWS.gz", "/usr/share/doc/grep/README", "/usr/share/doc/grep/THANKS.gz", "/usr/share/doc/grep/TODO.gz", "/usr/share/doc/grep/changelog.Debian.gz", "/usr/share/doc/grep/changelog.gz", "/usr/share/doc/grep/copyright", "/usr/share/info/grep.info.gz", "/usr/share/locale/af/LC_MESSAGES/grep.mo", "/usr/share/locale/be/LC_MESSAGES/grep.mo", "/usr/share/locale/bg/LC_MESSAGES/grep.mo", "/usr/share/locale/ca/LC_MESSAGES/grep.mo", "/usr/share/locale/cs/LC_MESSAGES/grep.mo", "/usr/share/locale/da/LC_MESSAGES/grep.mo", "/usr/share/locale/de/LC_MESSAGES/grep.mo", "/usr/share/locale/el/LC_MESSAGES/grep.mo", "/usr/share/locale/eo/LC_MESSAGES/grep.mo", "/usr/share/locale/es/LC_MESSAGES/grep.mo", "/usr/share/locale/et/LC_MESSAGES/grep.mo", "/usr/share/locale/eu/LC_MESSAGES/grep.mo", "/usr/share/locale/fi/LC_MESSAGES/grep.mo", "/usr/share/locale/fr/LC_MESSAGES/grep.mo", "/usr/share/locale/ga/LC_MESSAGES/grep.mo", "/usr/share/locale/gl/LC_MESSAGES/grep.mo", "/usr/share/locale/he/LC_MESSAGES/grep.mo", "/usr/share/locale/hr/LC_MESSAGES/grep.mo", "/usr/share/locale/hu/LC_MESSAGES/grep.mo", "/usr/share/locale/id/LC_MESSAGES/grep.mo", "/usr/share/locale/it/LC_MESSAGES/grep.mo", "/usr/share/locale/ja/LC_MESSAGES/grep.mo", "/usr/share/locale/ka/LC_MESSAGES/grep.mo", "/usr/share/locale/ko/LC_MESSAGES/grep.mo", "/usr/share/locale/ky/LC_MESSAGES/grep.mo", "/usr/share/locale/lt/LC_MESSAGES/grep.mo", "/usr/share/locale/nb/LC_MESSAGES/grep.mo", "/usr/share/locale/nl/LC_MESSAGES/grep.mo", "/usr/share/locale/pa/LC_MESSAGES/grep.mo", "/usr/share/locale/pl/LC_MESSAGES/grep.mo", "/usr/share/locale/pt/LC_MESSAGES/grep.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/grep.mo", "/usr/share/locale/ro/LC_MESSAGES/grep.mo", "/usr/share/locale/ru/LC_MESSAGES/grep.mo", "/usr/share/locale/sk/LC_MESSAGES/grep.mo", "/usr/share/locale/sl/LC_MESSAGES/grep.mo", "/usr/share/locale/sr/LC_MESSAGES/grep.mo", "/usr/share/locale/sv/LC_MESSAGES/grep.mo", "/usr/share/locale/ta/LC_MESSAGES/grep.mo", "/usr/share/locale/th/LC_MESSAGES/grep.mo", "/usr/share/locale/tr/LC_MESSAGES/grep.mo", "/usr/share/locale/uk/LC_MESSAGES/grep.mo", "/usr/share/locale/vi/LC_MESSAGES/grep.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/grep.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/grep.mo", "/usr/share/man/man1/grep.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "gzip@1.12-1", "Name": "gzip", "Identifier": { "PURL": "pkg:deb/debian/gzip@1.12-1?arch=amd64\u0026distro=debian-12.15", "UID": "e6df36a0bee4727c" }, "Version": "1.12", "Release": "1", "Arch": "amd64", "SrcName": "gzip", "SrcVersion": "1.12", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "GFDL-1.3+-no-invariant", "FSF-manpages", "GPL-3.0-only", "GFDL-3" ], "Maintainer": "Milan Kupcevic \u003cmilan@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "dpkg@1.21.23" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/bin/gunzip", "/bin/gzexe", "/bin/gzip", "/bin/uncompress", "/bin/zcat", "/bin/zcmp", "/bin/zdiff", "/bin/zegrep", "/bin/zfgrep", "/bin/zforce", "/bin/zgrep", "/bin/zless", "/bin/zmore", "/bin/znew", "/usr/share/doc/gzip/NEWS.gz", "/usr/share/doc/gzip/README.gz", "/usr/share/doc/gzip/TODO", "/usr/share/doc/gzip/changelog.Debian.gz", "/usr/share/doc/gzip/changelog.gz", "/usr/share/doc/gzip/copyright", "/usr/share/info/gzip.info.gz", "/usr/share/man/man1/gzexe.1.gz", "/usr/share/man/man1/gzip.1.gz", "/usr/share/man/man1/zdiff.1.gz", "/usr/share/man/man1/zforce.1.gz", "/usr/share/man/man1/zgrep.1.gz", "/usr/share/man/man1/zless.1.gz", "/usr/share/man/man1/zmore.1.gz", "/usr/share/man/man1/znew.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "hostname@3.23+nmu1", "Name": "hostname", "Identifier": { "PURL": "pkg:deb/debian/hostname@3.23%2Bnmu1?arch=amd64\u0026distro=debian-12.15", "UID": "ac0861c445a984c2" }, "Version": "3.23+nmu1", "Arch": "amd64", "SrcName": "hostname", "SrcVersion": "3.23+nmu1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Michael Meskes \u003cmeskes@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/bin/hostname", "/usr/share/doc/hostname/changelog.gz", "/usr/share/doc/hostname/copyright", "/usr/share/man/man1/hostname.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "init-system-helpers@1.65.2+deb12u1", "Name": "init-system-helpers", "Identifier": { "PURL": "pkg:deb/debian/init-system-helpers@1.65.2%2Bdeb12u1?arch=all\u0026distro=debian-12.15", "UID": "eb19be52d5305b25" }, "Version": "1.65.2+deb12u1", "Arch": "all", "SrcName": "init-system-helpers", "SrcVersion": "1.65.2+deb12u1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "usr-is-merged@37~deb12u1" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/bin/deb-systemd-helper", "/usr/bin/deb-systemd-invoke", "/usr/sbin/invoke-rc.d", "/usr/sbin/service", "/usr/sbin/update-rc.d", "/usr/share/bug/init-system-helpers/control", "/usr/share/doc/init-system-helpers/README.invoke-rc.d.gz", "/usr/share/doc/init-system-helpers/README.policy-rc.d.gz", "/usr/share/doc/init-system-helpers/changelog.gz", "/usr/share/doc/init-system-helpers/copyright", "/usr/share/lintian/overrides/init-system-helpers", "/usr/share/man/man1/deb-systemd-helper.1p.gz", "/usr/share/man/man1/deb-systemd-invoke.1p.gz", "/usr/share/man/man8/invoke-rc.d.8.gz", "/usr/share/man/man8/service.8.gz", "/usr/share/man/man8/update-rc.d.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "intel-media-va-driver@23.1.1+dfsg1-1", "Name": "intel-media-va-driver", "Identifier": { "PURL": "pkg:deb/debian/intel-media-va-driver@23.1.1%2Bdfsg1-1?arch=amd64\u0026distro=debian-12.15", "UID": "25aa2b995570ee6f" }, "Version": "23.1.1+dfsg1", "Release": "1", "Arch": "amd64", "SrcName": "intel-media-driver", "SrcVersion": "23.1.1+dfsg1", "SrcRelease": "1", "Licenses": [ "MIT", "BSD-3-Clause" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libigdgmm12@22.3.3+ds1-1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so", "/usr/share/doc/intel-media-va-driver/changelog.Debian.gz", "/usr/share/doc/intel-media-va-driver/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libacl1@2.3.1-3", "Name": "libacl1", "Identifier": { "PURL": "pkg:deb/debian/libacl1@2.3.1-3?arch=amd64\u0026distro=debian-12.15", "UID": "7231f68d66ac38b5" }, "Version": "2.3.1", "Release": "3", "Arch": "amd64", "SrcName": "acl", "SrcVersion": "2.3.1", "SrcRelease": "3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.1-only" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301", "/usr/share/doc/libacl1/changelog.Debian.gz", "/usr/share/doc/libacl1/changelog.gz", "/usr/share/doc/libacl1/copyright", "/usr/share/lintian/overrides/libacl1" ], "AnalyzedBy": "dpkg" }, { "ID": "libaom3@3.6.0-1+deb12u2", "Name": "libaom3", "Identifier": { "PURL": "pkg:deb/debian/libaom3@3.6.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "8cffe3264c58c158" }, "Version": "3.6.0", "Release": "1+deb12u2", "Arch": "amd64", "SrcName": "aom", "SrcVersion": "3.6.0", "SrcRelease": "1+deb12u2", "Licenses": [ "BSD-2-Clause", "public-domain-md5", "BSD-3-Clause", "ISC", "MIT" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libaom.so.3.6.0", "/usr/share/doc/libaom3/changelog.Debian.gz", "/usr/share/doc/libaom3/changelog.gz", "/usr/share/doc/libaom3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libapt-pkg6.0@2.6.1", "Name": "libapt-pkg6.0", "Identifier": { "PURL": "pkg:deb/debian/libapt-pkg6.0@2.6.1?arch=amd64\u0026distro=debian-12.15", "UID": "1643dd5a3358bf0d" }, "Version": "2.6.1", "Arch": "amd64", "SrcName": "apt", "SrcVersion": "2.6.1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "BSD-3-Clause", "MIT" ], "Maintainer": "APT Development Team \u003cdeity@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-5+b1", "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libgcrypt20@1.10.1-3+deb12u1", "liblz4-1@1.9.4-1", "liblzma5@5.4.1-1+deb12u1", "libstdc++6@12.2.0-14+deb12u1", "libsystemd0@252.39-1~deb12u2", "libudev1@252.39-1~deb12u2", "libxxhash0@0.8.1-1", "libzstd1@1.5.4+dfsg2-5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libapt-pkg.so.6.0.0", "/usr/share/doc/libapt-pkg6.0/NEWS.Debian.gz", "/usr/share/doc/libapt-pkg6.0/changelog.gz", "/usr/share/doc/libapt-pkg6.0/copyright", "/usr/share/locale/ar/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ast/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/bg/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/bs/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ca/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/cs/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/cy/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/da/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/de/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/dz/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/el/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/es/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/eu/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/fi/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/fr/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/gl/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/hu/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/it/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ja/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/km/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ko/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ku/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/lt/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/mr/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/nb/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ne/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/nl/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/nn/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/pl/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/pt/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ro/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/ru/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/sk/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/sl/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/sv/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/th/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/tl/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/tr/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/uk/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/vi/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/libapt-pkg6.0.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/libapt-pkg6.0.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libasound2@1.2.8-1+b1", "Name": "libasound2", "Identifier": { "PURL": "pkg:deb/debian/libasound2@1.2.8-1%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "bf64d1802f689b11" }, "Version": "1.2.8", "Release": "1+b1", "Arch": "amd64", "SrcName": "alsa-lib", "SrcVersion": "1.2.8", "SrcRelease": "1", "Licenses": [ "LPGL-2.1+", "LGPL-2.1-only" ], "Maintainer": "Debian ALSA Maintainers \u003cpkg-alsa-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasound2-data@1.2.8-1", "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libasound.so.2.0.0", "/usr/share/doc/libasound2/NEWS.Debian.gz", "/usr/share/doc/libasound2/changelog.Debian.amd64.gz", "/usr/share/doc/libasound2/changelog.Debian.gz", "/usr/share/doc/libasound2/copyright", "/usr/share/doc/libasound2/examples/asoundrc.txt" ], "AnalyzedBy": "dpkg" }, { "ID": "libasound2-data@1.2.8-1", "Name": "libasound2-data", "Identifier": { "PURL": "pkg:deb/debian/libasound2-data@1.2.8-1?arch=all\u0026distro=debian-12.15", "UID": "c04e41ab2b1b1f93" }, "Version": "1.2.8", "Release": "1", "Arch": "all", "SrcName": "alsa-lib", "SrcVersion": "1.2.8", "SrcRelease": "1", "Licenses": [ "LPGL-2.1+", "LGPL-2.1-only" ], "Maintainer": "Debian ALSA Maintainers \u003cpkg-alsa-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/alsa/alsa.conf", "/usr/share/alsa/cards/AACI.conf", "/usr/share/alsa/cards/ATIIXP-MODEM.conf", "/usr/share/alsa/cards/ATIIXP-SPDMA.conf", "/usr/share/alsa/cards/ATIIXP.conf", "/usr/share/alsa/cards/AU8810.conf", "/usr/share/alsa/cards/AU8820.conf", "/usr/share/alsa/cards/AU8830.conf", "/usr/share/alsa/cards/Audigy.conf", "/usr/share/alsa/cards/Audigy2.conf", "/usr/share/alsa/cards/Aureon51.conf", "/usr/share/alsa/cards/Aureon71.conf", "/usr/share/alsa/cards/CA0106.conf", "/usr/share/alsa/cards/CMI8338-SWIEC.conf", "/usr/share/alsa/cards/CMI8338.conf", "/usr/share/alsa/cards/CMI8738-MC6.conf", "/usr/share/alsa/cards/CMI8738-MC8.conf", "/usr/share/alsa/cards/CMI8788.conf", "/usr/share/alsa/cards/CS46xx.conf", "/usr/share/alsa/cards/EMU10K1.conf", "/usr/share/alsa/cards/EMU10K1X.conf", "/usr/share/alsa/cards/ENS1370.conf", "/usr/share/alsa/cards/ENS1371.conf", "/usr/share/alsa/cards/ES1968.conf", "/usr/share/alsa/cards/Echo_Echo3G.conf", "/usr/share/alsa/cards/FM801.conf", "/usr/share/alsa/cards/FWSpeakers.conf", "/usr/share/alsa/cards/FireWave.conf", "/usr/share/alsa/cards/GUS.conf", "/usr/share/alsa/cards/HDA-Intel.conf", "/usr/share/alsa/cards/HdmiLpeAudio.conf", "/usr/share/alsa/cards/ICE1712.conf", "/usr/share/alsa/cards/ICE1724.conf", "/usr/share/alsa/cards/ICH-MODEM.conf", "/usr/share/alsa/cards/ICH.conf", "/usr/share/alsa/cards/ICH4.conf", "/usr/share/alsa/cards/Loopback.conf", "/usr/share/alsa/cards/Maestro3.conf", "/usr/share/alsa/cards/NFORCE.conf", "/usr/share/alsa/cards/PC-Speaker.conf", "/usr/share/alsa/cards/PMac.conf", "/usr/share/alsa/cards/PMacToonie.conf", "/usr/share/alsa/cards/PS3.conf", "/usr/share/alsa/cards/RME9636.conf", "/usr/share/alsa/cards/RME9652.conf", "/usr/share/alsa/cards/SB-XFi.conf", "/usr/share/alsa/cards/SI7018.conf", "/usr/share/alsa/cards/TRID4DWAVENX.conf", "/usr/share/alsa/cards/USB-Audio.conf", "/usr/share/alsa/cards/VIA686A.conf", "/usr/share/alsa/cards/VIA8233.conf", "/usr/share/alsa/cards/VIA8233A.conf", "/usr/share/alsa/cards/VIA8237.conf", "/usr/share/alsa/cards/VX222.conf", "/usr/share/alsa/cards/VXPocket.conf", "/usr/share/alsa/cards/VXPocket440.conf", "/usr/share/alsa/cards/YMF744.conf", "/usr/share/alsa/cards/aliases.conf", "/usr/share/alsa/cards/pistachio-card.conf", "/usr/share/alsa/cards/vc4-hdmi.conf", "/usr/share/alsa/ctl/default.conf", "/usr/share/alsa/pcm/center_lfe.conf", "/usr/share/alsa/pcm/default.conf", "/usr/share/alsa/pcm/dmix.conf", "/usr/share/alsa/pcm/dpl.conf", "/usr/share/alsa/pcm/dsnoop.conf", "/usr/share/alsa/pcm/front.conf", "/usr/share/alsa/pcm/hdmi.conf", "/usr/share/alsa/pcm/iec958.conf", "/usr/share/alsa/pcm/modem.conf", "/usr/share/alsa/pcm/rear.conf", "/usr/share/alsa/pcm/side.conf", "/usr/share/alsa/pcm/surround21.conf", "/usr/share/alsa/pcm/surround40.conf", "/usr/share/alsa/pcm/surround41.conf", "/usr/share/alsa/pcm/surround50.conf", "/usr/share/alsa/pcm/surround51.conf", "/usr/share/alsa/pcm/surround71.conf", "/usr/share/doc/libasound2-data/changelog.Debian.gz", "/usr/share/doc/libasound2-data/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libass9@1:0.17.1-1", "Name": "libass9", "Identifier": { "PURL": "pkg:deb/debian/libass9@0.17.1-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "5060c4b9be28c3c1" }, "Version": "0.17.1", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libass", "SrcVersion": "0.17.1", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "ISC", "other-1", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libfontconfig1@2.14.1-4", "libfreetype6@2.12.1+dfsg-5+deb12u4", "libfribidi0@1.0.8-2.1", "libharfbuzz0b@6.0.0+dfsg-3" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libass.so.9.2.1", "/usr/share/doc/libass9/changelog.Debian.gz", "/usr/share/doc/libass9/changelog.gz", "/usr/share/doc/libass9/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libasyncns0@0.8-6+b3", "Name": "libasyncns0", "Identifier": { "PURL": "pkg:deb/debian/libasyncns0@0.8-6%2Bb3?arch=amd64\u0026distro=debian-12.15", "UID": "e378d9485fc7760f" }, "Version": "0.8", "Release": "6+b3", "Arch": "amd64", "SrcName": "libasyncns", "SrcVersion": "0.8", "SrcRelease": "6", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only" ], "Maintainer": "Tanguy Ortolo \u003ctanguy+debian@ortolo.eu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libasyncns.so.0.3.1", "/usr/share/doc/libasyncns0/changelog.Debian.amd64.gz", "/usr/share/doc/libasyncns0/changelog.Debian.gz", "/usr/share/doc/libasyncns0/changelog.gz", "/usr/share/doc/libasyncns0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libattr1@1:2.5.1-4", "Name": "libattr1", "Identifier": { "PURL": "pkg:deb/debian/libattr1@2.5.1-4?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f518c6c499c1b23d" }, "Version": "2.5.1", "Release": "4", "Epoch": 1, "Arch": "amd64", "SrcName": "attr", "SrcVersion": "2.5.1", "SrcRelease": "4", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "LGPL-2.1-only" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libattr.so.1.1.2501", "/usr/share/doc/libattr1/changelog.Debian.gz", "/usr/share/doc/libattr1/changelog.gz", "/usr/share/doc/libattr1/copyright", "/usr/share/lintian/overrides/libattr1" ], "AnalyzedBy": "dpkg" }, { "ID": "libaudit-common@1:3.0.9-1", "Name": "libaudit-common", "Identifier": { "PURL": "pkg:deb/debian/libaudit-common@3.0.9-1?arch=all\u0026distro=debian-12.15\u0026epoch=1", "UID": "501d3bae9dbba871" }, "Version": "3.0.9", "Release": "1", "Epoch": 1, "Arch": "all", "SrcName": "audit", "SrcVersion": "3.0.9", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only", "GPL-1.0-only" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/share/doc/libaudit-common/changelog.Debian.gz", "/usr/share/doc/libaudit-common/changelog.gz", "/usr/share/doc/libaudit-common/copyright", "/usr/share/man/man5/libaudit.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libaudit1@1:3.0.9-1", "Name": "libaudit1", "Identifier": { "PURL": "pkg:deb/debian/libaudit1@3.0.9-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "6fa2aa50bb112627" }, "Version": "3.0.9", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "audit", "SrcVersion": "3.0.9", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only", "GPL-1.0-only" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit-common@1:3.0.9-1", "libc6@2.36-9+deb12u14", "libcap-ng0@0.8.3-1+b3" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libaudit.so.1.0.0", "/usr/share/doc/libaudit1/changelog.Debian.gz", "/usr/share/doc/libaudit1/changelog.gz", "/usr/share/doc/libaudit1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libavc1394-0@0.5.4-5", "Name": "libavc1394-0", "Identifier": { "PURL": "pkg:deb/debian/libavc1394-0@0.5.4-5?arch=amd64\u0026distro=debian-12.15", "UID": "3192d68ba7da9ef9" }, "Version": "0.5.4", "Release": "5", "Arch": "amd64", "SrcName": "libavc1394", "SrcVersion": "0.5.4", "SrcRelease": "5", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libraw1394-11@2.1.2-2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavc1394.so.0.3.0", "/usr/lib/x86_64-linux-gnu/librom1394.so.0.3.0", "/usr/share/doc/libavc1394-0/changelog.Debian.gz", "/usr/share/doc/libavc1394-0/changelog.gz", "/usr/share/doc/libavc1394-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libavcodec59@7:5.1.9-0+deb12u1", "Name": "libavcodec59", "Identifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "Version": "5.1.9", "Release": "0+deb12u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "5.1.9", "SrcRelease": "0+deb12u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaom3@3.6.0-1+deb12u2", "libavutil57@7:5.1.9-0+deb12u1", "libc6@2.36-9+deb12u14", "libcairo2@1.16.0-7", "libcodec2-1.0@1.0.5-1", "libdav1d6@1.0.0-2+deb12u1", "libglib2.0-0@2.74.6-2+deb12u9", "libgsm1@1.0.22-1", "libjxl0.7@0.7.0-10+deb12u1", "liblzma5@5.4.1-1+deb12u1", "libmfx1@22.5.4-1", "libmp3lame0@3.100-6", "libopenjp2-7@2.5.0-2+deb12u3", "libopus0@1.3.1-3", "librav1e0@0.5.1-6", "librsvg2-2@2.54.7+dfsg-1~deb12u1", "libshine3@3.1.1-2", "libsnappy1v5@1.1.9-3", "libspeex1@1.2.1-2", "libsvtav1enc1@1.4.1+dfsg-1", "libswresample4@7:5.1.9-0+deb12u1", "libtheora0@1.1.1+dfsg.1-16.1+deb12u1", "libtwolame0@0.4.0-2", "libva2@2.17.0-1", "libvorbis0a@1.3.7-1", "libvorbisenc2@1.3.7-1", "libvpx7@1.12.0-1+deb12u5", "libwebp7@1.2.4-0.2+deb12u1", "libwebpmux3@1.2.4-0.2+deb12u1", "libx264-164@2:0.164.3095+gitbaee400-3", "libx265-199@3.5-2+b1", "libxvidcore4@2:1.3.7-1", "libzvbi0@0.2.41-1+deb12u1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavcodec.so.59.37.100", "/usr/share/doc/libavcodec59/changelog.Debian.gz", "/usr/share/doc/libavcodec59/changelog.gz", "/usr/share/doc/libavcodec59/copyright", "/usr/share/lintian/overrides/libavcodec59" ], "AnalyzedBy": "dpkg" }, { "ID": "libavdevice59@7:5.1.9-0+deb12u1", "Name": "libavdevice59", "Identifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "Version": "5.1.9", "Release": "0+deb12u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "5.1.9", "SrcRelease": "0+deb12u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasound2@1.2.8-1+b1", "libavc1394-0@0.5.4-5", "libavcodec59@7:5.1.9-0+deb12u1", "libavfilter8@7:5.1.9-0+deb12u1", "libavformat59@7:5.1.9-0+deb12u1", "libavutil57@7:5.1.9-0+deb12u1", "libc6@2.36-9+deb12u14", "libcaca0@0.99.beta20-3+deb12u1", "libcdio-cdda2@10.2+2.0.1-1", "libcdio-paranoia2@10.2+2.0.1-1", "libdc1394-25@2.2.6-4", "libdrm2@2.4.114-1+b1", "libgl1@1.6.0-1", "libiec61883-0@1.2.0-6+b1", "libjack-jackd2-0@1.9.21~dfsg-3", "libopenal1@1:1.19.1-2", "libpulse0@16.1+dfsg1-2+b1", "libraw1394-11@2.1.2-2", "libsdl2-2.0-0@2.26.5+dfsg-1", "libx11-6@2:1.8.4-2+deb12u2", "libxcb-shape0@1.15-1", "libxcb-shm0@1.15-1", "libxcb-xfixes0@1.15-1", "libxcb1@1.15-1", "libxext6@2:1.3.4-1+b1", "libxv1@2:1.0.11-1.1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavdevice.so.59.7.100", "/usr/share/doc/libavdevice59/changelog.Debian.gz", "/usr/share/doc/libavdevice59/changelog.gz", "/usr/share/doc/libavdevice59/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libavfilter8@7:5.1.9-0+deb12u1", "Name": "libavfilter8", "Identifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "Version": "5.1.9", "Release": "0+deb12u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "5.1.9", "SrcRelease": "0+deb12u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libass9@1:0.17.1-1", "libavcodec59@7:5.1.9-0+deb12u1", "libavformat59@7:5.1.9-0+deb12u1", "libavutil57@7:5.1.9-0+deb12u1", "libbs2b0@3.1.0+dfsg-7", "libc6@2.36-9+deb12u14", "libflite1@2.2-5", "libfontconfig1@2.14.1-4", "libfreetype6@2.12.1+dfsg-5+deb12u4", "libfribidi0@1.0.8-2.1", "liblilv-0-0@0.24.14-1", "libmfx1@22.5.4-1", "libmysofa1@1.3.1~dfsg0-1", "libplacebo208@4.208.0-3", "libpocketsphinx3@0.8+5prealpha+1-15", "libpostproc56@7:5.1.9-0+deb12u1", "librubberband2@3.1.2+dfsg0-1", "libsphinxbase3@0.8+5prealpha+1-16", "libstdc++6@12.2.0-14+deb12u1", "libswresample4@7:5.1.9-0+deb12u1", "libswscale6@7:5.1.9-0+deb12u1", "libva2@2.17.0-1", "libvidstab1.1@1.1.0-2+b1", "libzimg2@3.0.4+ds1-1", "libzmq5@4.3.4-6", "ocl-icd-libopencl1@2.3.1-1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavfilter.so.8.44.100", "/usr/share/doc/libavfilter8/changelog.Debian.gz", "/usr/share/doc/libavfilter8/changelog.gz", "/usr/share/doc/libavfilter8/copyright", "/usr/share/lintian/overrides/libavfilter8" ], "AnalyzedBy": "dpkg" }, { "ID": "libavformat59@7:5.1.9-0+deb12u1", "Name": "libavformat59", "Identifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "Version": "5.1.9", "Release": "0+deb12u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "5.1.9", "SrcRelease": "0+deb12u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavcodec59@7:5.1.9-0+deb12u1", "libavutil57@7:5.1.9-0+deb12u1", "libbluray2@1:1.3.4-1", "libbz2-1.0@1.0.8-5+b1", "libc6@2.36-9+deb12u14", "libchromaprint1@1.5.1-2+b1", "libgme0@0.6.3-6", "libgnutls30@3.7.9-2+deb12u7", "libopenmpt0@0.6.9-1", "librabbitmq4@0.11.0-1+deb12u2", "librist4@0.2.7+dfsg-1", "libsrt1.5-gnutls@1.5.1-1+deb12u1", "libssh-gcrypt-4@0.10.6-0+deb12u2", "libxml2@2.9.14+dfsg-1.3~deb12u6", "libzmq5@4.3.4-6", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavformat.so.59.27.100", "/usr/share/doc/libavformat59/changelog.Debian.gz", "/usr/share/doc/libavformat59/changelog.gz", "/usr/share/doc/libavformat59/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libavutil57@7:5.1.9-0+deb12u1", "Name": "libavutil57", "Identifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "Version": "5.1.9", "Release": "0+deb12u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "5.1.9", "SrcRelease": "0+deb12u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm2@2.4.114-1+b1", "libmfx1@22.5.4-1", "libva-drm2@2.17.0-1", "libva-x11-2@2.17.0-1", "libva2@2.17.0-1", "libvdpau1@1.5-2", "libx11-6@2:1.8.4-2+deb12u2", "ocl-icd-libopencl1@2.3.1-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libavutil.so.57.28.100", "/usr/share/doc/libavutil57/changelog.Debian.gz", "/usr/share/doc/libavutil57/changelog.gz", "/usr/share/doc/libavutil57/copyright", "/usr/share/lintian/overrides/libavutil57" ], "AnalyzedBy": "dpkg" }, { "ID": "libblas3@3.11.0-2", "Name": "libblas3", "Identifier": { "PURL": "pkg:deb/debian/libblas3@3.11.0-2?arch=amd64\u0026distro=debian-12.15", "UID": "39784a8b2871bd85" }, "Version": "3.11.0", "Release": "2", "Arch": "amd64", "SrcName": "lapack", "SrcVersion": "3.11.0", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-intel" ], "Maintainer": "Debian Science Team \u003cdebian-science-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/blas/libblas.so.3.11.0", "/usr/share/doc/libblas3/changelog.Debian.gz", "/usr/share/doc/libblas3/copyright", "/usr/share/lintian/overrides/libblas3" ], "AnalyzedBy": "dpkg" }, { "ID": "libblkid1@2.38.1-5+deb12u3", "Name": "libblkid1", "Identifier": { "PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ef2ef32fd8f1c6bb" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libblkid.so.1.1.0", "/usr/share/doc/libblkid1/changelog.Debian.gz", "/usr/share/doc/libblkid1/changelog.gz", "/usr/share/doc/libblkid1/copyright", "/usr/share/lintian/overrides/libblkid1" ], "AnalyzedBy": "dpkg" }, { "ID": "libbluray2@1:1.3.4-1", "Name": "libbluray2", "Identifier": { "PURL": "pkg:deb/debian/libbluray2@1.3.4-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "65e6080d091d4e26" }, "Version": "1.3.4", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libbluray", "SrcVersion": "1.3.4", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "LGPL-2.1-or-later", "custom", "GPL-2.0-or-later", "BSD-3-Clause", "MPL-1.0", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libfontconfig1@2.14.1-4", "libfreetype6@2.12.1+dfsg-5+deb12u4", "libudfread0@1.1.2-1", "libxml2@2.9.14+dfsg-1.3~deb12u6" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbluray.so.2.4.3", "/usr/share/doc/libbluray2/changelog.Debian.gz", "/usr/share/doc/libbluray2/changelog.gz", "/usr/share/doc/libbluray2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libbrotli1@1.0.9-2+b6", "Name": "libbrotli1", "Identifier": { "PURL": "pkg:deb/debian/libbrotli1@1.0.9-2%2Bb6?arch=amd64\u0026distro=debian-12.15", "UID": "2578f046acf84274" }, "Version": "1.0.9", "Release": "2+b6", "Arch": "amd64", "SrcName": "brotli", "SrcVersion": "1.0.9", "SrcRelease": "2", "Licenses": [ "MIT" ], "Maintainer": "Tomasz Buchert \u003ctomasz@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbrotlicommon.so.1.0.9", "/usr/lib/x86_64-linux-gnu/libbrotlidec.so.1.0.9", "/usr/lib/x86_64-linux-gnu/libbrotlienc.so.1.0.9", "/usr/share/doc/libbrotli1/changelog.Debian.amd64.gz", "/usr/share/doc/libbrotli1/changelog.Debian.gz", "/usr/share/doc/libbrotli1/copyright", "/usr/share/lintian/overrides/libbrotli1" ], "AnalyzedBy": "dpkg" }, { "ID": "libbs2b0@3.1.0+dfsg-7", "Name": "libbs2b0", "Identifier": { "PURL": "pkg:deb/debian/libbs2b0@3.1.0%2Bdfsg-7?arch=amd64\u0026distro=debian-12.15", "UID": "cfba48bab52c1dd8" }, "Version": "3.1.0+dfsg", "Release": "7", "Arch": "amd64", "SrcName": "libbs2b", "SrcVersion": "3.1.0+dfsg", "SrcRelease": "7", "Licenses": [ "MIT", "GPL-3.0-or-later", "GPL-2.0-or-later", "MIT+FSF-public", "FSF-unlimited", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian QA Group \u003cpackages@qa.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbs2b.so.0.0.0", "/usr/share/doc/libbs2b0/changelog.Debian.gz", "/usr/share/doc/libbs2b0/changelog.gz", "/usr/share/doc/libbs2b0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libbsd0@0.11.7-2", "Name": "libbsd0", "Identifier": { "PURL": "pkg:deb/debian/libbsd0@0.11.7-2?arch=amd64\u0026distro=debian-12.15", "UID": "a3253afe12e63e2d" }, "Version": "0.11.7", "Release": "2", "Arch": "amd64", "SrcName": "libbsd", "SrcVersion": "0.11.7", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-4-clause-Niels-Provos", "BSD-3-clause-Regents", "BSD-2-Clause-NetBSD", "BSD-3-clause-author", "BSD-3-clause-John-Birrell", "libutil-David-Nugent", "BSD-2-Clause", "BSD-2-clause-verbatim", "BSD-2-clause-author", "ISC", "ISC-Original", "MIT", "public-domain", "Beerware" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libmd0@1.0.4-2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libbsd.so.0.11.7", "/usr/share/doc/libbsd0/changelog.Debian.gz", "/usr/share/doc/libbsd0/changelog.gz", "/usr/share/doc/libbsd0/copyright", "/usr/share/lintian/overrides/libbsd0" ], "AnalyzedBy": "dpkg" }, { "ID": "libbz2-1.0@1.0.8-5+b1", "Name": "libbz2-1.0", "Identifier": { "PURL": "pkg:deb/debian/libbz2-1.0@1.0.8-5%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "a9f97ed113aa4026" }, "Version": "1.0.8", "Release": "5+b1", "Arch": "amd64", "SrcName": "bzip2", "SrcVersion": "1.0.8", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libbz2.so.1.0.4", "/usr/share/doc/libbz2-1.0/changelog.Debian.amd64.gz", "/usr/share/doc/libbz2-1.0/changelog.Debian.gz", "/usr/share/doc/libbz2-1.0/changelog.gz", "/usr/share/doc/libbz2-1.0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libc-bin@2.36-9+deb12u14", "Name": "libc-bin", "Identifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "fffe74ad3db2b1d6" }, "Version": "2.36", "Release": "9+deb12u14", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.36", "SrcRelease": "9+deb12u14", "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/sbin/ldconfig", "/usr/bin/getconf", "/usr/bin/getent", "/usr/bin/iconv", "/usr/bin/ldd", "/usr/bin/locale", "/usr/bin/localedef", "/usr/bin/pldd", "/usr/bin/tzselect", "/usr/bin/zdump", "/usr/lib/locale/C.utf8/LC_ADDRESS", "/usr/lib/locale/C.utf8/LC_COLLATE", "/usr/lib/locale/C.utf8/LC_CTYPE", "/usr/lib/locale/C.utf8/LC_IDENTIFICATION", "/usr/lib/locale/C.utf8/LC_MEASUREMENT", "/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES", "/usr/lib/locale/C.utf8/LC_MONETARY", "/usr/lib/locale/C.utf8/LC_NAME", "/usr/lib/locale/C.utf8/LC_NUMERIC", "/usr/lib/locale/C.utf8/LC_PAPER", "/usr/lib/locale/C.utf8/LC_TELEPHONE", "/usr/lib/locale/C.utf8/LC_TIME", "/usr/sbin/iconvconfig", "/usr/sbin/zic", "/usr/share/doc/libc-bin/changelog.Debian.gz", "/usr/share/doc/libc-bin/changelog.gz", "/usr/share/doc/libc-bin/copyright", "/usr/share/libc-bin/nsswitch.conf", "/usr/share/lintian/overrides/libc-bin", "/usr/share/man/man1/getconf.1.gz", "/usr/share/man/man1/tzselect.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libc6@2.36-9+deb12u14", "Name": "libc6", "Identifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "348ed513aa2cf7e9" }, "Version": "2.36", "Release": "9+deb12u14", "Arch": "amd64", "SrcName": "glibc", "SrcVersion": "2.36", "SrcRelease": "9+deb12u14", "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libgcc-s1@12.2.0-14+deb12u1" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", "/lib/x86_64-linux-gnu/libBrokenLocale.so.1", "/lib/x86_64-linux-gnu/libanl.so.1", "/lib/x86_64-linux-gnu/libc.so.6", "/lib/x86_64-linux-gnu/libc_malloc_debug.so.0", "/lib/x86_64-linux-gnu/libdl.so.2", "/lib/x86_64-linux-gnu/libm.so.6", "/lib/x86_64-linux-gnu/libmemusage.so", "/lib/x86_64-linux-gnu/libmvec.so.1", "/lib/x86_64-linux-gnu/libnsl.so.1", "/lib/x86_64-linux-gnu/libnss_compat.so.2", "/lib/x86_64-linux-gnu/libnss_dns.so.2", "/lib/x86_64-linux-gnu/libnss_files.so.2", "/lib/x86_64-linux-gnu/libnss_hesiod.so.2", "/lib/x86_64-linux-gnu/libpcprofile.so", "/lib/x86_64-linux-gnu/libpthread.so.0", "/lib/x86_64-linux-gnu/libresolv.so.2", "/lib/x86_64-linux-gnu/librt.so.1", "/lib/x86_64-linux-gnu/libthread_db.so.1", "/lib/x86_64-linux-gnu/libutil.so.1", "/usr/lib/x86_64-linux-gnu/gconv/ANSI_X3.110.so", "/usr/lib/x86_64-linux-gnu/gconv/ARMSCII-8.so", "/usr/lib/x86_64-linux-gnu/gconv/ASMO_449.so", "/usr/lib/x86_64-linux-gnu/gconv/BIG5.so", "/usr/lib/x86_64-linux-gnu/gconv/BIG5HKSCS.so", "/usr/lib/x86_64-linux-gnu/gconv/BRF.so", "/usr/lib/x86_64-linux-gnu/gconv/CP10007.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1125.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1250.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1251.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1252.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1253.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1254.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1255.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1256.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1257.so", "/usr/lib/x86_64-linux-gnu/gconv/CP1258.so", "/usr/lib/x86_64-linux-gnu/gconv/CP737.so", "/usr/lib/x86_64-linux-gnu/gconv/CP770.so", "/usr/lib/x86_64-linux-gnu/gconv/CP771.so", "/usr/lib/x86_64-linux-gnu/gconv/CP772.so", "/usr/lib/x86_64-linux-gnu/gconv/CP773.so", "/usr/lib/x86_64-linux-gnu/gconv/CP774.so", "/usr/lib/x86_64-linux-gnu/gconv/CP775.so", "/usr/lib/x86_64-linux-gnu/gconv/CP932.so", "/usr/lib/x86_64-linux-gnu/gconv/CSN_369103.so", "/usr/lib/x86_64-linux-gnu/gconv/CWI.so", "/usr/lib/x86_64-linux-gnu/gconv/DEC-MCS.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-AT-DE-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-AT-DE.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-CA-FR.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-DK-NO-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-DK-NO.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES-S.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-ES.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FI-SE-A.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FI-SE.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-FR.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-IS-FRISS.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-IT.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-PT.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-UK.so", "/usr/lib/x86_64-linux-gnu/gconv/EBCDIC-US.so", "/usr/lib/x86_64-linux-gnu/gconv/ECMA-CYRILLIC.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-CN.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JP-MS.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-JP.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-KR.so", "/usr/lib/x86_64-linux-gnu/gconv/EUC-TW.so", "/usr/lib/x86_64-linux-gnu/gconv/GB18030.so", "/usr/lib/x86_64-linux-gnu/gconv/GBBIG5.so", "/usr/lib/x86_64-linux-gnu/gconv/GBGBK.so", "/usr/lib/x86_64-linux-gnu/gconv/GBK.so", "/usr/lib/x86_64-linux-gnu/gconv/GEORGIAN-ACADEMY.so", "/usr/lib/x86_64-linux-gnu/gconv/GEORGIAN-PS.so", "/usr/lib/x86_64-linux-gnu/gconv/GOST_19768-74.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK-CCITT.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK7-OLD.so", "/usr/lib/x86_64-linux-gnu/gconv/GREEK7.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-GREEK8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-ROMAN8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-ROMAN9.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-THAI8.so", "/usr/lib/x86_64-linux-gnu/gconv/HP-TURKISH8.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM037.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM038.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1004.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1008.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1008_420.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1025.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1026.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1046.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1047.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1097.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1112.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1122.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1123.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1124.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1129.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1130.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1132.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1133.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1137.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1140.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1141.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1142.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1143.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1144.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1145.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1146.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1147.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1148.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1149.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1153.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1154.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1155.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1156.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1157.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1158.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1160.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1161.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1162.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1163.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1164.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1166.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1167.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM12712.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1364.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1371.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1388.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1390.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM1399.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM16804.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM256.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM273.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM274.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM275.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM277.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM278.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM280.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM281.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM284.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM285.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM290.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM297.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM420.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM423.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM424.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM437.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4517.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4899.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4909.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM4971.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM500.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM5347.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM803.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM850.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM851.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM852.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM855.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM856.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM857.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM858.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM860.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM861.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM862.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM863.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM864.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM865.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM866.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM866NAV.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM868.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM869.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM870.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM871.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM874.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM875.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM880.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM891.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM901.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM902.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM903.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9030.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM904.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM905.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9066.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM918.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM921.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM922.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM930.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM932.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM933.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM935.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM937.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM939.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM943.so", "/usr/lib/x86_64-linux-gnu/gconv/IBM9448.so", "/usr/lib/x86_64-linux-gnu/gconv/IEC_P27-1.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS-8.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS-CYRILLIC.so", "/usr/lib/x86_64-linux-gnu/gconv/INIS.so", "/usr/lib/x86_64-linux-gnu/gconv/ISIRI-3342.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-CN-EXT.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-CN.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-JP-3.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-JP.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-2022-KR.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-IR-197.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO-IR-209.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO646.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-1.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-10.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-11.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-13.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-14.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-15.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-16.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-2.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-3.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-4.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-5.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-6.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-7.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-8.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-9.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO8859-9E.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_10367-BOX.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_11548-1.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_2033.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5427-EXT.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5427.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_5428.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_6937-2.so", "/usr/lib/x86_64-linux-gnu/gconv/ISO_6937.so", "/usr/lib/x86_64-linux-gnu/gconv/JOHAB.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI-8.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-R.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-RU.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-T.so", "/usr/lib/x86_64-linux-gnu/gconv/KOI8-U.so", "/usr/lib/x86_64-linux-gnu/gconv/LATIN-GREEK-1.so", "/usr/lib/x86_64-linux-gnu/gconv/LATIN-GREEK.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-CENTRALEUROPE.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-IS.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-SAMI.so", "/usr/lib/x86_64-linux-gnu/gconv/MAC-UK.so", "/usr/lib/x86_64-linux-gnu/gconv/MACINTOSH.so", "/usr/lib/x86_64-linux-gnu/gconv/MIK.so", "/usr/lib/x86_64-linux-gnu/gconv/NATS-DANO.so", "/usr/lib/x86_64-linux-gnu/gconv/NATS-SEFI.so", "/usr/lib/x86_64-linux-gnu/gconv/PT154.so", "/usr/lib/x86_64-linux-gnu/gconv/RK1048.so", "/usr/lib/x86_64-linux-gnu/gconv/SAMI-WS2.so", "/usr/lib/x86_64-linux-gnu/gconv/SHIFT_JISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/SJIS.so", "/usr/lib/x86_64-linux-gnu/gconv/T.61.so", "/usr/lib/x86_64-linux-gnu/gconv/TCVN5712-1.so", "/usr/lib/x86_64-linux-gnu/gconv/TIS-620.so", "/usr/lib/x86_64-linux-gnu/gconv/TSCII.so", "/usr/lib/x86_64-linux-gnu/gconv/UHC.so", "/usr/lib/x86_64-linux-gnu/gconv/UNICODE.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-16.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-32.so", "/usr/lib/x86_64-linux-gnu/gconv/UTF-7.so", "/usr/lib/x86_64-linux-gnu/gconv/VISCII.so", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.d/gconv-modules-extra.conf", "/usr/lib/x86_64-linux-gnu/gconv/libCNS.so", "/usr/lib/x86_64-linux-gnu/gconv/libGB.so", "/usr/lib/x86_64-linux-gnu/gconv/libISOIR165.so", "/usr/lib/x86_64-linux-gnu/gconv/libJIS.so", "/usr/lib/x86_64-linux-gnu/gconv/libJISX0213.so", "/usr/lib/x86_64-linux-gnu/gconv/libKSC.so", "/usr/share/doc/libc6/NEWS.Debian.gz", "/usr/share/doc/libc6/NEWS.gz", "/usr/share/doc/libc6/README.Debian.gz", "/usr/share/doc/libc6/README.hesiod.gz", "/usr/share/doc/libc6/changelog.Debian.gz", "/usr/share/doc/libc6/changelog.gz", "/usr/share/doc/libc6/copyright", "/usr/share/lintian/overrides/libc6" ], "AnalyzedBy": "dpkg" }, { "ID": "libcaca0@0.99.beta20-3+deb12u1", "Name": "libcaca0", "Identifier": { "PURL": "pkg:deb/debian/libcaca0@0.99.beta20-3%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "5e138c1b59ffdbb3" }, "Version": "0.99.beta20", "Release": "3+deb12u1", "Arch": "amd64", "SrcName": "libcaca", "SrcVersion": "0.99.beta20", "SrcRelease": "3+deb12u1", "Licenses": [ "WTFPL-2", "ISC", "LGPL-2.0-or-later", "GPL-2.0-or-later", "GPL-1.0-only", "GPL-2.0-only", "LGPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libncursesw6@6.4-4", "libslang2@2.3.3-3", "libstdc++6@12.2.0-14+deb12u1", "libtinfo6@6.4-4", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/caca/libgl_plugin.so.0.0.0", "/usr/lib/x86_64-linux-gnu/caca/libx11_plugin.so.0.0.0", "/usr/lib/x86_64-linux-gnu/libcaca++.so.0.99.20", "/usr/lib/x86_64-linux-gnu/libcaca.so.0.99.20", "/usr/share/doc/libcaca0/changelog.Debian.gz", "/usr/share/doc/libcaca0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcairo-gobject2@1.16.0-7", "Name": "libcairo-gobject2", "Identifier": { "PURL": "pkg:deb/debian/libcairo-gobject2@1.16.0-7?arch=amd64\u0026distro=debian-12.15", "UID": "59c30bde839149ea" }, "Version": "1.16.0", "Release": "7", "Arch": "amd64", "SrcName": "cairo", "SrcVersion": "1.16.0", "SrcRelease": "7", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libcairo2@1.16.0-7", "libglib2.0-0@2.74.6-2+deb12u9" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcairo-gobject.so.2.11600.0", "/usr/share/doc/libcairo-gobject2/changelog.Debian.gz", "/usr/share/doc/libcairo-gobject2/changelog.gz", "/usr/share/doc/libcairo-gobject2/copyright", "/usr/share/lintian/overrides/libcairo-gobject2" ], "AnalyzedBy": "dpkg" }, { "ID": "libcairo2@1.16.0-7", "Name": "libcairo2", "Identifier": { "PURL": "pkg:deb/debian/libcairo2@1.16.0-7?arch=amd64\u0026distro=debian-12.15", "UID": "33aa9515f3ad17b4" }, "Version": "1.16.0", "Release": "7", "Arch": "amd64", "SrcName": "cairo", "SrcVersion": "1.16.0", "SrcRelease": "7", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libfontconfig1@2.14.1-4", "libfreetype6@2.12.1+dfsg-5+deb12u4", "libpixman-1-0@0.42.2-1", "libpng16-16@1.6.39-2+deb12u5", "libx11-6@2:1.8.4-2+deb12u2", "libxcb-render0@1.15-1", "libxcb-shm0@1.15-1", "libxcb1@1.15-1", "libxext6@2:1.3.4-1+b1", "libxrender1@1:0.9.10-1.1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcairo.so.2.11600.0", "/usr/share/doc/libcairo2/changelog.Debian.gz", "/usr/share/doc/libcairo2/changelog.gz", "/usr/share/doc/libcairo2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcap-ng0@0.8.3-1+b3", "Name": "libcap-ng0", "Identifier": { "PURL": "pkg:deb/debian/libcap-ng0@0.8.3-1%2Bb3?arch=amd64\u0026distro=debian-12.15", "UID": "88debe617c7a36f4" }, "Version": "0.8.3", "Release": "1+b3", "Arch": "amd64", "SrcName": "libcap-ng", "SrcVersion": "0.8.3", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later", "GPL-3.0-only", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Håvard F. Aasen \u003chavard.f.aasen@pfft.no\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0", "/lib/x86_64-linux-gnu/libdrop_ambient.so.0.0.0", "/usr/share/doc/libcap-ng0/changelog.Debian.amd64.gz", "/usr/share/doc/libcap-ng0/changelog.Debian.gz", "/usr/share/doc/libcap-ng0/changelog.gz", "/usr/share/doc/libcap-ng0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcap2@1:2.66-4+deb12u3+b1", "Name": "libcap2", "Identifier": { "PURL": "pkg:deb/debian/libcap2@2.66-4%2Bdeb12u3%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "1af72e5dac96ffcc" }, "Version": "2.66", "Release": "4+deb12u3+b1", "Epoch": 1, "Arch": "amd64", "SrcName": "libcap2", "SrcVersion": "2.66", "SrcRelease": "4+deb12u3", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Christian Kastner \u003cckk@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libcap.so.2.66", "/lib/x86_64-linux-gnu/libpsx.so.2.66", "/usr/share/doc/libcap2/changelog.Debian.amd64.gz", "/usr/share/doc/libcap2/changelog.Debian.gz", "/usr/share/doc/libcap2/changelog.gz", "/usr/share/doc/libcap2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcdio-cdda2@10.2+2.0.1-1", "Name": "libcdio-cdda2", "Identifier": { "PURL": "pkg:deb/debian/libcdio-cdda2@10.2%2B2.0.1-1?arch=amd64\u0026distro=debian-12.15", "UID": "7fa5914417b4fa3" }, "Version": "10.2+2.0.1", "Release": "1", "Arch": "amd64", "SrcName": "libcdio-paranoia", "SrcVersion": "10.2+2.0.1", "SrcRelease": "1", "Licenses": [ "GPL-3.0-only", "GFDL-1.2-only" ], "Maintainer": "Philippe SWARTVAGHER \u003cphil.swart@gmx.fr\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libcdio19@2.1.0-4" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcdio_cdda.so.2.0.0", "/usr/share/doc/libcdio-cdda2/changelog.Debian.gz", "/usr/share/doc/libcdio-cdda2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcdio-paranoia2@10.2+2.0.1-1", "Name": "libcdio-paranoia2", "Identifier": { "PURL": "pkg:deb/debian/libcdio-paranoia2@10.2%2B2.0.1-1?arch=amd64\u0026distro=debian-12.15", "UID": "6aadb62e5567a3a0" }, "Version": "10.2+2.0.1", "Release": "1", "Arch": "amd64", "SrcName": "libcdio-paranoia", "SrcVersion": "10.2+2.0.1", "SrcRelease": "1", "Licenses": [ "GPL-3.0-only", "GFDL-1.2-only" ], "Maintainer": "Philippe SWARTVAGHER \u003cphil.swart@gmx.fr\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libcdio-cdda2@10.2+2.0.1-1", "libcdio19@2.1.0-4" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcdio_paranoia.so.2.0.0", "/usr/share/doc/libcdio-paranoia2/changelog.Debian.gz", "/usr/share/doc/libcdio-paranoia2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcdio19@2.1.0-4", "Name": "libcdio19", "Identifier": { "PURL": "pkg:deb/debian/libcdio19@2.1.0-4?arch=amd64\u0026distro=debian-12.15", "UID": "112e0e7d5a6dfb53" }, "Version": "2.1.0", "Release": "4", "Arch": "amd64", "SrcName": "libcdio", "SrcVersion": "2.1.0", "SrcRelease": "4", "Licenses": [ "GPL-3.0-only", "GPL-2+ with autoconf-macro exception", "GFDL-1.2-only", "GPL-2.0-only" ], "Maintainer": "Gabriel F. T. Gomes \u003cgabriel@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcdio.so.19.0.0", "/usr/share/doc/libcdio19/changelog.Debian.gz", "/usr/share/doc/libcdio19/changelog.gz", "/usr/share/doc/libcdio19/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libchromaprint1@1.5.1-2+b1", "Name": "libchromaprint1", "Identifier": { "PURL": "pkg:deb/debian/libchromaprint1@1.5.1-2%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "f7febf529ded7d35" }, "Version": "1.5.1", "Release": "2+b1", "Arch": "amd64", "SrcName": "chromaprint", "SrcVersion": "1.5.1", "SrcRelease": "2", "Licenses": [ "MIT", "BSD-3-Clause", "LGPL-2.1-or-later", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavcodec59@7:5.1.9-0+deb12u1", "libavutil57@7:5.1.9-0+deb12u1", "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libchromaprint.so.1.5.1", "/usr/share/doc/libchromaprint1/changelog.Debian.amd64.gz", "/usr/share/doc/libchromaprint1/changelog.Debian.gz", "/usr/share/doc/libchromaprint1/changelog.gz", "/usr/share/doc/libchromaprint1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcjson1@1.7.15-1+deb12u4", "Name": "libcjson1", "Identifier": { "PURL": "pkg:deb/debian/libcjson1@1.7.15-1%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "2964162759c39c15" }, "Version": "1.7.15", "Release": "1+deb12u4", "Arch": "amd64", "SrcName": "cjson", "SrcVersion": "1.7.15", "SrcRelease": "1+deb12u4", "Licenses": [ "MIT", "Apache-2.0" ], "Maintainer": "Boyuan Yang \u003cbyang@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcjson.so.1.7.15", "/usr/share/doc/libcjson1/changelog.Debian.gz", "/usr/share/doc/libcjson1/changelog.gz", "/usr/share/doc/libcjson1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcodec2-1.0@1.0.5-1", "Name": "libcodec2-1.0", "Identifier": { "PURL": "pkg:deb/debian/libcodec2-1.0@1.0.5-1?arch=amd64\u0026distro=debian-12.15", "UID": "2a651a0fb11acc28" }, "Version": "1.0.5", "Release": "1", "Arch": "amd64", "SrcName": "codec2", "SrcVersion": "1.0.5", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-only", "JMVBSD", "KISSFFTBSD" ], "Maintainer": "A. Maitland Bottoms \u003cbottoms@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libcodec2.so.1.0", "/usr/share/doc/libcodec2-1.0/changelog.Debian.gz", "/usr/share/doc/libcodec2-1.0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcom-err2@1.47.0-2+b2", "Name": "libcom-err2", "Identifier": { "PURL": "pkg:deb/debian/libcom-err2@1.47.0-2%2Bb2?arch=amd64\u0026distro=debian-12.15", "UID": "594a811db84333e5" }, "Version": "1.47.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.0", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.0-only", "BSD-3-Clause", "Apache-2.0", "ISC", "GPL-2.0-or-later", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libcom_err.so.2.1", "/usr/share/doc/libcom-err2/changelog.Debian.amd64.gz", "/usr/share/doc/libcom-err2/changelog.Debian.gz", "/usr/share/doc/libcom-err2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libcrypt1@1:4.4.33-2", "Name": "libcrypt1", "Identifier": { "PURL": "pkg:deb/debian/libcrypt1@4.4.33-2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "73fbe2e0b284aa14" }, "Version": "4.4.33", "Release": "2", "Epoch": 1, "Arch": "amd64", "SrcName": "libxcrypt", "SrcVersion": "4.4.33", "SrcRelease": "2", "SrcEpoch": 1, "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libcrypt.so.1.1.0", "/usr/share/doc/libcrypt1/changelog.Debian.gz", "/usr/share/doc/libcrypt1/changelog.gz", "/usr/share/doc/libcrypt1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdatrie1@0.2.13-2+b1", "Name": "libdatrie1", "Identifier": { "PURL": "pkg:deb/debian/libdatrie1@0.2.13-2%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "22b471526f3960c5" }, "Version": "0.2.13", "Release": "2+b1", "Arch": "amd64", "SrcName": "libdatrie", "SrcVersion": "0.2.13", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Theppitak Karoonboonyanan \u003cthep@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdatrie.so.1.4.0", "/usr/share/doc/libdatrie1/NEWS.gz", "/usr/share/doc/libdatrie1/README", "/usr/share/doc/libdatrie1/changelog.Debian.amd64.gz", "/usr/share/doc/libdatrie1/changelog.Debian.gz", "/usr/share/doc/libdatrie1/changelog.gz", "/usr/share/doc/libdatrie1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdav1d6@1.0.0-2+deb12u1", "Name": "libdav1d6", "Identifier": { "PURL": "pkg:deb/debian/libdav1d6@1.0.0-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "867667e06260a7da" }, "Version": "1.0.0", "Release": "2+deb12u1", "Arch": "amd64", "SrcName": "dav1d", "SrcVersion": "1.0.0", "SrcRelease": "2+deb12u1", "Licenses": [ "BSD-2-Clause", "public-domain", "ISC" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdav1d.so.6.6.0", "/usr/share/doc/libdav1d6/changelog.Debian.gz", "/usr/share/doc/libdav1d6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdb5.3@5.3.28+dfsg2-1", "Name": "libdb5.3", "Identifier": { "PURL": "pkg:deb/debian/libdb5.3@5.3.28%2Bdfsg2-1?arch=amd64\u0026distro=debian-12.15", "UID": "266a3c30ab7cc889" }, "Version": "5.3.28+dfsg2", "Release": "1", "Arch": "amd64", "SrcName": "db5.3", "SrcVersion": "5.3.28+dfsg2", "SrcRelease": "1", "Licenses": [ "Sleepycat", "BSD-3-Clause", "MS-PL", "GPL-2.0-or-later", "Artistic-2.0", "X11", "MIT-old", "TCL-like", "BSD-3-clause-fjord", "GPL-3.0-only", "Zlib" ], "Maintainer": "Bastian Germann \u003cbage@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdb-5.3.so", "/usr/share/doc/libdb5.3/build_signature_amd64.txt", "/usr/share/doc/libdb5.3/changelog.Debian.gz", "/usr/share/doc/libdb5.3/copyright", "/usr/share/lintian/overrides/libdb5.3" ], "AnalyzedBy": "dpkg" }, { "ID": "libdbus-1-3@1.14.10-1~deb12u1", "Name": "libdbus-1-3", "Identifier": { "PURL": "pkg:deb/debian/libdbus-1-3@1.14.10-1~deb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "218413ca8bc52096" }, "Version": "1.14.10", "Release": "1~deb12u1", "Arch": "amd64", "SrcName": "dbus", "SrcVersion": "1.14.10", "SrcRelease": "1~deb12u1", "Licenses": [ "GPL-2.0-or-later", "AFL-2.1", "MIT", "Tcl-BSDish", "BSD-3-Clause", "BSD-3-clause-generic", "autoconf-archive-permissive", "FSF-unlimited-permission", "GPL-2.0-with-autoconf-exception+", "LGPL-2.1-or-later", "g10-permissive", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Utopia Maintenance Team \u003cpkg-utopia-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libsystemd0@252.39-1~deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libdbus-1.so.3.32.4", "/usr/share/doc/libdbus-1-3/AUTHORS.gz", "/usr/share/doc/libdbus-1-3/NEWS.gz", "/usr/share/doc/libdbus-1-3/README.gz", "/usr/share/doc/libdbus-1-3/changelog.Debian.gz", "/usr/share/doc/libdbus-1-3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdc1394-25@2.2.6-4", "Name": "libdc1394-25", "Identifier": { "PURL": "pkg:deb/debian/libdc1394-25@2.2.6-4?arch=amd64\u0026distro=debian-12.15", "UID": "e09a07fe871c65b3" }, "Version": "2.2.6", "Release": "4", "Arch": "amd64", "SrcName": "libdc1394", "SrcVersion": "2.2.6", "SrcRelease": "4", "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libraw1394-11@2.1.2-2", "libusb-1.0-0@2:1.0.26-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdc1394.so.25.0.0", "/usr/share/doc/libdc1394-25/changelog.Debian.gz", "/usr/share/doc/libdc1394-25/changelog.gz", "/usr/share/doc/libdc1394-25/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdebconfclient0@0.270", "Name": "libdebconfclient0", "Identifier": { "PURL": "pkg:deb/debian/libdebconfclient0@0.270?arch=amd64\u0026distro=debian-12.15", "UID": "4fce62d658bacc56" }, "Version": "0.270", "Arch": "amd64", "SrcName": "cdebconf", "SrcVersion": "0.270", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Install System Team \u003cdebian-boot@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdebconfclient.so.0.0.0", "/usr/share/doc/libdebconfclient0/changelog.gz", "/usr/share/doc/libdebconfclient0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdecor-0-0@0.1.1-2", "Name": "libdecor-0-0", "Identifier": { "PURL": "pkg:deb/debian/libdecor-0-0@0.1.1-2?arch=amd64\u0026distro=debian-12.15", "UID": "63531efd9e7132e3" }, "Version": "0.1.1", "Release": "2", "Arch": "amd64", "SrcName": "libdecor-0", "SrcVersion": "0.1.1", "SrcRelease": "2", "Licenses": [ "MIT", "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian SDL packages maintainers \u003cpkg-sdl-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libwayland-client0@1.21.0-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdecor-0.so.0.100.1", "/usr/share/doc/libdecor-0-0/changelog.Debian.gz", "/usr/share/doc/libdecor-0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdeflate0@1.14-1", "Name": "libdeflate0", "Identifier": { "PURL": "pkg:deb/debian/libdeflate0@1.14-1?arch=amd64\u0026distro=debian-12.15", "UID": "133208a527a09f44" }, "Version": "1.14", "Release": "1", "Arch": "amd64", "SrcName": "libdeflate", "SrcVersion": "1.14", "SrcRelease": "1", "Licenses": [ "MIT" ], "Maintainer": "Debian Med Packaging Team \u003cdebian-med-packaging@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdeflate.so.0", "/usr/share/doc/libdeflate0/changelog.Debian.gz", "/usr/share/doc/libdeflate0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-amdgpu1@2.4.114-1+b1", "Name": "libdrm-amdgpu1", "Identifier": { "PURL": "pkg:deb/debian/libdrm-amdgpu1@2.4.114-1%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "88e7116b6f2cfc5d" }, "Version": "2.4.114", "Release": "1+b1", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.114", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm2@2.4.114-1+b1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm_amdgpu.so.1.0.0", "/usr/share/doc/libdrm-amdgpu1/changelog.Debian.amd64.gz", "/usr/share/doc/libdrm-amdgpu1/changelog.Debian.gz", "/usr/share/doc/libdrm-amdgpu1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-common@2.4.114-1", "Name": "libdrm-common", "Identifier": { "PURL": "pkg:deb/debian/libdrm-common@2.4.114-1?arch=all\u0026distro=debian-12.15", "UID": "440438aa50545fef" }, "Version": "2.4.114", "Release": "1", "Arch": "all", "SrcName": "libdrm", "SrcVersion": "2.4.114", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/libdrm-common/changelog.Debian.gz", "/usr/share/doc/libdrm-common/copyright", "/usr/share/libdrm/amdgpu.ids" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-intel1@2.4.114-1+b1", "Name": "libdrm-intel1", "Identifier": { "PURL": "pkg:deb/debian/libdrm-intel1@2.4.114-1%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "16ff089ee5e7b968" }, "Version": "2.4.114", "Release": "1+b1", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.114", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm2@2.4.114-1+b1", "libpciaccess0@0.17-2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm_intel.so.1.0.0", "/usr/share/doc/libdrm-intel1/changelog.Debian.amd64.gz", "/usr/share/doc/libdrm-intel1/changelog.Debian.gz", "/usr/share/doc/libdrm-intel1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-nouveau2@2.4.114-1+b1", "Name": "libdrm-nouveau2", "Identifier": { "PURL": "pkg:deb/debian/libdrm-nouveau2@2.4.114-1%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "9c2207377f42cd52" }, "Version": "2.4.114", "Release": "1+b1", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.114", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm2@2.4.114-1+b1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm_nouveau.so.2.0.0", "/usr/share/doc/libdrm-nouveau2/changelog.Debian.amd64.gz", "/usr/share/doc/libdrm-nouveau2/changelog.Debian.gz", "/usr/share/doc/libdrm-nouveau2/copyright", "/usr/share/lintian/overrides/libdrm-nouveau2" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm-radeon1@2.4.114-1+b1", "Name": "libdrm-radeon1", "Identifier": { "PURL": "pkg:deb/debian/libdrm-radeon1@2.4.114-1%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "e60f92df3e3f729e" }, "Version": "2.4.114", "Release": "1+b1", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.114", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm2@2.4.114-1+b1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm_radeon.so.1.0.1", "/usr/share/doc/libdrm-radeon1/changelog.Debian.amd64.gz", "/usr/share/doc/libdrm-radeon1/changelog.Debian.gz", "/usr/share/doc/libdrm-radeon1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libdrm2@2.4.114-1+b1", "Name": "libdrm2", "Identifier": { "PURL": "pkg:deb/debian/libdrm2@2.4.114-1%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "e5fe0785a03e2099" }, "Version": "2.4.114", "Release": "1+b1", "Arch": "amd64", "SrcName": "libdrm", "SrcVersion": "2.4.114", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm-common@2.4.114-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libdrm.so.2.4.0", "/usr/share/doc/libdrm2/NEWS.Debian.gz", "/usr/share/doc/libdrm2/changelog.Debian.amd64.gz", "/usr/share/doc/libdrm2/changelog.Debian.gz", "/usr/share/doc/libdrm2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libedit2@3.1-20221030-2", "Name": "libedit2", "Identifier": { "PURL": "pkg:deb/debian/libedit2@3.1-20221030-2?arch=amd64\u0026distro=debian-12.15", "UID": "1ec98cc071dd7b19" }, "Version": "3.1-20221030", "Release": "2", "Arch": "amd64", "SrcName": "libedit", "SrcVersion": "3.1-20221030", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "LLVM Packaging Team \u003cpkg-llvm-team@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbsd0@0.11.7-2", "libc6@2.36-9+deb12u14", "libtinfo6@6.4-4" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libedit.so.2.0.70", "/usr/share/doc/libedit2/TODO.Debian", "/usr/share/doc/libedit2/changelog.Debian.gz", "/usr/share/doc/libedit2/changelog.gz", "/usr/share/doc/libedit2/copyright", "/usr/share/lintian/overrides/libedit2", "/usr/share/man/man5/editrc.5edit.gz", "/usr/share/man/man7/editline.7edit.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libelf1@0.188-2.1", "Name": "libelf1", "Identifier": { "PURL": "pkg:deb/debian/libelf1@0.188-2.1?arch=amd64\u0026distro=debian-12.15", "UID": "c6c69bc70a4c3977" }, "Version": "0.188", "Release": "2.1", "Arch": "amd64", "SrcName": "elfutils", "SrcVersion": "0.188", "SrcRelease": "2.1", "Licenses": [ "GPL-3.0-or-later", "LGPL-3.0-or-later", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-3.0-only", "BSD-2-Clause", "GFDL-1.3-no-invariants-only", "GFDL-1.3-only", "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-3+ with Bison exception", "GPL-3.0-only" ], "Maintainer": "Debian Elfutils Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libelf-0.188.so", "/usr/share/doc/libelf1/changelog.Debian.gz", "/usr/share/doc/libelf1/changelog.gz", "/usr/share/doc/libelf1/copyright", "/usr/share/locale/de/LC_MESSAGES/elfutils.mo", "/usr/share/locale/en@boldquot/LC_MESSAGES/elfutils.mo", "/usr/share/locale/en@quot/LC_MESSAGES/elfutils.mo", "/usr/share/locale/es/LC_MESSAGES/elfutils.mo", "/usr/share/locale/ja/LC_MESSAGES/elfutils.mo", "/usr/share/locale/pl/LC_MESSAGES/elfutils.mo", "/usr/share/locale/uk/LC_MESSAGES/elfutils.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libepoxy0@1.5.10-1", "Name": "libepoxy0", "Identifier": { "PURL": "pkg:deb/debian/libepoxy0@1.5.10-1?arch=amd64\u0026distro=debian-12.15", "UID": "fc44dda5dc75737a" }, "Version": "1.5.10", "Release": "1", "Arch": "amd64", "SrcName": "libepoxy", "SrcVersion": "1.5.10", "SrcRelease": "1", "Licenses": [ "MIT" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libepoxy.so.0.0.0", "/usr/share/doc/libepoxy0/changelog.Debian.gz", "/usr/share/doc/libepoxy0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libexpat1@2.5.0-1+deb12u2", "Name": "libexpat1", "Identifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "Version": "2.5.0", "Release": "1+deb12u2", "Arch": "amd64", "SrcName": "expat", "SrcVersion": "2.5.0", "SrcRelease": "1+deb12u2", "Licenses": [ "MIT" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libexpat.so.1.8.10", "/usr/lib/x86_64-linux-gnu/libexpatw.so.1.8.10", "/usr/share/doc/libexpat1/AUTHORS", "/usr/share/doc/libexpat1/changelog.Debian.gz", "/usr/share/doc/libexpat1/changelog.gz", "/usr/share/doc/libexpat1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libext2fs2@1.47.0-2+b2", "Name": "libext2fs2", "Identifier": { "PURL": "pkg:deb/debian/libext2fs2@1.47.0-2%2Bb2?arch=amd64\u0026distro=debian-12.15", "UID": "eb8ca4e2d173bd30" }, "Version": "1.47.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.0", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.0-only", "BSD-3-Clause", "Apache-2.0", "ISC", "GPL-2.0-or-later", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libe2p.so.2.3", "/lib/x86_64-linux-gnu/libext2fs.so.2.4", "/usr/share/doc/libext2fs2/changelog.Debian.amd64.gz", "/usr/share/doc/libext2fs2/changelog.Debian.gz", "/usr/share/doc/libext2fs2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libffi8@3.4.4-1", "Name": "libffi8", "Identifier": { "PURL": "pkg:deb/debian/libffi8@3.4.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "6aa49bd0bc25466c" }, "Version": "3.4.4", "Release": "1", "Arch": "amd64", "SrcName": "libffi", "SrcVersion": "3.4.4", "SrcRelease": "1", "Licenses": [ "MIT", "X11", "GPL-2.0-or-later", "GPL-3.0-or-later", "MPL-1.1", "LGPL-2.1-or-later", "public-domain" ], "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libffi.so.8.1.2", "/usr/share/doc/libffi8/changelog.Debian.gz", "/usr/share/doc/libffi8/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libflac12@1.4.2+ds-2", "Name": "libflac12", "Identifier": { "PURL": "pkg:deb/debian/libflac12@1.4.2%2Bds-2?arch=amd64\u0026distro=debian-12.15", "UID": "922942209b3f4454" }, "Version": "1.4.2+ds", "Release": "2", "Arch": "amd64", "SrcName": "flac", "SrcVersion": "1.4.2+ds", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "GFDL-1.1-or-later", "GFDL-1.2-only", "BSD-3-Clause", "LGPL-2.0-or-later", "LGPL-2.0-only", "Public-domain", "ISC", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libogg0@1.3.5-3" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libFLAC.so.12.0.0", "/usr/share/doc/libflac12/changelog.Debian.gz", "/usr/share/doc/libflac12/changelog.gz", "/usr/share/doc/libflac12/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libflite1@2.2-5", "Name": "libflite1", "Identifier": { "PURL": "pkg:deb/debian/libflite1@2.2-5?arch=amd64\u0026distro=debian-12.15", "UID": "c4f7669fcccf3c3e" }, "Version": "2.2", "Release": "5", "Arch": "amd64", "SrcName": "flite", "SrcVersion": "2.2", "SrcRelease": "5", "Licenses": [ "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Accessibility Team \u003cpkg-a11y-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasound2@1.2.8-1+b1", "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libflite.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_grapheme_lang.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_grapheme_lex.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_indic_lang.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_indic_lex.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_time_awb.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_us_awb.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_us_kal.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_us_kal16.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_us_rms.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmu_us_slt.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_cmulex.so.2.2", "/usr/lib/x86_64-linux-gnu/libflite_usenglish.so.2.2", "/usr/share/doc/libflite1/changelog.Debian.gz", "/usr/share/doc/libflite1/copyright", "/usr/share/lintian/overrides/libflite1" ], "AnalyzedBy": "dpkg" }, { "ID": "libfontconfig1@2.14.1-4", "Name": "libfontconfig1", "Identifier": { "PURL": "pkg:deb/debian/libfontconfig1@2.14.1-4?arch=amd64\u0026distro=debian-12.15", "UID": "bd5bdac3609c31ad" }, "Version": "2.14.1", "Release": "4", "Arch": "amd64", "SrcName": "fontconfig", "SrcVersion": "2.14.1", "SrcRelease": "4", "Maintainer": "Debian freedesktop.org maintainers \u003cpkg-freedesktop-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "fontconfig-config@2.14.1-4", "libc6@2.36-9+deb12u14", "libexpat1@2.5.0-1+deb12u2", "libfreetype6@2.12.1+dfsg-5+deb12u4" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libfontconfig.so.1.12.0", "/usr/share/doc/libfontconfig1/changelog.Debian.gz", "/usr/share/doc/libfontconfig1/changelog.gz", "/usr/share/doc/libfontconfig1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libfreetype6@2.12.1+dfsg-5+deb12u4", "Name": "libfreetype6", "Identifier": { "PURL": "pkg:deb/debian/libfreetype6@2.12.1%2Bdfsg-5%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "3f62f38bf3cee23d" }, "Version": "2.12.1+dfsg", "Release": "5+deb12u4", "Arch": "amd64", "SrcName": "freetype", "SrcVersion": "2.12.1+dfsg", "SrcRelease": "5+deb12u4", "Licenses": [ "FTL", "MIT", "BSD-3-Clause", "FSFAP", "GPL-3.0-or-later", "GPL-2.0-or-later", "Public-Domain", "BSL-1.0", "Zlib", "OpenGroup-BSD-like", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Hugh McMaster \u003chugh.mcmaster@outlook.com\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbrotli1@1.0.9-2+b6", "libc6@2.36-9+deb12u14", "libpng16-16@1.6.39-2+deb12u5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libfreetype.so.6.18.3", "/usr/share/doc/libfreetype6/README", "/usr/share/doc/libfreetype6/changelog.Debian.gz", "/usr/share/doc/libfreetype6/changelog.gz", "/usr/share/doc/libfreetype6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libfribidi0@1.0.8-2.1", "Name": "libfribidi0", "Identifier": { "PURL": "pkg:deb/debian/libfribidi0@1.0.8-2.1?arch=amd64\u0026distro=debian-12.15", "UID": "8a0454d7e3e77f7a" }, "Version": "1.0.8", "Release": "2.1", "Arch": "amd64", "SrcName": "fribidi", "SrcVersion": "1.0.8", "SrcRelease": "2.1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only" ], "Maintainer": "Debian Hebrew Packaging Team \u003cteam+hebrew@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libfribidi.so.0.4.0", "/usr/share/doc/libfribidi0/NEWS.gz", "/usr/share/doc/libfribidi0/README", "/usr/share/doc/libfribidi0/THANKS", "/usr/share/doc/libfribidi0/TODO", "/usr/share/doc/libfribidi0/changelog.Debian.gz", "/usr/share/doc/libfribidi0/changelog.gz", "/usr/share/doc/libfribidi0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgbm1@22.3.6-1+deb12u2", "Name": "libgbm1", "Identifier": { "PURL": "pkg:deb/debian/libgbm1@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "c308bc0f36020bca" }, "Version": "22.3.6", "Release": "1+deb12u2", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "22.3.6", "SrcRelease": "1+deb12u2", "Licenses": [ "MIT", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm2@2.4.114-1+b1", "libexpat1@2.5.0-1+deb12u2", "libwayland-server0@1.21.0-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgbm.so.1.0.0", "/usr/share/bug/libgbm1/control", "/usr/share/bug/libgbm1/script", "/usr/share/doc/libgbm1/changelog.Debian.gz", "/usr/share/doc/libgbm1/changelog.gz", "/usr/share/doc/libgbm1/copyright", "/usr/share/lintian/overrides/libgbm1" ], "AnalyzedBy": "dpkg" }, { "ID": "libgcc-s1@12.2.0-14+deb12u1", "Name": "libgcc-s1", "Identifier": { "PURL": "pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "30dd46e15657e503" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libgcc_s.so.1", "/usr/share/lintian/overrides/libgcc-s1" ], "AnalyzedBy": "dpkg" }, { "ID": "libgcrypt20@1.10.1-3+deb12u1", "Name": "libgcrypt20", "Identifier": { "PURL": "pkg:deb/debian/libgcrypt20@1.10.1-3%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "fa3462de6167db33" }, "Version": "1.10.1", "Release": "3+deb12u1", "Arch": "amd64", "SrcName": "libgcrypt20", "SrcVersion": "1.10.1", "SrcRelease": "3+deb12u1", "Licenses": [ "LGPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgpg-error0@1.46-1" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.4.1", "/usr/share/doc/libgcrypt20/AUTHORS.gz", "/usr/share/doc/libgcrypt20/NEWS.gz", "/usr/share/doc/libgcrypt20/README.gz", "/usr/share/doc/libgcrypt20/THANKS.gz", "/usr/share/doc/libgcrypt20/changelog.Debian.gz", "/usr/share/doc/libgcrypt20/changelog.gz", "/usr/share/doc/libgcrypt20/copyright", "/usr/share/libgcrypt20/clean-up-unmanaged-libraries" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdbm-compat4@1.23-3", "Name": "libgdbm-compat4", "Identifier": { "PURL": "pkg:deb/debian/libgdbm-compat4@1.23-3?arch=amd64\u0026distro=debian-12.15", "UID": "c42fecd4e0189d90" }, "Version": "1.23", "Release": "3", "Arch": "amd64", "SrcName": "gdbm", "SrcVersion": "1.23", "SrcRelease": "3", "Licenses": [ "GPL-3.0-or-later", "GPL-2.0-or-later", "GFDL-1.3-no-invariants-or-later", "GPL-3.0-only", "GPL-2.0-only" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgdbm6@1.23-3" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgdbm_compat.so.4.0.0", "/usr/share/doc/libgdbm-compat4/changelog.Debian.gz", "/usr/share/doc/libgdbm-compat4/changelog.gz", "/usr/share/doc/libgdbm-compat4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdbm6@1.23-3", "Name": "libgdbm6", "Identifier": { "PURL": "pkg:deb/debian/libgdbm6@1.23-3?arch=amd64\u0026distro=debian-12.15", "UID": "3830ff1f557eaf52" }, "Version": "1.23", "Release": "3", "Arch": "amd64", "SrcName": "gdbm", "SrcVersion": "1.23", "SrcRelease": "3", "Licenses": [ "GPL-3.0-or-later", "GPL-2.0-or-later", "GFDL-1.3-no-invariants-or-later", "GPL-3.0-only", "GPL-2.0-only" ], "Maintainer": "Nicolas Mora \u003cbabelouest@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgdbm.so.6.0.0", "/usr/share/doc/libgdbm6/changelog.Debian.gz", "/usr/share/doc/libgdbm6/changelog.gz", "/usr/share/doc/libgdbm6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdk-pixbuf-2.0-0@2.42.10+dfsg-1+deb12u4", "Name": "libgdk-pixbuf-2.0-0", "Identifier": { "PURL": "pkg:deb/debian/libgdk-pixbuf-2.0-0@2.42.10%2Bdfsg-1%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "ce52b0ee879274d5" }, "Version": "2.42.10+dfsg", "Release": "1+deb12u4", "Arch": "amd64", "SrcName": "gdk-pixbuf", "SrcVersion": "2.42.10+dfsg", "SrcRelease": "1+deb12u4", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "CC0-1.0", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgdk-pixbuf2.0-common@2.42.10+dfsg-1+deb12u4", "libglib2.0-0@2.74.6-2+deb12u9", "libjpeg62-turbo@1:2.1.5-2", "libpng16-16@1.6.39-2+deb12u5", "libtiff6@4.5.0-6+deb12u4", "shared-mime-info@2.2-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-ani.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-bmp.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-gif.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-icns.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-ico.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-pnm.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-qtif.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-tga.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-tiff.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-xbm.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-xpm.so", "/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders", "/usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4200.10", "/usr/share/doc/libgdk-pixbuf-2.0-0/NEWS.gz", "/usr/share/doc/libgdk-pixbuf-2.0-0/README.md", "/usr/share/doc/libgdk-pixbuf-2.0-0/changelog.Debian.gz", "/usr/share/doc/libgdk-pixbuf-2.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgdk-pixbuf2.0-common@2.42.10+dfsg-1+deb12u4", "Name": "libgdk-pixbuf2.0-common", "Identifier": { "PURL": "pkg:deb/debian/libgdk-pixbuf2.0-common@2.42.10%2Bdfsg-1%2Bdeb12u4?arch=all\u0026distro=debian-12.15", "UID": "b882baa913ba958a" }, "Version": "2.42.10+dfsg", "Release": "1+deb12u4", "Arch": "all", "SrcName": "gdk-pixbuf", "SrcVersion": "2.42.10+dfsg", "SrcRelease": "1+deb12u4", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "CC0-1.0", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/libgdk-pixbuf2.0-common/changelog.Debian.gz", "/usr/share/doc/libgdk-pixbuf2.0-common/copyright", "/usr/share/locale/ab/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/af/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ang/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ar/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/as/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ast/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/az/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/be/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/be@latin/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/bg/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/bn/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/bn_IN/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/br/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/bs/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ca/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ca@valencia/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/crh/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/cs/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/csb/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/cy/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/da/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/de/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/dz/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/el/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/en@shaw/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/en_CA/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/en_GB/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/eo/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/es/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/et/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/eu/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/fa/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/fi/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/fr/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/fur/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ga/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/gl/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/gu/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/he/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/hi/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/hr/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/hu/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/hy/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ia/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/id/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/io/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/is/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/it/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ja/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ka/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/kk/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/km/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/kn/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ko/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ku/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/li/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/lt/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/lv/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/mai/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/mi/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/mk/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ml/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/mn/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/mr/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ms/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/my/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/nb/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/nds/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ne/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/nl/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/nn/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/nso/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/oc/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/or/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/pa/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/pl/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ps/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/pt/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ro/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ru/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/si/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sk/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sl/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sq/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sr/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sr@ije/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sr@latin/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/sv/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ta/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/te/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/tg/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/th/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/tk/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/tr/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/tt/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/ug/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/uk/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/uz/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/uz@cyrillic/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/vi/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/wa/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/xh/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/yi/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/zh_HK/LC_MESSAGES/gdk-pixbuf.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/gdk-pixbuf.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libgfortran5@12.2.0-14+deb12u1", "Name": "libgfortran5", "Identifier": { "PURL": "pkg:deb/debian/libgfortran5@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "bedb900bb555afac" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libquadmath0@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgfortran.so.5.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libgl1@1.6.0-1", "Name": "libgl1", "Identifier": { "PURL": "pkg:deb/debian/libgl1@1.6.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "98aca896a70687f2" }, "Version": "1.6.0", "Release": "1", "Arch": "amd64", "SrcName": "libglvnd", "SrcVersion": "1.6.0", "SrcRelease": "1", "Licenses": [ "MIT", "Apache-2.0", "public-domain", "GPL-3.0-or-later", "BSD-1-Clause", "GPL-2.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libglvnd0@1.6.0-1", "libglx0@1.6.0-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libGL.so.1.7.0", "/usr/share/bug/libgl1/control", "/usr/share/doc/libgl1/changelog.Debian.gz", "/usr/share/doc/libgl1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgl1-mesa-dri@22.3.6-1+deb12u2", "Name": "libgl1-mesa-dri", "Identifier": { "PURL": "pkg:deb/debian/libgl1-mesa-dri@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "edc9e2d43b47100b" }, "Version": "22.3.6", "Release": "1+deb12u2", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "22.3.6", "SrcRelease": "1+deb12u2", "Licenses": [ "MIT", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm-amdgpu1@2.4.114-1+b1", "libdrm-intel1@2.4.114-1+b1", "libdrm-nouveau2@2.4.114-1+b1", "libdrm-radeon1@2.4.114-1+b1", "libdrm2@2.4.114-1+b1", "libelf1@0.188-2.1", "libexpat1@2.5.0-1+deb12u2", "libgcc-s1@12.2.0-14+deb12u1", "libglapi-mesa@22.3.6-1+deb12u2", "libllvm15@1:15.0.6-4+b1", "libsensors5@1:3.6.0-7.1", "libstdc++6@12.2.0-14+deb12u1", "libxcb-dri3-0@1.15-1", "libzstd1@1.5.4+dfsg2-5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/dri/crocus_dri.so", "/usr/lib/x86_64-linux-gnu/dri/d3d12_dri.so", "/usr/lib/x86_64-linux-gnu/dri/i915_dri.so", "/usr/lib/x86_64-linux-gnu/dri/iris_dri.so", "/usr/lib/x86_64-linux-gnu/dri/kms_swrast_dri.so", "/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so", "/usr/lib/x86_64-linux-gnu/dri/r300_dri.so", "/usr/lib/x86_64-linux-gnu/dri/r600_dri.so", "/usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so", "/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so", "/usr/lib/x86_64-linux-gnu/dri/virtio_gpu_dri.so", "/usr/lib/x86_64-linux-gnu/dri/vmwgfx_dri.so", "/usr/lib/x86_64-linux-gnu/dri/zink_dri.so", "/usr/share/bug/libgl1-mesa-dri/control", "/usr/share/bug/libgl1-mesa-dri/script", "/usr/share/doc/libgl1-mesa-dri/changelog.Debian.gz", "/usr/share/doc/libgl1-mesa-dri/changelog.gz", "/usr/share/doc/libgl1-mesa-dri/copyright", "/usr/share/drirc.d/00-mesa-defaults.conf" ], "AnalyzedBy": "dpkg" }, { "ID": "libglapi-mesa@22.3.6-1+deb12u2", "Name": "libglapi-mesa", "Identifier": { "PURL": "pkg:deb/debian/libglapi-mesa@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "231877390a5a63c1" }, "Version": "22.3.6", "Release": "1+deb12u2", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "22.3.6", "SrcRelease": "1+deb12u2", "Licenses": [ "MIT", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libglapi.so.0.0.0", "/usr/share/bug/libglapi-mesa/control", "/usr/share/bug/libglapi-mesa/script", "/usr/share/doc/libglapi-mesa/changelog.Debian.gz", "/usr/share/doc/libglapi-mesa/changelog.gz", "/usr/share/doc/libglapi-mesa/copyright", "/usr/share/lintian/overrides/libglapi-mesa" ], "AnalyzedBy": "dpkg" }, { "ID": "libglib2.0-0@2.74.6-2+deb12u9", "Name": "libglib2.0-0", "Identifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u9?arch=amd64\u0026distro=debian-12.15", "UID": "992130747c8c4933" }, "Version": "2.74.6", "Release": "2+deb12u9", "Arch": "amd64", "SrcName": "glib2.0", "SrcVersion": "2.74.6", "SrcRelease": "2+deb12u9", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "FSFULLR", "CC0-1.0", "Janik-permissive", "Iconv-PD", "Mingw-PD", "Old-GLib-Tests-permissive", "MIT", "AFL-2.0", "Unicode-DFS-2016", "GPL-2.0-or-later", "GPL-2.0-with-autoconf-exception+", "LGPL-3.0-or-later", "Apache-2.0 with LLVM exception", "Kuchling-PD", "Plumb-PD", "BSD-3-clause-pcre", "bzip2-1.0.6", "CC-BY-SA-3.0", "Apache-2.0", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libffi8@3.4.4-1", "libmount1@2.38.1-5+deb12u3", "libpcre2-8-0@10.42-1", "libselinux1@3.4-1+b6", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/glib-2.0/gio-launch-desktop", "/usr/lib/x86_64-linux-gnu/glib-2.0/gio-querymodules", "/usr/lib/x86_64-linux-gnu/glib-2.0/glib-compile-schemas", "/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0.7400.6", "/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6", "/usr/lib/x86_64-linux-gnu/libgmodule-2.0.so.0.7400.6", "/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.7400.6", "/usr/lib/x86_64-linux-gnu/libgthread-2.0.so.0.7400.6", "/usr/share/doc/libglib2.0-0/NEWS.gz", "/usr/share/doc/libglib2.0-0/README.md", "/usr/share/doc/libglib2.0-0/changelog.Debian.gz", "/usr/share/doc/libglib2.0-0/copyright", "/usr/share/lintian/overrides/libglib2.0-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libglvnd0@1.6.0-1", "Name": "libglvnd0", "Identifier": { "PURL": "pkg:deb/debian/libglvnd0@1.6.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "6bba2663dee41b12" }, "Version": "1.6.0", "Release": "1", "Arch": "amd64", "SrcName": "libglvnd", "SrcVersion": "1.6.0", "SrcRelease": "1", "Licenses": [ "MIT", "Apache-2.0", "public-domain", "GPL-3.0-or-later", "BSD-1-Clause", "GPL-2.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libGLdispatch.so.0.0.0", "/usr/share/bug/libglvnd0/control", "/usr/share/doc/libglvnd0/changelog.Debian.gz", "/usr/share/doc/libglvnd0/copyright", "/usr/share/lintian/overrides/libglvnd0" ], "AnalyzedBy": "dpkg" }, { "ID": "libglx-mesa0@22.3.6-1+deb12u2", "Name": "libglx-mesa0", "Identifier": { "PURL": "pkg:deb/debian/libglx-mesa0@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "2da6ad3db758cde9" }, "Version": "22.3.6", "Release": "1+deb12u2", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "22.3.6", "SrcRelease": "1+deb12u2", "Licenses": [ "MIT", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm2@2.4.114-1+b1", "libexpat1@2.5.0-1+deb12u2", "libgl1-mesa-dri@22.3.6-1+deb12u2", "libglapi-mesa@22.3.6-1+deb12u2", "libx11-6@2:1.8.4-2+deb12u2", "libx11-xcb1@2:1.8.4-2+deb12u2", "libxcb-dri2-0@1.15-1", "libxcb-dri3-0@1.15-1", "libxcb-glx0@1.15-1", "libxcb-present0@1.15-1", "libxcb-randr0@1.15-1", "libxcb-shm0@1.15-1", "libxcb-sync1@1.15-1", "libxcb-xfixes0@1.15-1", "libxcb1@1.15-1", "libxext6@2:1.3.4-1+b1", "libxfixes3@1:6.0.0-2", "libxshmfence1@1.3-1", "libxxf86vm1@1:1.1.4-1+b2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libGLX_mesa.so.0.0.0", "/usr/share/bug/libglx-mesa0/control", "/usr/share/bug/libglx-mesa0/script", "/usr/share/doc/libglx-mesa0/changelog.Debian.gz", "/usr/share/doc/libglx-mesa0/changelog.gz", "/usr/share/doc/libglx-mesa0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libglx0@1.6.0-1", "Name": "libglx0", "Identifier": { "PURL": "pkg:deb/debian/libglx0@1.6.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "cf0b062eed3b8a98" }, "Version": "1.6.0", "Release": "1", "Arch": "amd64", "SrcName": "libglvnd", "SrcVersion": "1.6.0", "SrcRelease": "1", "Licenses": [ "MIT", "Apache-2.0", "public-domain", "GPL-3.0-or-later", "BSD-1-Clause", "GPL-2.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libglvnd0@1.6.0-1", "libglx-mesa0@22.3.6-1+deb12u2", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libGLX.so.0.0.0", "/usr/share/bug/libglx0/control", "/usr/share/doc/libglx0/changelog.Debian.gz", "/usr/share/doc/libglx0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgme0@0.6.3-6", "Name": "libgme0", "Identifier": { "PURL": "pkg:deb/debian/libgme0@0.6.3-6?arch=amd64\u0026distro=debian-12.15", "UID": "40b97d8dd1c2fa58" }, "Version": "0.6.3", "Release": "6", "Arch": "amd64", "SrcName": "game-music-emu", "SrcVersion": "0.6.3", "SrcRelease": "6", "Licenses": [ "LGPL-2.1-or-later", "MIT", "LGPL-2.1-only" ], "Maintainer": "Ileana Dumitrescu \u003cileanadumitrescu95@gmail.com\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgme.so.0.6.3", "/usr/share/doc/libgme0/changelog.Debian.gz", "/usr/share/doc/libgme0/changelog.gz", "/usr/share/doc/libgme0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgmp10@2:6.2.1+dfsg1-1.1", "Name": "libgmp10", "Identifier": { "PURL": "pkg:deb/debian/libgmp10@6.2.1%2Bdfsg1-1.1?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "c266356721669ceb" }, "Version": "6.2.1+dfsg1", "Release": "1.1", "Epoch": 2, "Arch": "amd64", "SrcName": "gmp", "SrcVersion": "6.2.1+dfsg1", "SrcRelease": "1.1", "SrcEpoch": 2, "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later", "GPL-3.0-or-later", "GPL-3+ with Bison exception", "GPL-2.0-only", "GPL-3.0-only", "LGPL-3.0-only" ], "Maintainer": "Debian Science Team \u003cdebian-science-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgmp.so.10.4.1", "/usr/share/doc/libgmp10/README.Debian", "/usr/share/doc/libgmp10/changelog.Debian.gz", "/usr/share/doc/libgmp10/changelog.gz", "/usr/share/doc/libgmp10/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgnutls30@3.7.9-2+deb12u7", "Name": "libgnutls30", "Identifier": { "PURL": "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u7?arch=amd64\u0026distro=debian-12.15", "UID": "1825cdc4e3258ffb" }, "Version": "3.7.9", "Release": "2+deb12u7", "Arch": "amd64", "SrcName": "gnutls28", "SrcVersion": "3.7.9", "SrcRelease": "2+deb12u7", "Licenses": [ "LGPL-2.1-only", "LGPL-2.0-or-later", "LGPL-3.0-only", "GPL-2.0-or-later", "GPL-3.0-only", "GFDL-1.3-only", "CC0-1.0", "MIT", "Apache-2.0", "LGPL-3.0-or-later", "LGPL-2.1-or-later", "GPL-3.0-or-later", "BSD-3-Clause" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgmp10@2:6.2.1+dfsg1-1.1", "libhogweed6@3.8.1-2", "libidn2-0@2.3.3-1+b1", "libnettle8@3.8.1-2", "libp11-kit0@0.24.1-2", "libtasn1-6@4.19.0-2+deb12u1", "libunistring2@1.0-2" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgnutls.so.30.34.3", "/usr/share/doc/libgnutls30/AUTHORS.gz", "/usr/share/doc/libgnutls30/NEWS.Debian.gz", "/usr/share/doc/libgnutls30/NEWS.gz", "/usr/share/doc/libgnutls30/README.md.gz", "/usr/share/doc/libgnutls30/THANKS.gz", "/usr/share/doc/libgnutls30/changelog.Debian.gz", "/usr/share/doc/libgnutls30/changelog.gz", "/usr/share/doc/libgnutls30/copyright", "/usr/share/locale/cs/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/de/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/eo/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/es/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/fi/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/fr/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/it/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ka/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ms/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/nl/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/pl/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/ro/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/sr/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/sv/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/uk/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/vi/LC_MESSAGES/gnutls30.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/gnutls30.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libgomp1@12.2.0-14+deb12u1", "Name": "libgomp1", "Identifier": { "PURL": "pkg:deb/debian/libgomp1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "ab9f3376b6eee575" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgomp.so.1.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "libgpg-error0@1.46-1", "Name": "libgpg-error0", "Identifier": { "PURL": "pkg:deb/debian/libgpg-error0@1.46-1?arch=amd64\u0026distro=debian-12.15", "UID": "87a36dd3f556a5a4" }, "Version": "1.46", "Release": "1", "Arch": "amd64", "SrcName": "libgpg-error", "SrcVersion": "1.46", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "BSD-3-Clause", "g10-permissive", "GPL-3.0-or-later", "LGPL-2.1-only", "GPL-3.0-only" ], "Maintainer": "Debian GnuPG Maintainers \u003cpkg-gnupg-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libgpg-error.so.0.33.1", "/usr/share/doc/libgpg-error0/README.gz", "/usr/share/doc/libgpg-error0/changelog.Debian.gz", "/usr/share/doc/libgpg-error0/changelog.gz", "/usr/share/doc/libgpg-error0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgraphite2-3@1.3.14-1+deb12u1", "Name": "libgraphite2-3", "Identifier": { "PURL": "pkg:deb/debian/libgraphite2-3@1.3.14-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "e98615518cd38469" }, "Version": "1.3.14", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "graphite2", "SrcVersion": "1.3.14", "SrcRelease": "1+deb12u1", "Licenses": [ "LGPL-2.1-or-later", "MPL-1.1", "GPL-2.0-or-later", "public-domain", "Artistic-2.0", "GPL-1.0-or-later", "custom-sil-open-font-license", "GPL-1.0-only", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian LibreOffice Maintainers \u003cdebian-openoffice@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgraphite2.so.3.2.1", "/usr/share/doc/libgraphite2-3/changelog.Debian.gz", "/usr/share/doc/libgraphite2-3/changelog.gz", "/usr/share/doc/libgraphite2-3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgsm1@1.0.22-1", "Name": "libgsm1", "Identifier": { "PURL": "pkg:deb/debian/libgsm1@1.0.22-1?arch=amd64\u0026distro=debian-12.15", "UID": "7a6e987e808ec51" }, "Version": "1.0.22", "Release": "1", "Arch": "amd64", "SrcName": "libgsm", "SrcVersion": "1.0.22", "SrcRelease": "1", "Licenses": [ "TU-Berlin-2.0" ], "Maintainer": "Debian Mobcom Maintainers \u003cDebian-mobcom-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgsm.so.1.0.19", "/usr/share/doc/libgsm1/MACHINES", "/usr/share/doc/libgsm1/README", "/usr/share/doc/libgsm1/README.Debian", "/usr/share/doc/libgsm1/changelog.Debian.gz", "/usr/share/doc/libgsm1/changelog.gz", "/usr/share/doc/libgsm1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libgssapi-krb5-2@1.20.1-2+deb12u5", "Name": "libgssapi-krb5-2", "Identifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "cef581a5d8a0ac0f" }, "Version": "1.20.1", "Release": "2+deb12u5", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.20.1", "SrcRelease": "2+deb12u5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libcom-err2@1.47.0-2+b2", "libk5crypto3@1.20.1-2+deb12u5", "libkrb5-3@1.20.1-2+deb12u5", "libkrb5support0@1.20.1-2+deb12u5" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2", "/usr/share/doc/libgssapi-krb5-2/changelog.Debian.gz", "/usr/share/doc/libgssapi-krb5-2/copyright", "/usr/share/lintian/overrides/libgssapi-krb5-2" ], "AnalyzedBy": "dpkg" }, { "ID": "libharfbuzz0b@6.0.0+dfsg-3", "Name": "libharfbuzz0b", "Identifier": { "PURL": "pkg:deb/debian/libharfbuzz0b@6.0.0%2Bdfsg-3?arch=amd64\u0026distro=debian-12.15", "UID": "da6f84dd706514a0" }, "Version": "6.0.0+dfsg", "Release": "3", "Arch": "amd64", "SrcName": "harfbuzz", "SrcVersion": "6.0.0+dfsg", "SrcRelease": "3", "Licenses": [ "MIT", "Unicode", "ISC", "Apache-2.0", "OFL-1.1", "Monotype", "CC0-1.0", "GPL-3.0-or-later", "GPL-2+ with Font exception", "UFL-1.0", "FSFULLR", "GPL-2.0-with-autoconf-exception+", "GPL-3.0-with-autoconf-exception+", "FSFAP", "LGPL-2.1-or-later", "GPL-2+ with LibTool exception", "FSFUL", "GPL-2.0-only", "GPL-3.0-only", "LGPL-2.1-only" ], "Maintainer": "أحمد المحمودي (Ahmed El-Mahmoudy) \u003caelmahmoudy@users.sourceforge.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libfreetype6@2.12.1+dfsg-5+deb12u4", "libglib2.0-0@2.74.6-2+deb12u9", "libgraphite2-3@1.3.14-1+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0.60000.0", "/usr/share/doc/libharfbuzz0b/changelog.Debian.gz", "/usr/share/doc/libharfbuzz0b/changelog.gz", "/usr/share/doc/libharfbuzz0b/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libhogweed6@3.8.1-2", "Name": "libhogweed6", "Identifier": { "PURL": "pkg:deb/debian/libhogweed6@3.8.1-2?arch=amd64\u0026distro=debian-12.15", "UID": "24f3ef2a444c7bb0" }, "Version": "3.8.1", "Release": "2", "Arch": "amd64", "SrcName": "nettle", "SrcVersion": "3.8.1", "SrcRelease": "2", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "MIT", "GPL-3.0-or-later", "GPL-3.0-with-autoconf-exception+", "public-domain", "GPL-2.0-only", "GAP" ], "Maintainer": "Magnus Holmgren \u003cholmgren@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgmp10@2:6.2.1+dfsg1-1.1", "libnettle8@3.8.1-2" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhogweed.so.6.6", "/usr/share/doc/libhogweed6/changelog.Debian.gz", "/usr/share/doc/libhogweed6/changelog.gz", "/usr/share/doc/libhogweed6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libhwy1@1.0.3-3+deb12u1", "Name": "libhwy1", "Identifier": { "PURL": "pkg:deb/debian/libhwy1@1.0.3-3%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "6d4f58310a8eb9f" }, "Version": "1.0.3", "Release": "3+deb12u1", "Arch": "amd64", "SrcName": "highway", "SrcVersion": "1.0.3", "SrcRelease": "3+deb12u1", "Licenses": [ "Apache-2.0" ], "Maintainer": "Debian PhotoTools Maintainers \u003cpkg-phototools-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libhwy.so.1.0.3", "/usr/lib/x86_64-linux-gnu/libhwy_contrib.so.1.0.3", "/usr/lib/x86_64-linux-gnu/libhwy_test.so.1.0.3", "/usr/share/doc/libhwy1/changelog.Debian.gz", "/usr/share/doc/libhwy1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libicu72@72.1-3+deb12u1", "Name": "libicu72", "Identifier": { "PURL": "pkg:deb/debian/libicu72@72.1-3%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "8499b86fa54f986" }, "Version": "72.1", "Release": "3+deb12u1", "Arch": "amd64", "SrcName": "icu", "SrcVersion": "72.1", "SrcRelease": "3+deb12u1", "Licenses": [ "MIT", "GPL-3.0-only" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libicudata.so.72.1", "/usr/lib/x86_64-linux-gnu/libicui18n.so.72.1", "/usr/lib/x86_64-linux-gnu/libicuio.so.72.1", "/usr/lib/x86_64-linux-gnu/libicutest.so.72.1", "/usr/lib/x86_64-linux-gnu/libicutu.so.72.1", "/usr/lib/x86_64-linux-gnu/libicuuc.so.72.1", "/usr/share/doc/libicu72/changelog.Debian.gz", "/usr/share/doc/libicu72/copyright", "/usr/share/lintian/overrides/libicu72" ], "AnalyzedBy": "dpkg" }, { "ID": "libidn2-0@2.3.3-1+b1", "Name": "libidn2-0", "Identifier": { "PURL": "pkg:deb/debian/libidn2-0@2.3.3-1%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "45ac5e890c6624db" }, "Version": "2.3.3", "Release": "1+b1", "Arch": "amd64", "SrcName": "libidn2", "SrcVersion": "2.3.3", "SrcRelease": "1", "Licenses": [ "GPL-3.0-or-later", "LGPL-3.0-or-later", "GPL-2.0-or-later", "Unicode", "GPL-3.0-only", "GPL-2.0-only", "LGPL-3.0-only" ], "Maintainer": "Debian Libidn team \u003chelp-libidn@gnu.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libunistring2@1.0-2" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.8", "/usr/share/doc/libidn2-0/AUTHORS", "/usr/share/doc/libidn2-0/NEWS.gz", "/usr/share/doc/libidn2-0/README.md.gz", "/usr/share/doc/libidn2-0/changelog.Debian.amd64.gz", "/usr/share/doc/libidn2-0/changelog.Debian.gz", "/usr/share/doc/libidn2-0/changelog.gz", "/usr/share/doc/libidn2-0/copyright", "/usr/share/lintian/overrides/libidn2-0", "/usr/share/locale/cs/LC_MESSAGES/libidn2.mo", "/usr/share/locale/da/LC_MESSAGES/libidn2.mo", "/usr/share/locale/de/LC_MESSAGES/libidn2.mo", "/usr/share/locale/eo/LC_MESSAGES/libidn2.mo", "/usr/share/locale/es/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fi/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/fur/LC_MESSAGES/libidn2.mo", "/usr/share/locale/hr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/hu/LC_MESSAGES/libidn2.mo", "/usr/share/locale/id/LC_MESSAGES/libidn2.mo", "/usr/share/locale/it/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ja/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ka/LC_MESSAGES/libidn2.mo", "/usr/share/locale/nl/LC_MESSAGES/libidn2.mo", "/usr/share/locale/pl/LC_MESSAGES/libidn2.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ro/LC_MESSAGES/libidn2.mo", "/usr/share/locale/ru/LC_MESSAGES/libidn2.mo", "/usr/share/locale/sr/LC_MESSAGES/libidn2.mo", "/usr/share/locale/sv/LC_MESSAGES/libidn2.mo", "/usr/share/locale/uk/LC_MESSAGES/libidn2.mo", "/usr/share/locale/vi/LC_MESSAGES/libidn2.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/libidn2.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libiec61883-0@1.2.0-6+b1", "Name": "libiec61883-0", "Identifier": { "PURL": "pkg:deb/debian/libiec61883-0@1.2.0-6%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "19921756556a99f1" }, "Version": "1.2.0", "Release": "6+b1", "Arch": "amd64", "SrcName": "libiec61883", "SrcVersion": "1.2.0", "SrcRelease": "6", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Debian QA Group \u003cpackages@qa.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libraw1394-11@2.1.2-2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libiec61883.so.0.1.1", "/usr/share/doc/libiec61883-0/NEWS.gz", "/usr/share/doc/libiec61883-0/README", "/usr/share/doc/libiec61883-0/changelog.Debian.amd64.gz", "/usr/share/doc/libiec61883-0/changelog.Debian.gz", "/usr/share/doc/libiec61883-0/changelog.gz", "/usr/share/doc/libiec61883-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libigdgmm12@22.3.3+ds1-1", "Name": "libigdgmm12", "Identifier": { "PURL": "pkg:deb/debian/libigdgmm12@22.3.3%2Bds1-1?arch=amd64\u0026distro=debian-12.15", "UID": "c49668b1e02ff40a" }, "Version": "22.3.3+ds1", "Release": "1", "Arch": "amd64", "SrcName": "intel-gmmlib", "SrcVersion": "22.3.3+ds1", "SrcRelease": "1", "Licenses": [ "MIT", "BSD-3-Clause" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libigdgmm.so.12.3.0", "/usr/share/doc/libigdgmm12/changelog.Debian.gz", "/usr/share/doc/libigdgmm12/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libjack-jackd2-0@1.9.21~dfsg-3", "Name": "libjack-jackd2-0", "Identifier": { "PURL": "pkg:deb/debian/libjack-jackd2-0@1.9.21~dfsg-3?arch=amd64\u0026distro=debian-12.15", "UID": "3c53eba29bc3c2ea" }, "Version": "1.9.21~dfsg", "Release": "3", "Arch": "amd64", "SrcName": "jackd2", "SrcVersion": "1.9.21~dfsg", "SrcRelease": "3", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later", "GPL-2~either", "GPL-3.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later", "GPL-2~or", "MIT", "BSD-3-Clause", "public-domain~Kroon", "BSD-2-Clause", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdb5.3@5.3.28+dfsg2-1", "libgcc-s1@12.2.0-14+deb12u1", "libopus0@1.3.1-3", "libsamplerate0@0.2.2-3", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libjack.so.0.1.0", "/usr/lib/x86_64-linux-gnu/libjacknet.so.0.1.0", "/usr/lib/x86_64-linux-gnu/libjackserver.so.0.1.0", "/usr/share/doc/libjack-jackd2-0/changelog.Debian.gz", "/usr/share/doc/libjack-jackd2-0/changelog.gz", "/usr/share/doc/libjack-jackd2-0/copyright", "/usr/share/lintian/overrides/libjack-jackd2-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libjbig0@2.1-6.1", "Name": "libjbig0", "Identifier": { "PURL": "pkg:deb/debian/libjbig0@2.1-6.1?arch=amd64\u0026distro=debian-12.15", "UID": "1650131acc34570e" }, "Version": "2.1", "Release": "6.1", "Arch": "amd64", "SrcName": "jbigkit", "SrcVersion": "2.1", "SrcRelease": "6.1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Michael van der Kolff \u003cmvanderkolff@gmail.com\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libjbig.so.0", "/usr/share/doc/libjbig0/changelog.Debian.gz", "/usr/share/doc/libjbig0/changelog.gz", "/usr/share/doc/libjbig0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libjpeg62-turbo@1:2.1.5-2", "Name": "libjpeg62-turbo", "Identifier": { "PURL": "pkg:deb/debian/libjpeg62-turbo@2.1.5-2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "370c628e0ffc779e" }, "Version": "2.1.5", "Release": "2", "Epoch": 1, "Arch": "amd64", "SrcName": "libjpeg-turbo", "SrcVersion": "2.1.5", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "BSD-BY-LC-NE", "Zlib", "BSD-3-Clause", "MIT", "NTP" ], "Maintainer": "Ondřej Surý \u003condrej@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libjpeg.so.62.3.0", "/usr/share/doc/libjpeg62-turbo/changelog.Debian.gz", "/usr/share/doc/libjpeg62-turbo/changelog.gz", "/usr/share/doc/libjpeg62-turbo/copyright", "/usr/share/lintian/overrides/libjpeg62-turbo" ], "AnalyzedBy": "dpkg" }, { "ID": "libjxl0.7@0.7.0-10+deb12u1", "Name": "libjxl0.7", "Identifier": { "PURL": "pkg:deb/debian/libjxl0.7@0.7.0-10%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "bea4bb097438a61f" }, "Version": "0.7.0", "Release": "10+deb12u1", "Arch": "amd64", "SrcName": "jpeg-xl", "SrcVersion": "0.7.0", "SrcRelease": "10+deb12u1", "Licenses": [ "BSD-3-clause-Google", "ISC" ], "Maintainer": "Debian PhotoTools Maintainers \u003cpkg-phototools-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbrotli1@1.0.9-2+b6", "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libhwy1@1.0.3-3+deb12u1", "liblcms2-2@2.14-2+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libjxl.so.0.7.0", "/usr/lib/x86_64-linux-gnu/libjxl_threads.so.0.7.0", "/usr/share/doc/libjxl0.7/changelog.Debian.gz", "/usr/share/doc/libjxl0.7/changelog.gz", "/usr/share/doc/libjxl0.7/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libk5crypto3@1.20.1-2+deb12u5", "Name": "libk5crypto3", "Identifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "cc3d2951db5cce7a" }, "Version": "1.20.1", "Release": "2+deb12u5", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.20.1", "SrcRelease": "2+deb12u5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libkrb5support0@1.20.1-2+deb12u5" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1", "/usr/share/doc/libk5crypto3/changelog.Debian.gz", "/usr/share/doc/libk5crypto3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libkeyutils1@1.6.3-2", "Name": "libkeyutils1", "Identifier": { "PURL": "pkg:deb/debian/libkeyutils1@1.6.3-2?arch=amd64\u0026distro=debian-12.15", "UID": "776616ae452b5717" }, "Version": "1.6.3", "Release": "2", "Arch": "amd64", "SrcName": "keyutils", "SrcVersion": "1.6.3", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only" ], "Maintainer": "Christian Kastner \u003cckk@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libkeyutils.so.1.10", "/usr/share/doc/libkeyutils1/changelog.Debian.gz", "/usr/share/doc/libkeyutils1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libkrb5-3@1.20.1-2+deb12u5", "Name": "libkrb5-3", "Identifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "bf111d136a9ec9cc" }, "Version": "1.20.1", "Release": "2+deb12u5", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.20.1", "SrcRelease": "2+deb12u5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libcom-err2@1.47.0-2+b2", "libk5crypto3@1.20.1-2+deb12u5", "libkeyutils1@1.6.3-2", "libkrb5support0@1.20.1-2+deb12u5", "libssl3@3.0.20-1~deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so", "/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3", "/usr/share/doc/libkrb5-3/README.Debian", "/usr/share/doc/libkrb5-3/README.gz", "/usr/share/doc/libkrb5-3/changelog.Debian.gz", "/usr/share/doc/libkrb5-3/copyright", "/usr/share/lintian/overrides/libkrb5-3" ], "AnalyzedBy": "dpkg" }, { "ID": "libkrb5support0@1.20.1-2+deb12u5", "Name": "libkrb5support0", "Identifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "81ccec4ad369fa5d" }, "Version": "1.20.1", "Release": "2+deb12u5", "Arch": "amd64", "SrcName": "krb5", "SrcVersion": "1.20.1", "SrcRelease": "2+deb12u5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1", "/usr/share/doc/libkrb5support0/changelog.Debian.gz", "/usr/share/doc/libkrb5support0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblapack3@3.11.0-2", "Name": "liblapack3", "Identifier": { "PURL": "pkg:deb/debian/liblapack3@3.11.0-2?arch=amd64\u0026distro=debian-12.15", "UID": "83c7d76211464b15" }, "Version": "3.11.0", "Release": "2", "Arch": "amd64", "SrcName": "lapack", "SrcVersion": "3.11.0", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-intel" ], "Maintainer": "Debian Science Team \u003cdebian-science-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libblas3@3.11.0-2", "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libgfortran5@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/lapack/liblapack.so.3.11.0", "/usr/share/doc/liblapack3/changelog.Debian.gz", "/usr/share/doc/liblapack3/copyright", "/usr/share/lintian/overrides/liblapack3" ], "AnalyzedBy": "dpkg" }, { "ID": "liblcms2-2@2.14-2+deb12u1", "Name": "liblcms2-2", "Identifier": { "PURL": "pkg:deb/debian/liblcms2-2@2.14-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "814522fd942f6aa8" }, "Version": "2.14", "Release": "2+deb12u1", "Arch": "amd64", "SrcName": "lcms2", "SrcVersion": "2.14", "SrcRelease": "2+deb12u1", "Licenses": [ "MIT", "GPL-3.0-only", "IJG", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Thomas Weber \u003ctweber@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblcms2.so.2.0.14", "/usr/share/doc/liblcms2-2/changelog.Debian.gz", "/usr/share/doc/liblcms2-2/changelog.gz", "/usr/share/doc/liblcms2-2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libldap-2.5-0@2.5.13+dfsg-5", "Name": "libldap-2.5-0", "Identifier": { "PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.15", "UID": "1bdeeaa4bf6afd83" }, "Version": "2.5.13+dfsg", "Release": "5", "Arch": "amd64", "SrcName": "openldap", "SrcVersion": "2.5.13+dfsg", "SrcRelease": "5", "Licenses": [ "OpenLDAP-2.8", "FSF-unlimited", "GPL-2.0-with-autoconf-exception+", "GPL-3.0-with-autoconf-exception+", "GPL-2+ with Libtool exception", "GPL-3+ with Libtool exception", "GPL-3.0-or-later", "GPL-2.0-or-later", "UMich", "F5", "JCG", "MIT-XC", "NeoSoft-permissive", "BSD-3-Clause", "Beerware", "public-domain", "BSD-4-clause-California", "BSD-3-clause-variant", "Expat-ISC", "Expat-UNM", "MIT", "BSD-3-clause-California", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian OpenLDAP Maintainers \u003cpkg-openldap-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgnutls30@3.7.9-2+deb12u7", "libsasl2-2@2.1.28+dfsg-10" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblber-2.5.so.0.1.8", "/usr/lib/x86_64-linux-gnu/libldap-2.5.so.0.1.8", "/usr/share/doc/libldap-2.5-0/README.Debian", "/usr/share/doc/libldap-2.5-0/changelog.Debian.gz", "/usr/share/doc/libldap-2.5-0/changelog.gz", "/usr/share/doc/libldap-2.5-0/copyright", "/usr/share/lintian/overrides/libldap-2.5-0" ], "AnalyzedBy": "dpkg" }, { "ID": "liblerc4@4.0.0+ds-2", "Name": "liblerc4", "Identifier": { "PURL": "pkg:deb/debian/liblerc4@4.0.0%2Bds-2?arch=amd64\u0026distro=debian-12.15", "UID": "ab6857fa63ee069f" }, "Version": "4.0.0+ds", "Release": "2", "Arch": "amd64", "SrcName": "lerc", "SrcVersion": "4.0.0+ds", "SrcRelease": "2", "Licenses": [ "Apache-2.0" ], "Maintainer": "Debian GIS Project \u003cpkg-grass-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libLerc.so.4", "/usr/share/doc/liblerc4/NOTICE", "/usr/share/doc/liblerc4/changelog.Debian.gz", "/usr/share/doc/liblerc4/changelog.gz", "/usr/share/doc/liblerc4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblilv-0-0@0.24.14-1", "Name": "liblilv-0-0", "Identifier": { "PURL": "pkg:deb/debian/liblilv-0-0@0.24.14-1?arch=amd64\u0026distro=debian-12.15", "UID": "8b58834986bada4e" }, "Version": "0.24.14", "Release": "1", "Arch": "amd64", "SrcName": "lilv", "SrcVersion": "0.24.14", "SrcRelease": "1", "Licenses": [ "ISC", "BSD-3-Clause" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libserd-0-0@0.30.16-1", "libsord-0-0@0.16.14+git221008-1", "libsratom-0-0@0.6.14-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblilv-0.so.0.24.14", "/usr/share/doc/liblilv-0-0/changelog.Debian.gz", "/usr/share/doc/liblilv-0-0/changelog.gz", "/usr/share/doc/liblilv-0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libllvm15@1:15.0.6-4+b1", "Name": "libllvm15", "Identifier": { "PURL": "pkg:deb/debian/libllvm15@15.0.6-4%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f795a0fe0bc3db51" }, "Version": "15.0.6", "Release": "4+b1", "Epoch": 1, "Arch": "amd64", "SrcName": "llvm-toolchain-15", "SrcVersion": "15.0.6", "SrcRelease": "4", "SrcEpoch": 1, "Licenses": [ "APACHE-2-LLVM-EXCEPTIONS", "Apache-2.0", "MIT", "BSD-3-Clause", "solar-public-domain", "Python-2.0" ], "Maintainer": "LLVM Packaging Team \u003cpkg-llvm-team@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libedit2@3.1-20221030-2", "libffi8@3.4.4-1", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1", "libtinfo6@6.4-4", "libxml2@2.9.14+dfsg-1.3~deb12u6", "libz3-4@4.8.12-3.1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libLLVM-15.so.1", "/usr/share/doc/libllvm15/NEWS.Debian.gz", "/usr/share/doc/libllvm15/changelog.Debian.amd64.gz", "/usr/share/doc/libllvm15/changelog.Debian.gz", "/usr/share/doc/libllvm15/copyright", "/usr/share/lintian/overrides/libllvm15" ], "AnalyzedBy": "dpkg" }, { "ID": "liblz4-1@1.9.4-1", "Name": "liblz4-1", "Identifier": { "PURL": "pkg:deb/debian/liblz4-1@1.9.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "90d5806a87917e38" }, "Version": "1.9.4", "Release": "1", "Arch": "amd64", "SrcName": "lz4", "SrcVersion": "1.9.4", "SrcRelease": "1", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Nobuhiro Iwamatsu \u003ciwamatsu@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/liblz4.so.1.9.4", "/usr/share/doc/liblz4-1/changelog.Debian.gz", "/usr/share/doc/liblz4-1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "liblzma5@5.4.1-1+deb12u1", "Name": "liblzma5", "Identifier": { "PURL": "pkg:deb/debian/liblzma5@5.4.1-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "32ad389eeac4c281" }, "Version": "5.4.1", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "xz-utils", "SrcVersion": "5.4.1", "SrcRelease": "1+deb12u1", "Licenses": [ "PD", "probably-PD", "GPL-2.0-or-later", "LGPL-2.1-or-later", "permissive-fsf", "Autoconf", "permissive-nowarranty", "GPL-2.0-only", "none", "config-h", "LGPL-2.0-only", "LGPL-2.1-only", "noderivs", "PD-debian", "GPL-3.0-only" ], "Maintainer": "Sebastian Andrzej Siewior \u003csebastian@breakpoint.cc\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/liblzma.so.5.4.1", "/usr/share/doc/liblzma5/AUTHORS", "/usr/share/doc/liblzma5/NEWS.gz", "/usr/share/doc/liblzma5/THANKS", "/usr/share/doc/liblzma5/changelog.Debian.gz", "/usr/share/doc/liblzma5/changelog.gz", "/usr/share/doc/liblzma5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmbedcrypto7@2.28.3-1", "Name": "libmbedcrypto7", "Identifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "Version": "2.28.3", "Release": "1", "Arch": "amd64", "SrcName": "mbedtls", "SrcVersion": "2.28.3", "SrcRelease": "1", "Licenses": [ "Apache-2.0", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Andrea Pappacoda \u003candrea@pappacoda.it\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmbedcrypto.so.2.28.3", "/usr/share/doc/libmbedcrypto7/changelog.Debian.gz", "/usr/share/doc/libmbedcrypto7/changelog.gz", "/usr/share/doc/libmbedcrypto7/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmd0@1.0.4-2", "Name": "libmd0", "Identifier": { "PURL": "pkg:deb/debian/libmd0@1.0.4-2?arch=amd64\u0026distro=debian-12.15", "UID": "35bf60005b880824" }, "Version": "1.0.4", "Release": "2", "Arch": "amd64", "SrcName": "libmd", "SrcVersion": "1.0.4", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "BSD-3-clause-Aaron-D-Gifford", "BSD-2-Clause", "BSD-2-Clause-NetBSD", "ISC", "Beerware", "public-domain-md4", "public-domain-md5", "public-domain-sha1" ], "Maintainer": "Guillem Jover \u003cguillem@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmd.so.0.0.5", "/usr/share/doc/libmd0/changelog.Debian.gz", "/usr/share/doc/libmd0/changelog.gz", "/usr/share/doc/libmd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmfx1@22.5.4-1", "Name": "libmfx1", "Identifier": { "PURL": "pkg:deb/debian/libmfx1@22.5.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "1a3c53149a5498ca" }, "Version": "22.5.4", "Release": "1", "Arch": "amd64", "SrcName": "intel-mediasdk", "SrcVersion": "22.5.4", "SrcRelease": "1", "Licenses": [ "MIT", "BSD-3-Clause", "Apache-2.0", "NTP" ], "Maintainer": "Timo Aaltonen \u003ctjaalton@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1", "libva2@2.17.0-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmfx-tracer.so.1.35", "/usr/lib/x86_64-linux-gnu/libmfx.so.1.35", "/usr/lib/x86_64-linux-gnu/libmfxhw64.so.1.35", "/usr/lib/x86_64-linux-gnu/mfx/libmfx_h264la_hw64.so", "/usr/lib/x86_64-linux-gnu/mfx/libmfx_hevc_fei_hw64.so", "/usr/lib/x86_64-linux-gnu/mfx/libmfx_hevcd_hw64.so", "/usr/lib/x86_64-linux-gnu/mfx/libmfx_hevce_hw64.so", "/usr/lib/x86_64-linux-gnu/mfx/libmfx_vp8d_hw64.so", "/usr/lib/x86_64-linux-gnu/mfx/libmfx_vp9d_hw64.so", "/usr/lib/x86_64-linux-gnu/mfx/libmfx_vp9e_hw64.so", "/usr/share/doc/libmfx1/changelog.Debian.gz", "/usr/share/doc/libmfx1/changelog.gz", "/usr/share/doc/libmfx1/copyright", "/usr/share/mfx/plugins.cfg" ], "AnalyzedBy": "dpkg" }, { "ID": "libmount1@2.38.1-5+deb12u3", "Name": "libmount1", "Identifier": { "PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "1c28517f3a673db4" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libblkid1@2.38.1-5+deb12u3", "libc6@2.36-9+deb12u14", "libselinux1@3.4-1+b6" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmount.so.1.1.0", "/usr/share/doc/libmount1/changelog.Debian.gz", "/usr/share/doc/libmount1/changelog.gz", "/usr/share/doc/libmount1/copyright", "/usr/share/lintian/overrides/libmount1" ], "AnalyzedBy": "dpkg" }, { "ID": "libmp3lame0@3.100-6", "Name": "libmp3lame0", "Identifier": { "PURL": "pkg:deb/debian/libmp3lame0@3.100-6?arch=amd64\u0026distro=debian-12.15", "UID": "300d00567d6ccea5" }, "Version": "3.100", "Release": "6", "Arch": "amd64", "SrcName": "lame", "SrcVersion": "3.100", "SrcRelease": "6", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "zlib-acknowledgement", "BSD-3-Clause", "GPL-1.0-or-later", "GPL-1.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmp3lame.so.0.0.0", "/usr/share/doc/libmp3lame0/changelog.Debian.gz", "/usr/share/doc/libmp3lame0/changelog.gz", "/usr/share/doc/libmp3lame0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libmpg123-0@1.31.2-1+deb12u1", "Name": "libmpg123-0", "Identifier": { "PURL": "pkg:deb/debian/libmpg123-0@1.31.2-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "973b0c209f3e296d" }, "Version": "1.31.2", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "mpg123", "SrcVersion": "1.31.2", "SrcRelease": "1+deb12u1", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmpg123.so.0.47.0", "/usr/share/doc/libmpg123-0/changelog.Debian.gz", "/usr/share/doc/libmpg123-0/changelog.gz", "/usr/share/doc/libmpg123-0/copyright", "/usr/share/lintian/overrides/libmpg123-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libmysofa1@1.3.1~dfsg0-1", "Name": "libmysofa1", "Identifier": { "PURL": "pkg:deb/debian/libmysofa1@1.3.1~dfsg0-1?arch=amd64\u0026distro=debian-12.15", "UID": "46b5ceeb21ebb51e" }, "Version": "1.3.1~dfsg0", "Release": "1", "Arch": "amd64", "SrcName": "libmysofa", "SrcVersion": "1.3.1~dfsg0", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "listen-ircam", "mit-kemar", "CC-BY-SA-3.0", "CC-BY-4.0", "cipic" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libmysofa.so.1.3.0", "/usr/share/doc/libmysofa1/changelog.Debian.gz", "/usr/share/doc/libmysofa1/copyright", "/usr/share/libmysofa/MIT_KEMAR_normal_pinna.sofa" ], "AnalyzedBy": "dpkg" }, { "ID": "libncursesw6@6.4-4", "Name": "libncursesw6", "Identifier": { "PURL": "pkg:deb/debian/libncursesw6@6.4-4?arch=amd64\u0026distro=debian-12.15", "UID": "5834ee5318950104" }, "Version": "6.4", "Release": "4", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.4", "SrcRelease": "4", "Maintainer": "Craig Small \u003ccsmall@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libtinfo6@6.4-4" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libncursesw.so.6.4", "/usr/lib/x86_64-linux-gnu/libformw.so.6.4", "/usr/lib/x86_64-linux-gnu/libmenuw.so.6.4", "/usr/lib/x86_64-linux-gnu/libpanelw.so.6.4" ], "AnalyzedBy": "dpkg" }, { "ID": "libnettle8@3.8.1-2", "Name": "libnettle8", "Identifier": { "PURL": "pkg:deb/debian/libnettle8@3.8.1-2?arch=amd64\u0026distro=debian-12.15", "UID": "da2b60df99ec436c" }, "Version": "3.8.1", "Release": "2", "Arch": "amd64", "SrcName": "nettle", "SrcVersion": "3.8.1", "SrcRelease": "2", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "LGPL-2.0-or-later", "LGPL-2.0-only", "MIT", "GPL-3.0-or-later", "GPL-3.0-with-autoconf-exception+", "public-domain", "GPL-2.0-only", "GAP" ], "Maintainer": "Magnus Holmgren \u003cholmgren@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnettle.so.8.6", "/usr/share/doc/libnettle8/NEWS.gz", "/usr/share/doc/libnettle8/README", "/usr/share/doc/libnettle8/changelog.Debian.gz", "/usr/share/doc/libnettle8/changelog.gz", "/usr/share/doc/libnettle8/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libnorm1@1.5.9+dfsg-2", "Name": "libnorm1", "Identifier": { "PURL": "pkg:deb/debian/libnorm1@1.5.9%2Bdfsg-2?arch=amd64\u0026distro=debian-12.15", "UID": "7dde4d1c83639658" }, "Version": "1.5.9+dfsg", "Release": "2", "Arch": "amd64", "SrcName": "norm", "SrcVersion": "1.5.9+dfsg", "SrcRelease": "2", "Licenses": [ "NRL-2-clause", "NRL-3-clause", "BSD-2-Clause", "BSD-4-Clause-UC", "BSD-3-Clause" ], "Maintainer": "Luca Boccassi \u003cbluca@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnorm.so.1", "/usr/share/doc/libnorm1/changelog.Debian.gz", "/usr/share/doc/libnorm1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libnuma1@2.0.16-1", "Name": "libnuma1", "Identifier": { "PURL": "pkg:deb/debian/libnuma1@2.0.16-1?arch=amd64\u0026distro=debian-12.15", "UID": "a6ba9c39e9fa5829" }, "Version": "2.0.16", "Release": "1", "Arch": "amd64", "SrcName": "numactl", "SrcVersion": "2.0.16", "SrcRelease": "1", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later" ], "Maintainer": "Ian Wienand \u003cianw@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0", "/usr/share/doc/libnuma1/changelog.Debian.gz", "/usr/share/doc/libnuma1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libogg0@1.3.5-3", "Name": "libogg0", "Identifier": { "PURL": "pkg:deb/debian/libogg0@1.3.5-3?arch=amd64\u0026distro=debian-12.15", "UID": "c38a7cc1a6e397c0" }, "Version": "1.3.5", "Release": "3", "Arch": "amd64", "SrcName": "libogg", "SrcVersion": "1.3.5", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause", "rfc3533-license", "rfc5334-license" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libogg.so.0.8.5", "/usr/share/doc/libogg0/changelog.Debian.gz", "/usr/share/doc/libogg0/changelog.gz", "/usr/share/doc/libogg0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libopenal-data@1:1.19.1-2", "Name": "libopenal-data", "Identifier": { "PURL": "pkg:deb/debian/libopenal-data@1.19.1-2?arch=all\u0026distro=debian-12.15\u0026epoch=1", "UID": "e9368846daf9f84a" }, "Version": "1.19.1", "Release": "2", "Epoch": 1, "Arch": "all", "SrcName": "openal-soft", "SrcVersion": "1.19.1", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "LGPL-2.0-or-later", "Apache-2.0", "MIT", "LGPL-2.1-or-later", "BSD-3-clause-cmake", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian Games Team \u003cpkg-games-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/libopenal-data/changelog.Debian.gz", "/usr/share/doc/libopenal-data/changelog.gz", "/usr/share/doc/libopenal-data/copyright", "/usr/share/openal/hrtf/default-44100.mhr", "/usr/share/openal/hrtf/default-48000.mhr" ], "AnalyzedBy": "dpkg" }, { "ID": "libopenal1@1:1.19.1-2", "Name": "libopenal1", "Identifier": { "PURL": "pkg:deb/debian/libopenal1@1.19.1-2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "c203bedab64665c4" }, "Version": "1.19.1", "Release": "2", "Epoch": 1, "Arch": "amd64", "SrcName": "openal-soft", "SrcVersion": "1.19.1", "SrcRelease": "2", "SrcEpoch": 1, "Licenses": [ "LGPL-2.0-or-later", "Apache-2.0", "MIT", "LGPL-2.1-or-later", "BSD-3-clause-cmake", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only" ], "Maintainer": "Debian Games Team \u003cpkg-games-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libopenal-data@1:1.19.1-2", "libsndio7.0@1.9.0-0.3+b2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libopenal.so.1.19.1", "/usr/share/doc/libopenal1/changelog.Debian.gz", "/usr/share/doc/libopenal1/changelog.gz", "/usr/share/doc/libopenal1/copyright", "/usr/share/doc/libopenal1/examples/alsoftrc.sample" ], "AnalyzedBy": "dpkg" }, { "ID": "libopenjp2-7@2.5.0-2+deb12u3", "Name": "libopenjp2-7", "Identifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "Version": "2.5.0", "Release": "2+deb12u3", "Arch": "amd64", "SrcName": "openjpeg2", "SrcVersion": "2.5.0", "SrcRelease": "2+deb12u3", "Licenses": [ "BSD-2-Clause", "MIT", "BSD-3-Clause", "public-domain", "Libpng", "Zlib", "libtiff", "LIBTIFF-PIXAR", "LIBTIFF-GLARSON" ], "Maintainer": "Debian PhotoTools Maintainers \u003cpkg-phototools-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libopenjp2.so.2.5.0", "/usr/share/doc/libopenjp2-7/changelog.Debian.gz", "/usr/share/doc/libopenjp2-7/changelog.gz", "/usr/share/doc/libopenjp2-7/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libopenmpt0@0.6.9-1", "Name": "libopenmpt0", "Identifier": { "PURL": "pkg:deb/debian/libopenmpt0@0.6.9-1?arch=amd64\u0026distro=debian-12.15", "UID": "644f4b292866f338" }, "Version": "0.6.9", "Release": "1", "Arch": "amd64", "SrcName": "libopenmpt", "SrcVersion": "0.6.9", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "GPL-2.0-with-autoconf-exception+", "GPL-3.0-with-autoconf-exception+", "X11", "GPL-2+ with LibTool exception", "GPL-3+ with Autoconf Macros exception", "GNU-All-Permissive-License", "GNU-All-Permissive-License-FSF", "BSL-1.0", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libmpg123-0@1.31.2-1+deb12u1", "libstdc++6@12.2.0-14+deb12u1", "libvorbis0a@1.3.7-1", "libvorbisfile3@1.3.7-1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libopenmpt.so.0.3.3", "/usr/share/doc/libopenmpt0/changelog.Debian.gz", "/usr/share/doc/libopenmpt0/changelog.gz", "/usr/share/doc/libopenmpt0/copyright", "/usr/share/lintian/overrides/libopenmpt0" ], "AnalyzedBy": "dpkg" }, { "ID": "libopus0@1.3.1-3", "Name": "libopus0", "Identifier": { "PURL": "pkg:deb/debian/libopus0@1.3.1-3?arch=amd64\u0026distro=debian-12.15", "UID": "34b6ac783469f744" }, "Version": "1.3.1", "Release": "3", "Arch": "amd64", "SrcName": "opus", "SrcVersion": "1.3.1", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause", "BSD-2-Clause" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libopus.so.0.8.0", "/usr/share/doc/libopus0/changelog.Debian.gz", "/usr/share/doc/libopus0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libp11-kit0@0.24.1-2", "Name": "libp11-kit0", "Identifier": { "PURL": "pkg:deb/debian/libp11-kit0@0.24.1-2?arch=amd64\u0026distro=debian-12.15", "UID": "8ad8fe8135cab155" }, "Version": "0.24.1", "Release": "2", "Arch": "amd64", "SrcName": "p11-kit", "SrcVersion": "0.24.1", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "permissive-like-automake-output", "ISC", "ISC+IBM", "LGPL-2.1-or-later", "Apache-2.0", "same-as-rest-of-p11kit", "LGPL-2.1-only" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libffi8@3.4.4-1" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libp11-kit.so.0.3.0", "/usr/share/doc/libp11-kit0/changelog.Debian.gz", "/usr/share/doc/libp11-kit0/changelog.gz", "/usr/share/doc/libp11-kit0/copyright", "/usr/share/doc/libp11-kit0/examples/pkcs11.conf.example" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-modules@1.5.2-6+deb12u2", "Name": "libpam-modules", "Identifier": { "PURL": "pkg:deb/debian/libpam-modules@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "1c34e641d558b279" }, "Version": "1.5.2", "Release": "6+deb12u2", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.5.2", "SrcRelease": "6+deb12u2", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/security/pam_access.so", "/lib/x86_64-linux-gnu/security/pam_debug.so", "/lib/x86_64-linux-gnu/security/pam_deny.so", "/lib/x86_64-linux-gnu/security/pam_echo.so", "/lib/x86_64-linux-gnu/security/pam_env.so", "/lib/x86_64-linux-gnu/security/pam_exec.so", "/lib/x86_64-linux-gnu/security/pam_faildelay.so", "/lib/x86_64-linux-gnu/security/pam_faillock.so", "/lib/x86_64-linux-gnu/security/pam_filter.so", "/lib/x86_64-linux-gnu/security/pam_ftp.so", "/lib/x86_64-linux-gnu/security/pam_group.so", "/lib/x86_64-linux-gnu/security/pam_issue.so", "/lib/x86_64-linux-gnu/security/pam_keyinit.so", "/lib/x86_64-linux-gnu/security/pam_lastlog.so", "/lib/x86_64-linux-gnu/security/pam_limits.so", "/lib/x86_64-linux-gnu/security/pam_listfile.so", "/lib/x86_64-linux-gnu/security/pam_localuser.so", "/lib/x86_64-linux-gnu/security/pam_loginuid.so", "/lib/x86_64-linux-gnu/security/pam_mail.so", "/lib/x86_64-linux-gnu/security/pam_mkhomedir.so", "/lib/x86_64-linux-gnu/security/pam_motd.so", "/lib/x86_64-linux-gnu/security/pam_namespace.so", "/lib/x86_64-linux-gnu/security/pam_nologin.so", "/lib/x86_64-linux-gnu/security/pam_permit.so", "/lib/x86_64-linux-gnu/security/pam_pwhistory.so", "/lib/x86_64-linux-gnu/security/pam_rhosts.so", "/lib/x86_64-linux-gnu/security/pam_rootok.so", "/lib/x86_64-linux-gnu/security/pam_securetty.so", "/lib/x86_64-linux-gnu/security/pam_selinux.so", "/lib/x86_64-linux-gnu/security/pam_sepermit.so", "/lib/x86_64-linux-gnu/security/pam_setquota.so", "/lib/x86_64-linux-gnu/security/pam_shells.so", "/lib/x86_64-linux-gnu/security/pam_stress.so", "/lib/x86_64-linux-gnu/security/pam_succeed_if.so", "/lib/x86_64-linux-gnu/security/pam_time.so", "/lib/x86_64-linux-gnu/security/pam_timestamp.so", "/lib/x86_64-linux-gnu/security/pam_tty_audit.so", "/lib/x86_64-linux-gnu/security/pam_umask.so", "/lib/x86_64-linux-gnu/security/pam_unix.so", "/lib/x86_64-linux-gnu/security/pam_userdb.so", "/lib/x86_64-linux-gnu/security/pam_usertype.so", "/lib/x86_64-linux-gnu/security/pam_warn.so", "/lib/x86_64-linux-gnu/security/pam_wheel.so", "/lib/x86_64-linux-gnu/security/pam_xauth.so", "/usr/share/doc/libpam-modules/NEWS.Debian.gz", "/usr/share/doc/libpam-modules/changelog.Debian.gz", "/usr/share/doc/libpam-modules/changelog.gz", "/usr/share/doc/libpam-modules/copyright", "/usr/share/doc/libpam-modules/examples/upperLOWER.c", "/usr/share/lintian/overrides/libpam-modules", "/usr/share/man/man5/access.conf.5.gz", "/usr/share/man/man5/faillock.conf.5.gz", "/usr/share/man/man5/group.conf.5.gz", "/usr/share/man/man5/limits.conf.5.gz", "/usr/share/man/man5/namespace.conf.5.gz", "/usr/share/man/man5/pam_env.conf.5.gz", "/usr/share/man/man5/sepermit.conf.5.gz", "/usr/share/man/man5/time.conf.5.gz", "/usr/share/man/man7/pam_env.7.gz", "/usr/share/man/man7/pam_selinux.7.gz", "/usr/share/man/man8/pam_access.8.gz", "/usr/share/man/man8/pam_debug.8.gz", "/usr/share/man/man8/pam_deny.8.gz", "/usr/share/man/man8/pam_echo.8.gz", "/usr/share/man/man8/pam_exec.8.gz", "/usr/share/man/man8/pam_faildelay.8.gz", "/usr/share/man/man8/pam_faillock.8.gz", "/usr/share/man/man8/pam_filter.8.gz", "/usr/share/man/man8/pam_ftp.8.gz", "/usr/share/man/man8/pam_group.8.gz", "/usr/share/man/man8/pam_issue.8.gz", "/usr/share/man/man8/pam_keyinit.8.gz", "/usr/share/man/man8/pam_lastlog.8.gz", "/usr/share/man/man8/pam_limits.8.gz", "/usr/share/man/man8/pam_listfile.8.gz", "/usr/share/man/man8/pam_localuser.8.gz", "/usr/share/man/man8/pam_loginuid.8.gz", "/usr/share/man/man8/pam_mail.8.gz", "/usr/share/man/man8/pam_mkhomedir.8.gz", "/usr/share/man/man8/pam_motd.8.gz", "/usr/share/man/man8/pam_namespace.8.gz", "/usr/share/man/man8/pam_nologin.8.gz", "/usr/share/man/man8/pam_permit.8.gz", "/usr/share/man/man8/pam_pwhistory.8.gz", "/usr/share/man/man8/pam_rhosts.8.gz", "/usr/share/man/man8/pam_rootok.8.gz", "/usr/share/man/man8/pam_securetty.8.gz", "/usr/share/man/man8/pam_sepermit.8.gz", "/usr/share/man/man8/pam_setquota.8.gz", "/usr/share/man/man8/pam_shells.8.gz", "/usr/share/man/man8/pam_stress.8.gz", "/usr/share/man/man8/pam_succeed_if.8.gz", "/usr/share/man/man8/pam_time.8.gz", "/usr/share/man/man8/pam_timestamp.8.gz", "/usr/share/man/man8/pam_tty_audit.8.gz", "/usr/share/man/man8/pam_umask.8.gz", "/usr/share/man/man8/pam_unix.8.gz", "/usr/share/man/man8/pam_userdb.8.gz", "/usr/share/man/man8/pam_usertype.8.gz", "/usr/share/man/man8/pam_warn.8.gz", "/usr/share/man/man8/pam_wheel.8.gz", "/usr/share/man/man8/pam_xauth.8.gz", "/usr/share/pam-configs/mkhomedir" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-modules-bin@1.5.2-6+deb12u2", "Name": "libpam-modules-bin", "Identifier": { "PURL": "pkg:deb/debian/libpam-modules-bin@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "9719a4713ae6c4fa" }, "Version": "1.5.2", "Release": "6+deb12u2", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.5.2", "SrcRelease": "6+deb12u2", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:3.0.9-1", "libc6@2.36-9+deb12u14", "libcrypt1@1:4.4.33-2", "libpam0g@1.5.2-6+deb12u2", "libselinux1@3.4-1+b6" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/sbin/mkhomedir_helper", "/sbin/pam_namespace_helper", "/sbin/pwhistory_helper", "/sbin/unix_chkpwd", "/sbin/unix_update", "/usr/lib/systemd/system/pam_namespace.service", "/usr/sbin/faillock", "/usr/sbin/pam_timestamp_check", "/usr/share/doc/libpam-modules-bin/NEWS.Debian.gz", "/usr/share/doc/libpam-modules-bin/changelog.Debian.gz", "/usr/share/doc/libpam-modules-bin/changelog.gz", "/usr/share/doc/libpam-modules-bin/copyright", "/usr/share/lintian/overrides/libpam-modules-bin", "/usr/share/man/man5/environment.5.gz", "/usr/share/man/man8/faillock.8.gz", "/usr/share/man/man8/mkhomedir_helper.8.gz", "/usr/share/man/man8/pam_namespace_helper.8.gz", "/usr/share/man/man8/pam_timestamp_check.8.gz", "/usr/share/man/man8/pwhistory_helper.8.gz", "/usr/share/man/man8/unix_chkpwd.8.gz", "/usr/share/man/man8/unix_update.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam-runtime@1.5.2-6+deb12u2", "Name": "libpam-runtime", "Identifier": { "PURL": "pkg:deb/debian/libpam-runtime@1.5.2-6%2Bdeb12u2?arch=all\u0026distro=debian-12.15", "UID": "47e594e0f52955ae" }, "Version": "1.5.2", "Release": "6+deb12u2", "Arch": "all", "SrcName": "pam", "SrcVersion": "1.5.2", "SrcRelease": "6+deb12u2", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.82", "libpam-modules@1.5.2-6+deb12u2" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/sbin/pam-auth-update", "/usr/sbin/pam_getenv", "/usr/share/doc/libpam-runtime/NEWS.Debian.gz", "/usr/share/doc/libpam-runtime/changelog.Debian.gz", "/usr/share/doc/libpam-runtime/changelog.gz", "/usr/share/doc/libpam-runtime/copyright", "/usr/share/lintian/overrides/libpam-runtime", "/usr/share/locale/af/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/am/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ar/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/as/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/az/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/be/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bg/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bn_IN/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/bs/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ca/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/cs/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/cy/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/da/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/de/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/de_CH/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/el/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/eo/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/es/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/et/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/eu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fa/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/fr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ga/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/gl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/gu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/he/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/hu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ia/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/id/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/is/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/it/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ja/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ka/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/km/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ko/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/kw_GB/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ky/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/lt/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/lv/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ml/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/mr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ms/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/my/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nb/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ne/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/nn/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/or/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pa/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pt/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ro/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ru/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/si/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sl/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sq/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sr@latin/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/sv/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ta/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/te/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/tg/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/th/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/tr/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/uk/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/ur/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/vi/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/yo/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_HK/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/Linux-PAM.mo", "/usr/share/locale/zu/LC_MESSAGES/Linux-PAM.mo", "/usr/share/man/man5/pam.conf.5.gz", "/usr/share/man/man7/PAM.7.gz", "/usr/share/man/man8/pam-auth-update.8.gz", "/usr/share/man/man8/pam_getenv.8.gz", "/usr/share/pam-configs/unix", "/usr/share/pam/common-account", "/usr/share/pam/common-account.md5sums", "/usr/share/pam/common-auth", "/usr/share/pam/common-auth.md5sums", "/usr/share/pam/common-password", "/usr/share/pam/common-password.md5sums", "/usr/share/pam/common-session", "/usr/share/pam/common-session-noninteractive", "/usr/share/pam/common-session-noninteractive.md5sums", "/usr/share/pam/common-session.md5sums" ], "AnalyzedBy": "dpkg" }, { "ID": "libpam0g@1.5.2-6+deb12u2", "Name": "libpam0g", "Identifier": { "PURL": "pkg:deb/debian/libpam0g@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "7ae56a42d59eaaac" }, "Version": "1.5.2", "Release": "6+deb12u2", "Arch": "amd64", "SrcName": "pam", "SrcVersion": "1.5.2", "SrcRelease": "6+deb12u2", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-only", "GPL-3+ with Bison exception", "BSD-tcp_wrappers", "LGPL-2.0-or-later", "LGPL-2.0-only", "public-domain", "Beerware" ], "Maintainer": "Sam Hartman \u003chartmans@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.82", "libaudit1@1:3.0.9-1", "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libpam.so.0.85.1", "/lib/x86_64-linux-gnu/libpam_misc.so.0.82.1", "/lib/x86_64-linux-gnu/libpamc.so.0.82.1", "/usr/share/doc/libpam0g/Debian-PAM-MiniPolicy.gz", "/usr/share/doc/libpam0g/NEWS.Debian.gz", "/usr/share/doc/libpam0g/README", "/usr/share/doc/libpam0g/README.Debian", "/usr/share/doc/libpam0g/TODO.Debian", "/usr/share/doc/libpam0g/changelog.Debian.gz", "/usr/share/doc/libpam0g/changelog.gz", "/usr/share/doc/libpam0g/copyright", "/usr/share/lintian/overrides/libpam0g" ], "AnalyzedBy": "dpkg" }, { "ID": "libpango-1.0-0@1.50.12+ds-1", "Name": "libpango-1.0-0", "Identifier": { "PURL": "pkg:deb/debian/libpango-1.0-0@1.50.12%2Bds-1?arch=amd64\u0026distro=debian-12.15", "UID": "141047b7e83f66e2" }, "Version": "1.50.12+ds", "Release": "1", "Arch": "amd64", "SrcName": "pango1.0", "SrcVersion": "1.50.12+ds", "SrcRelease": "1", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "Example", "TCL", "Unicode", "ICU", "Chromium-BSD-style", "Apache-2.0", "Bitstream-Vera", "OFL-1.1", "CC0-1.0", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "fontconfig@2.14.1-4", "libc6@2.36-9+deb12u14", "libfribidi0@1.0.8-2.1", "libglib2.0-0@2.74.6-2+deb12u9", "libharfbuzz0b@6.0.0+dfsg-3", "libthai0@0.1.29-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpango-1.0.so.0.5000.12", "/usr/share/doc/libpango-1.0-0/NEWS.gz", "/usr/share/doc/libpango-1.0-0/README.md", "/usr/share/doc/libpango-1.0-0/THANKS", "/usr/share/doc/libpango-1.0-0/changelog.Debian.gz", "/usr/share/doc/libpango-1.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpangocairo-1.0-0@1.50.12+ds-1", "Name": "libpangocairo-1.0-0", "Identifier": { "PURL": "pkg:deb/debian/libpangocairo-1.0-0@1.50.12%2Bds-1?arch=amd64\u0026distro=debian-12.15", "UID": "69f2c56af0b52c32" }, "Version": "1.50.12+ds", "Release": "1", "Arch": "amd64", "SrcName": "pango1.0", "SrcVersion": "1.50.12+ds", "SrcRelease": "1", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "Example", "TCL", "Unicode", "ICU", "Chromium-BSD-style", "Apache-2.0", "Bitstream-Vera", "OFL-1.1", "CC0-1.0", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libcairo2@1.16.0-7", "libfontconfig1@2.14.1-4", "libglib2.0-0@2.74.6-2+deb12u9", "libharfbuzz0b@6.0.0+dfsg-3", "libpango-1.0-0@1.50.12+ds-1", "libpangoft2-1.0-0@1.50.12+ds-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpangocairo-1.0.so.0.5000.12", "/usr/share/doc/libpangocairo-1.0-0/changelog.Debian.gz", "/usr/share/doc/libpangocairo-1.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpangoft2-1.0-0@1.50.12+ds-1", "Name": "libpangoft2-1.0-0", "Identifier": { "PURL": "pkg:deb/debian/libpangoft2-1.0-0@1.50.12%2Bds-1?arch=amd64\u0026distro=debian-12.15", "UID": "177284457bdd54d7" }, "Version": "1.50.12+ds", "Release": "1", "Arch": "amd64", "SrcName": "pango1.0", "SrcVersion": "1.50.12+ds", "SrcRelease": "1", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-or-later", "Example", "TCL", "Unicode", "ICU", "Chromium-BSD-style", "Apache-2.0", "Bitstream-Vera", "OFL-1.1", "CC0-1.0", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libfontconfig1@2.14.1-4", "libfreetype6@2.12.1+dfsg-5+deb12u4", "libglib2.0-0@2.74.6-2+deb12u9", "libharfbuzz0b@6.0.0+dfsg-3", "libpango-1.0-0@1.50.12+ds-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpangoft2-1.0.so.0.5000.12", "/usr/share/doc/libpangoft2-1.0-0/changelog.Debian.gz", "/usr/share/doc/libpangoft2-1.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpciaccess0@0.17-2", "Name": "libpciaccess0", "Identifier": { "PURL": "pkg:deb/debian/libpciaccess0@0.17-2?arch=amd64\u0026distro=debian-12.15", "UID": "eb03b865a3cd4b1" }, "Version": "0.17", "Release": "2", "Arch": "amd64", "SrcName": "libpciaccess", "SrcVersion": "0.17", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpciaccess.so.0.11.1", "/usr/share/doc/libpciaccess0/changelog.Debian.gz", "/usr/share/doc/libpciaccess0/changelog.gz", "/usr/share/doc/libpciaccess0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpcre2-8-0@10.42-1", "Name": "libpcre2-8-0", "Identifier": { "PURL": "pkg:deb/debian/libpcre2-8-0@10.42-1?arch=amd64\u0026distro=debian-12.15", "UID": "ff608de08d24151b" }, "Version": "10.42", "Release": "1", "Arch": "amd64", "SrcName": "pcre2", "SrcVersion": "10.42", "SrcRelease": "1", "Licenses": [ "BSD-3-clause-Cambridge with BINARY LIBRARY-LIKE PACKAGES exception", "BSD-3-Clause", "X11", "BSD-2-Clause", "public-domain" ], "Maintainer": "Matthew Vernon \u003cmatthew@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.11.2", "/usr/share/doc/libpcre2-8-0/README.Debian", "/usr/share/doc/libpcre2-8-0/changelog.Debian.gz", "/usr/share/doc/libpcre2-8-0/changelog.gz", "/usr/share/doc/libpcre2-8-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libperl5.36@5.36.0-7+deb12u3", "Name": "libperl5.36", "Identifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "Version": "5.36.0", "Release": "7+deb12u3", "Arch": "amd64", "SrcName": "perl", "SrcVersion": "5.36.0", "SrcRelease": "7+deb12u3", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "RRA-KEEP-THIS-NOTICE", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2", "HSIEH-DERIVATIVE", "HSIEH-BSD" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbz2-1.0@1.0.8-5+b1", "libc6@2.36-9+deb12u14", "libcrypt1@1:4.4.33-2", "libdb5.3@5.3.28+dfsg2-1", "libgdbm-compat4@1.23-3", "libgdbm6@1.23-3", "perl-modules-5.36@5.36.0-7+deb12u3", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/bin/cpan5.36-x86_64-linux-gnu", "/usr/bin/perl5.36-x86_64-linux-gnu", "/usr/lib/x86_64-linux-gnu/libperl.so.5.36.0", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/B.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/B/Concise.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/B/Showlex.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/B/Terse.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/B/Xref.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/EXTERN.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/INTERN.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/XSUB.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/av.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/bitcount.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/charclass_invlists.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/config.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/cop.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/cv.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/dosish.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/ebcdic_tables.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/embed.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/embedvar.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/fakesdio.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/feature.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/form.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/git_version.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/gv.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/handy.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/hv.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/hv_func.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/hv_macro.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/inline.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/intrpvar.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/invlist_inline.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/iperlsys.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/keywords.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/l1_char_class_tab.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/malloc_ctl.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/metaconfig.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/mg.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/mg_data.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/mg_raw.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/mg_vtable.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/mydtrace.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/nostdio.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/op.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/op_reg_common.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/opcode.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/opnames.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/overload.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/pad.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/parser.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/patchlevel-debian.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/patchlevel.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perl.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perl_inc_macro.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perl_langinfo.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perl_siphash.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perlapi.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perlio.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perliol.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perlsdio.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perlvars.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/perly.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/pp.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/pp_proto.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/proto.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/reentr.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/regcharclass.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/regcomp.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/regexp.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/regnodes.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/sbox32_hash.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/scope.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/sv.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/sv_inline.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/thread.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/time64.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/time64_config.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/uconfig.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/uni_keywords.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/unicode_constants.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/unixish.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/utf8.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/utfebcdic.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/util.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/uudmap.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/vutil.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/warnings.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/CORE/zaphod32_hash.h", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Compress/Raw/Bzip2.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Compress/Raw/Zlib.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Config.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Config.pod", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Config_git.pl", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Config_heavy.pl", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Cwd.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/DB_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Data/Dumper.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Devel/PPPort.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Devel/Peek.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Digest/MD5.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Digest/SHA.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/DynaLoader.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Alias.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Byte.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/CJKConstants.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/CN.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/CN/HZ.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Config.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/EBCDIC.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Encoder.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Encoding.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/GSM0338.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Guess.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/JP.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/JP/H2Z.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/JP/JIS7.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/KR.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/KR/2022_KR.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/MIME/Header.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/MIME/Header/ISO_2022_JP.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/MIME/Name.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Symbol.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/TW.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Unicode.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Encode/Unicode/UTF7.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Errno.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Fcntl.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/DosGlob.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Glob.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/AmigaOS.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/Cygwin.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/Epoc.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/Functions.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/Mac.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/OS2.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/Unix.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/VMS.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/File/Spec/Win32.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Filter/Util/Call.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/GDBM_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Hash/Util.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Hash/Util/FieldHash.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/I18N/Langinfo.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Dir.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Handle.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Pipe.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Poll.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Seekable.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Select.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Socket/INET.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IO/Socket/UNIX.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IPC/Msg.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IPC/Semaphore.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IPC/SharedMem.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/IPC/SysV.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/List/Util.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/List/Util/XS.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/MIME/Base64.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/MIME/QuotedPrint.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Math/BigInt/FastCalc.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/NDBM_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/O.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/ODBM_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Opcode.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/POSIX.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/POSIX.pod", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/PerlIO/encoding.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/PerlIO/mmap.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/PerlIO/scalar.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/PerlIO/via.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/SDBM_File.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Scalar/Util.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Storable.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Sub/Util.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Sys/Hostname.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Sys/Syslog.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Time/HiRes.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Time/Piece.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Time/Seconds.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Unicode/Collate.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Unicode/Collate/Locale.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/Unicode/Normalize.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/_h2ph_pre.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/bitsperlong.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/ioctl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/ioctls.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/posix_types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/socket.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/sockios.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/termbits-common.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/termbits.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm-generic/termios.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/bitsperlong.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/ioctl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/ioctls.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/posix_types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/posix_types_32.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/posix_types_64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/posix_types_x32.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/socket.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/sockios.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/termbits.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/termios.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/unistd.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/unistd_32.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/unistd_64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/asm/unistd_x32.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/attributes.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/B/B.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Compress/Raw/Bzip2/Bzip2.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Compress/Raw/Zlib/Zlib.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Cwd/Cwd.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/DB_File/DB_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Data/Dumper/Dumper.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Devel/Peek/Peek.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Digest/MD5/MD5.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Digest/SHA/SHA.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/Byte/Byte.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/CN/CN.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/EBCDIC/EBCDIC.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/Encode.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/JP/JP.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/KR/KR.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/Symbol/Symbol.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/TW/TW.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Encode/Unicode/Unicode.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Fcntl/Fcntl.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/File/DosGlob/DosGlob.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/File/Glob/Glob.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Filter/Util/Call/Call.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/GDBM_File/GDBM_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Hash/Util/FieldHash/FieldHash.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Hash/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/I18N/Langinfo/Langinfo.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/IO/IO.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/IPC/SysV/SysV.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/List/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/MIME/Base64/Base64.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Math/BigInt/FastCalc/FastCalc.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/NDBM_File/NDBM_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/ODBM_File/ODBM_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Opcode/Opcode.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/POSIX/POSIX.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/PerlIO/encoding/encoding.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/PerlIO/mmap/mmap.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/PerlIO/scalar/scalar.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/PerlIO/via/via.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/SDBM_File/SDBM_File.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Socket/Socket.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Storable/Storable.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Sys/Hostname/Hostname.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Sys/Syslog/Syslog.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Time/HiRes/HiRes.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Time/Piece/Piece.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Unicode/Collate/Collate.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/Unicode/Normalize/Normalize.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/attributes/attributes.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/mro/mro.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/re/re.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/threads/shared/shared.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/auto/threads/threads.so", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/atomic_wide_counter.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/byteswap.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/confname.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/endian.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/endianness.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/environments.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/floatn-common.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/floatn.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/getopt_core.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/getopt_posix.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/ioctl-types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/ioctls.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/long-double.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/posix_opt.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/pthreadtypes-arch.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/pthreadtypes.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/select.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/select2.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sigaction.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sigcontext.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sigevent-consts.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/siginfo-arch.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/siginfo-consts-arch.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/siginfo-consts.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/signal_ext.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/signum-arch.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/signum-generic.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sigstack.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sigstksz.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sigthread.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/sockaddr.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/socket-constants.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/socket.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/socket2.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/socket_type.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/ss_flags.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/stdint-intn.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/struct_mutex.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/struct_rwlock.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/syscall.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/syslog-ldbl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/syslog-path.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/syslog.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/thread-shared-types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/time64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/timesize.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/__sigset_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/__sigval_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/clock_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/clockid_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/idtype_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/sig_atomic_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/sigevent_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/siginfo_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/sigset_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/sigval_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/stack_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/struct_iovec.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/struct_osockaddr.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/struct_rusage.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/struct_sigstack.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/struct_timespec.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/struct_timeval.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/time_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/types/timer_t.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/typesizes.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/uintn-identity.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/unistd.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/unistd_ext.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/waitflags.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/waitstatus.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/bits/wordsize.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/encoding.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/endian.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/errno.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/features-time64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/features.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/gnu/stubs-64.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/gnu/stubs.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/lib.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/linux/ioctl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/linux/posix_types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/linux/stddef.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/mro.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/ops.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/re.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/signal.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/stdarg.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/stdc-predef.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/stddef.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/cdefs.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/ioctl.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/select.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/socket.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/syscall.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/syslog.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/time.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/ttydefaults.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/types.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/ucontext.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sys/wait.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/syscall.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/sysexits.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/syslimits.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/syslog.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/threads.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/threads/shared.pm", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/unistd.ph", "/usr/lib/x86_64-linux-gnu/perl/5.36.0/wait.ph", "/usr/lib/x86_64-linux-gnu/perl/debian-config-data-5.36.0/README", "/usr/lib/x86_64-linux-gnu/perl/debian-config-data-5.36.0/config.sh.debug.gz", "/usr/lib/x86_64-linux-gnu/perl/debian-config-data-5.36.0/config.sh.shared.gz", "/usr/lib/x86_64-linux-gnu/perl/debian-config-data-5.36.0/config.sh.static.gz", "/usr/share/doc/libperl5.36/changelog.Debian.gz", "/usr/share/doc/libperl5.36/changelog.gz", "/usr/share/doc/libperl5.36/copyright", "/usr/share/lintian/overrides/libperl5.36", "/usr/share/man/man1/cpan5.36-x86_64-linux-gnu.1.gz", "/usr/share/man/man1/perl5.36-x86_64-linux-gnu.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libpgm-5.3-0@5.3.128~dfsg-2", "Name": "libpgm-5.3-0", "Identifier": { "PURL": "pkg:deb/debian/libpgm-5.3-0@5.3.128~dfsg-2?arch=amd64\u0026distro=debian-12.15", "UID": "ce5d298479fc7911" }, "Version": "5.3.128~dfsg", "Release": "2", "Arch": "amd64", "SrcName": "libpgm", "SrcVersion": "5.3.128~dfsg", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-only", "LGPL-2.0-or-later", "LGPL-2.0-only", "BSD-3-Clause", "ISC" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpgm-5.3.so.0.0.128", "/usr/share/doc/libpgm-5.3-0/changelog.Debian.gz", "/usr/share/doc/libpgm-5.3-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpixman-1-0@0.42.2-1", "Name": "libpixman-1-0", "Identifier": { "PURL": "pkg:deb/debian/libpixman-1-0@0.42.2-1?arch=amd64\u0026distro=debian-12.15", "UID": "efb046322ba383c6" }, "Version": "0.42.2", "Release": "1", "Arch": "amd64", "SrcName": "pixman", "SrcVersion": "0.42.2", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpixman-1.so.0.42.2", "/usr/share/doc/libpixman-1-0/changelog.Debian.gz", "/usr/share/doc/libpixman-1-0/changelog.gz", "/usr/share/doc/libpixman-1-0/copyright", "/usr/share/lintian/overrides/libpixman-1-0" ], "AnalyzedBy": "dpkg" }, { "ID": "libplacebo208@4.208.0-3", "Name": "libplacebo208", "Identifier": { "PURL": "pkg:deb/debian/libplacebo208@4.208.0-3?arch=amd64\u0026distro=debian-12.15", "UID": "381e4092a24e1cc" }, "Version": "4.208.0", "Release": "3", "Arch": "amd64", "SrcName": "libplacebo", "SrcVersion": "4.208.0", "SrcRelease": "3", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "MIT", "Zlib", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libepoxy0@1.5.10-1", "libgcc-s1@12.2.0-14+deb12u1", "liblcms2-2@2.14-2+deb12u1", "libstdc++6@12.2.0-14+deb12u1", "libvulkan1@1.3.239.0-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libplacebo.so.208", "/usr/share/doc/libplacebo208/changelog.Debian.gz", "/usr/share/doc/libplacebo208/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpng16-16@1.6.39-2+deb12u5", "Name": "libpng16-16", "Identifier": { "PURL": "pkg:deb/debian/libpng16-16@1.6.39-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "87aec9de7c5b5777" }, "Version": "1.6.39", "Release": "2+deb12u5", "Arch": "amd64", "SrcName": "libpng1.6", "SrcVersion": "1.6.39", "SrcRelease": "2+deb12u5", "Licenses": [ "Libpng", "MIT", "GPL-2.0-or-later", "BSD-like-with-advertising-clause", "libpng OR Apache-2.0 OR BSD-3-clause", "Apache-2.0", "GPL-2.0-only", "BSD-3-Clause" ], "Maintainer": "Maintainers of libpng1.6 packages \u003clibpng1.6@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpng16.so.16.39.0", "/usr/share/doc-base/libpng16-16.libpng16", "/usr/share/doc/libpng16-16/ANNOUNCE", "/usr/share/doc/libpng16-16/README.gz", "/usr/share/doc/libpng16-16/TODO", "/usr/share/doc/libpng16-16/changelog.Debian.gz", "/usr/share/doc/libpng16-16/changelog.gz", "/usr/share/doc/libpng16-16/copyright", "/usr/share/doc/libpng16-16/libpng-manual.txt.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libpocketsphinx3@0.8+5prealpha+1-15", "Name": "libpocketsphinx3", "Identifier": { "PURL": "pkg:deb/debian/libpocketsphinx3@0.8%2B5prealpha%2B1-15?arch=amd64\u0026distro=debian-12.15", "UID": "60463ac31f5cc0b7" }, "Version": "0.8+5prealpha+1", "Release": "15", "Arch": "amd64", "SrcName": "pocketsphinx", "SrcVersion": "0.8+5prealpha+1", "SrcRelease": "15", "Licenses": [ "BSD-2-Clause", "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Accessibility Team \u003cpkg-a11y-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libsphinxbase3@0.8+5prealpha+1-16" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpocketsphinx.so.3.0.0", "/usr/share/doc/libpocketsphinx3/changelog.Debian.gz", "/usr/share/doc/libpocketsphinx3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libpostproc56@7:5.1.9-0+deb12u1", "Name": "libpostproc56", "Identifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "Version": "5.1.9", "Release": "0+deb12u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "5.1.9", "SrcRelease": "0+deb12u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavutil57@7:5.1.9-0+deb12u1", "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpostproc.so.56.6.100", "/usr/share/doc/libpostproc56/changelog.Debian.gz", "/usr/share/doc/libpostproc56/changelog.gz", "/usr/share/doc/libpostproc56/copyright", "/usr/share/lintian/overrides/libpostproc56" ], "AnalyzedBy": "dpkg" }, { "ID": "libpq5@15.18-0+deb12u1", "Name": "libpq5", "Identifier": { "PURL": "pkg:deb/debian/libpq5@15.18-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "9a3b2536b5dff719" }, "Version": "15.18", "Release": "0+deb12u1", "Arch": "amd64", "SrcName": "postgresql-15", "SrcVersion": "15.18", "SrcRelease": "0+deb12u1", "Licenses": [ "PostgreSQL", "Custom-regex", "TCL", "Custom-pg_dump", "BSD-3-Clause", "Custom-Unicode", "double-metaphone", "GPL-1.0-only", "Artistic-2.0", "nagaysau-ishii", "BSD-2-Clause" ], "Maintainer": "Debian PostgreSQL Maintainers \u003cteam+postgresql@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgssapi-krb5-2@1.20.1-2+deb12u5", "libldap-2.5-0@2.5.13+dfsg-5", "libssl3@3.0.20-1~deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpq.so.5.15", "/usr/share/doc/libpq5/changelog.Debian.gz", "/usr/share/doc/libpq5/changelog.gz", "/usr/share/doc/libpq5/copyright", "/usr/share/locale/cs/LC_MESSAGES/libpq5-15.mo", "/usr/share/locale/de/LC_MESSAGES/libpq5-15.mo", "/usr/share/locale/el/LC_MESSAGES/libpq5-15.mo", "/usr/share/locale/es/LC_MESSAGES/libpq5-15.mo", "/usr/share/locale/fr/LC_MESSAGES/libpq5-15.mo", "/usr/share/locale/it/LC_MESSAGES/libpq5-15.mo", "/usr/share/locale/ja/LC_MESSAGES/libpq5-15.mo", "/usr/share/locale/ka/LC_MESSAGES/libpq5-15.mo", "/usr/share/locale/ko/LC_MESSAGES/libpq5-15.mo", "/usr/share/locale/ru/LC_MESSAGES/libpq5-15.mo", "/usr/share/locale/sv/LC_MESSAGES/libpq5-15.mo", "/usr/share/locale/uk/LC_MESSAGES/libpq5-15.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/libpq5-15.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libpulse0@16.1+dfsg1-2+b1", "Name": "libpulse0", "Identifier": { "PURL": "pkg:deb/debian/libpulse0@16.1%2Bdfsg1-2%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "acd90f9c92f1f814" }, "Version": "16.1+dfsg1", "Release": "2+b1", "Arch": "amd64", "SrcName": "pulseaudio", "SrcVersion": "16.1+dfsg1", "SrcRelease": "2", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "other", "LGPL-2.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-or-later" ], "Maintainer": "Pulseaudio maintenance team \u003cpkg-pulseaudio-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasyncns0@0.8-6+b3", "libc6@2.36-9+deb12u14", "libdbus-1-3@1.14.10-1~deb12u1", "libsndfile1@1.2.0-1+deb12u1", "libsystemd0@252.39-1~deb12u2", "libx11-6@2:1.8.4-2+deb12u2", "libx11-xcb1@2:1.8.4-2+deb12u2", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libpulse-simple.so.0.1.1", "/usr/lib/x86_64-linux-gnu/libpulse.so.0.24.2", "/usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-16.1.so", "/usr/share/doc/libpulse0/NEWS.Debian.gz", "/usr/share/doc/libpulse0/NEWS.gz", "/usr/share/doc/libpulse0/README", "/usr/share/doc/libpulse0/changelog.Debian.amd64.gz", "/usr/share/doc/libpulse0/changelog.Debian.gz", "/usr/share/doc/libpulse0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libquadmath0@12.2.0-14+deb12u1", "Name": "libquadmath0", "Identifier": { "PURL": "pkg:deb/debian/libquadmath0@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "f97128e3ede84a54" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libquadmath.so.0.0.0" ], "AnalyzedBy": "dpkg" }, { "ID": "librabbitmq4@0.11.0-1+deb12u2", "Name": "librabbitmq4", "Identifier": { "PURL": "pkg:deb/debian/librabbitmq4@0.11.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "b4011515a62a2bc3" }, "Version": "0.11.0", "Release": "1+deb12u2", "Arch": "amd64", "SrcName": "librabbitmq", "SrcVersion": "0.11.0", "SrcRelease": "1+deb12u2", "Licenses": [ "MIT", "BSD-Author" ], "Maintainer": "Florian Ernst \u003cflorian@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libssl3@3.0.20-1~deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librabbitmq.so.4.5.0", "/usr/share/doc/librabbitmq4/changelog.Debian.gz", "/usr/share/doc/librabbitmq4/changelog.gz", "/usr/share/doc/librabbitmq4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "librav1e0@0.5.1-6", "Name": "librav1e0", "Identifier": { "PURL": "pkg:deb/debian/librav1e0@0.5.1-6?arch=amd64\u0026distro=debian-12.15", "UID": "72e653bf75c6a2d2" }, "Version": "0.5.1", "Release": "6", "Arch": "amd64", "SrcName": "rust-rav1e", "SrcVersion": "0.5.1", "SrcRelease": "6", "Licenses": [ "BSD-2-Clause", "ISC" ], "Maintainer": "Debian Rust Maintainers \u003cpkg-rust-maintainers@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librav1e.so.0.5.1", "/usr/share/doc/librav1e0/changelog.Debian.gz", "/usr/share/doc/librav1e0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libraw1394-11@2.1.2-2", "Name": "libraw1394-11", "Identifier": { "PURL": "pkg:deb/debian/libraw1394-11@2.1.2-2?arch=amd64\u0026distro=debian-12.15", "UID": "c0650c58e585b0c0" }, "Version": "2.1.2", "Release": "2", "Arch": "amd64", "SrcName": "libraw1394", "SrcVersion": "2.1.2", "SrcRelease": "2", "Licenses": [ "LGPL-2.0-or-later", "GPL-2.0-or-later" ], "Maintainer": "Guus Sliepen \u003cguus@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libraw1394.so.11.1.0", "/usr/share/doc/libraw1394-11/changelog.Debian.gz", "/usr/share/doc/libraw1394-11/changelog.gz", "/usr/share/doc/libraw1394-11/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libreadline8@8.2-1.3", "Name": "libreadline8", "Identifier": { "PURL": "pkg:deb/debian/libreadline8@8.2-1.3?arch=amd64\u0026distro=debian-12.15", "UID": "34abfa24af5378b" }, "Version": "8.2", "Release": "1.3", "Arch": "amd64", "SrcName": "readline", "SrcVersion": "8.2", "SrcRelease": "1.3", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-or-later", "ISC-no-attribution" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libtinfo6@6.4-4", "readline-common@8.2-1.3" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libhistory.so.8.2", "/lib/x86_64-linux-gnu/libreadline.so.8.2", "/usr/share/doc/libreadline8/README.Debian", "/usr/share/doc/libreadline8/USAGE", "/usr/share/doc/libreadline8/changelog.Debian.gz", "/usr/share/doc/libreadline8/changelog.gz", "/usr/share/doc/libreadline8/copyright", "/usr/share/doc/libreadline8/examples/Inputrc", "/usr/share/doc/libreadline8/inputrc.arrows" ], "AnalyzedBy": "dpkg" }, { "ID": "librist4@0.2.7+dfsg-1", "Name": "librist4", "Identifier": { "PURL": "pkg:deb/debian/librist4@0.2.7%2Bdfsg-1?arch=amd64\u0026distro=debian-12.15", "UID": "5a18159bf63a85f8" }, "Version": "0.2.7+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "librist", "SrcVersion": "0.2.7+dfsg", "SrcRelease": "1", "Licenses": [ "BSD-2-Clause", "public-domain", "MIT", "ISC" ], "Maintainer": "Florian Ernst \u003cflorian@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libcjson1@1.7.15-1+deb12u4", "libmbedcrypto7@2.28.3-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librist.so.4.2.0", "/usr/share/doc/librist4/changelog.Debian.gz", "/usr/share/doc/librist4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "librsvg2-2@2.54.7+dfsg-1~deb12u1", "Name": "librsvg2-2", "Identifier": { "PURL": "pkg:deb/debian/librsvg2-2@2.54.7%2Bdfsg-1~deb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "e2026bddcfa5df5d" }, "Version": "2.54.7+dfsg", "Release": "1~deb12u1", "Arch": "amd64", "SrcName": "librsvg", "SrcVersion": "2.54.7+dfsg", "SrcRelease": "1~deb12u1", "Licenses": [ "LGPL-2.0-or-later", "FSFAP", "BSD-3-Clause", "MIT", "Apache-2.0", "BSD-2-Clause", "0BSD", "BSL-1.0", "Unlicense", "MPL-2.0", "Sun-permissive", "Zlib", "CC-BY-3.0", "CC-zero-waive-1.0-us", "OFL-1.1", "LGPL-2.0-only" ], "Maintainer": "Debian GNOME Maintainers \u003cpkg-gnome-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libcairo-gobject2@1.16.0-7", "libcairo2@1.16.0-7", "libgcc-s1@12.2.0-14+deb12u1", "libgdk-pixbuf-2.0-0@2.42.10+dfsg-1+deb12u4", "libglib2.0-0@2.74.6-2+deb12u9", "libpango-1.0-0@1.50.12+ds-1", "libpangocairo-1.0-0@1.50.12+ds-1", "libxml2@2.9.14+dfsg-1.3~deb12u6" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librsvg-2.so.2.48.0", "/usr/share/doc/librsvg2-2/AUTHORS", "/usr/share/doc/librsvg2-2/NEWS.gz", "/usr/share/doc/librsvg2-2/README.md.gz", "/usr/share/doc/librsvg2-2/changelog.Debian.gz", "/usr/share/doc/librsvg2-2/copyright", "/usr/share/lintian/overrides/librsvg2-2" ], "AnalyzedBy": "dpkg" }, { "ID": "librubberband2@3.1.2+dfsg0-1", "Name": "librubberband2", "Identifier": { "PURL": "pkg:deb/debian/librubberband2@3.1.2%2Bdfsg0-1?arch=amd64\u0026distro=debian-12.15", "UID": "27068970f1d85978" }, "Version": "3.1.2+dfsg0", "Release": "1", "Arch": "amd64", "SrcName": "rubberband", "SrcVersion": "3.1.2+dfsg0", "SrcRelease": "1", "Licenses": [ "GPL-2.0-or-later", "MIT", "BSD-3-Clause", "Zlib", "other-1", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/librubberband.so.2.2.1", "/usr/share/doc/librubberband2/changelog.Debian.gz", "/usr/share/doc/librubberband2/changelog.gz", "/usr/share/doc/librubberband2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsamplerate0@0.2.2-3", "Name": "libsamplerate0", "Identifier": { "PURL": "pkg:deb/debian/libsamplerate0@0.2.2-3?arch=amd64\u0026distro=debian-12.15", "UID": "51b25d7d84934155" }, "Version": "0.2.2", "Release": "3", "Arch": "amd64", "SrcName": "libsamplerate", "SrcVersion": "0.2.2", "SrcRelease": "3", "Licenses": [ "BSD-2-Clause", "GPL-2.0-or-later", "FSFAP", "GPL-3.0-or-later", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsamplerate.so.0.2.2", "/usr/share/doc/libsamplerate0/changelog.Debian.gz", "/usr/share/doc/libsamplerate0/changelog.gz", "/usr/share/doc/libsamplerate0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsasl2-2@2.1.28+dfsg-10", "Name": "libsasl2-2", "Identifier": { "PURL": "pkg:deb/debian/libsasl2-2@2.1.28%2Bdfsg-10?arch=amd64\u0026distro=debian-12.15", "UID": "b4e310f3e97a1ebf" }, "Version": "2.1.28+dfsg", "Release": "10", "Arch": "amd64", "SrcName": "cyrus-sasl2", "SrcVersion": "2.1.28+dfsg", "SrcRelease": "10", "Licenses": [ "BSD-4-Clause", "OpenSSL", "SSLeay", "BSD-3-Clause", "BSD-2-Clause", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-4-Clause-UC", "RSA-MD", "BSD-4-clause-KTH", "text://BSD-4-clause and IBM-as-is", "BSD-3-clause-JANET", "BSD-3-clause-PADL", "MIT-OpenVision", "OpenLDAP", "FSFULLR", "MIT-CMU", "MIT-Export", "BSD-2.2-clause", "text://IBM-as-is" ], "Maintainer": "Debian Cyrus Team \u003cteam+cyrus@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libsasl2-modules-db@2.1.28+dfsg-10" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsasl2.so.2.0.25", "/usr/share/doc/libsasl2-2/NEWS.Debian.gz", "/usr/share/doc/libsasl2-2/README.Debian", "/usr/share/doc/libsasl2-2/changelog.Debian.gz", "/usr/share/doc/libsasl2-2/copyright", "/usr/share/man/man5/libsasl.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libsasl2-modules-db@2.1.28+dfsg-10", "Name": "libsasl2-modules-db", "Identifier": { "PURL": "pkg:deb/debian/libsasl2-modules-db@2.1.28%2Bdfsg-10?arch=amd64\u0026distro=debian-12.15", "UID": "78ec2981d6b43e7d" }, "Version": "2.1.28+dfsg", "Release": "10", "Arch": "amd64", "SrcName": "cyrus-sasl2", "SrcVersion": "2.1.28+dfsg", "SrcRelease": "10", "Licenses": [ "BSD-4-Clause", "OpenSSL", "SSLeay", "BSD-3-Clause", "BSD-2-Clause", "GPL-3.0-or-later", "GPL-3.0-only", "BSD-4-Clause-UC", "RSA-MD", "BSD-4-clause-KTH", "text://BSD-4-clause and IBM-as-is", "BSD-3-clause-JANET", "BSD-3-clause-PADL", "MIT-OpenVision", "OpenLDAP", "FSFULLR", "MIT-CMU", "MIT-Export", "BSD-2.2-clause", "text://IBM-as-is" ], "Maintainer": "Debian Cyrus Team \u003cteam+cyrus@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdb5.3@5.3.28+dfsg2-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/sasl2/libsasldb.so.2.0.25", "/usr/share/doc/libsasl2-modules-db/NEWS.Debian.gz", "/usr/share/doc/libsasl2-modules-db/changelog.Debian.gz", "/usr/share/doc/libsasl2-modules-db/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsdl2-2.0-0@2.26.5+dfsg-1", "Name": "libsdl2-2.0-0", "Identifier": { "PURL": "pkg:deb/debian/libsdl2-2.0-0@2.26.5%2Bdfsg-1?arch=amd64\u0026distro=debian-12.15", "UID": "e67f203d1bc72d81" }, "Version": "2.26.5+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "libsdl2", "SrcVersion": "2.26.5+dfsg", "SrcRelease": "1", "Licenses": [ "zlib-acknowledgement", "zlib-libpng-like-permissive", "Expat-like", "Apache-2.0", "SGI-Free-Software-License-B", "BSD-3-Clause", "GPL-3.0-only", "hidapi-orig", "SunPro", "PublicDomain_Sam_Lantinga", "PublicDomain_David_Ludwig", "BrownUn_UnCalifornia_ErikCorry", "Gareth_McCaughan", "RSA_Data_Security", "Mozilla-permissive", "MIT", "LGPL-2.1-or-later", "PublicDomain_Edgar_Simo", "BSD-3-clause-chromium", "MIT-open-group", "BSD-3-clause-kitware", "LGPL-2.1-only" ], "Maintainer": "Debian SDL packages maintainers \u003cpkg-sdl-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasound2@1.2.8-1+b1", "libc6@2.36-9+deb12u14", "libdecor-0-0@0.1.1-2", "libdrm2@2.4.114-1+b1", "libgbm1@22.3.6-1+deb12u2", "libpulse0@16.1+dfsg1-2+b1", "libsamplerate0@0.2.2-3", "libwayland-client0@1.21.0-1", "libwayland-cursor0@1.21.0-1", "libwayland-egl1@1.21.0-1", "libx11-6@2:1.8.4-2+deb12u2", "libxcursor1@1:1.2.1-1", "libxext6@2:1.3.4-1+b1", "libxfixes3@1:6.0.0-2", "libxi6@2:1.8-1+b1", "libxkbcommon0@1.5.0-1", "libxrandr2@2:1.5.2-2+b1", "libxss1@1:1.2.3-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libSDL2-2.0.so.0.2600.5", "/usr/share/doc/libsdl2-2.0-0/BUGS.txt", "/usr/share/doc/libsdl2-2.0-0/CREDITS.txt", "/usr/share/doc/libsdl2-2.0-0/README-SDL.txt", "/usr/share/doc/libsdl2-2.0-0/README.md", "/usr/share/doc/libsdl2-2.0-0/changelog.Debian.gz", "/usr/share/doc/libsdl2-2.0-0/changelog.gz", "/usr/share/doc/libsdl2-2.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libseccomp2@2.5.4-1+deb12u1", "Name": "libseccomp2", "Identifier": { "PURL": "pkg:deb/debian/libseccomp2@2.5.4-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "88ec7e73f2e0c3ca" }, "Version": "2.5.4", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "libseccomp", "SrcVersion": "2.5.4", "SrcRelease": "1+deb12u1", "Licenses": [ "LGPL-2.1-only" ], "Maintainer": "Kees Cook \u003ckees@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libseccomp.so.2.5.4", "/usr/share/doc/libseccomp2/changelog.Debian.gz", "/usr/share/doc/libseccomp2/changelog.gz", "/usr/share/doc/libseccomp2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libselinux1@3.4-1+b6", "Name": "libselinux1", "Identifier": { "PURL": "pkg:deb/debian/libselinux1@3.4-1%2Bb6?arch=amd64\u0026distro=debian-12.15", "UID": "a010ce2dff4f3211" }, "Version": "3.4", "Release": "1+b6", "Arch": "amd64", "SrcName": "libselinux", "SrcVersion": "3.4", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libpcre2-8-0@10.42-1" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libselinux.so.1", "/usr/share/doc/libselinux1/changelog.Debian.amd64.gz", "/usr/share/doc/libselinux1/changelog.Debian.gz", "/usr/share/doc/libselinux1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsemanage-common@3.4-1", "Name": "libsemanage-common", "Identifier": { "PURL": "pkg:deb/debian/libsemanage-common@3.4-1?arch=all\u0026distro=debian-12.15", "UID": "92dad50d9f4fd095" }, "Version": "3.4", "Release": "1", "Arch": "all", "SrcName": "libsemanage", "SrcVersion": "3.4", "SrcRelease": "1", "Licenses": [ "LGPL-2.0-or-later", "GPL-2.0-or-later" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/share/doc/libsemanage-common/changelog.Debian.gz", "/usr/share/doc/libsemanage-common/copyright", "/usr/share/man/man5/semanage.conf.5.gz", "/usr/share/man/ru/man5/semanage.conf.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libsemanage2@3.4-1+b5", "Name": "libsemanage2", "Identifier": { "PURL": "pkg:deb/debian/libsemanage2@3.4-1%2Bb5?arch=amd64\u0026distro=debian-12.15", "UID": "dbf1d8a820975a92" }, "Version": "3.4", "Release": "1+b5", "Arch": "amd64", "SrcName": "libsemanage", "SrcVersion": "3.4", "SrcRelease": "1", "Licenses": [ "LGPL-2.0-or-later", "GPL-2.0-or-later" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:3.0.9-1", "libbz2-1.0@1.0.8-5+b1", "libc6@2.36-9+deb12u14", "libselinux1@3.4-1+b6", "libsemanage-common@3.4-1", "libsepol2@3.4-2.1" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsemanage.so.2", "/usr/share/doc/libsemanage2/changelog.Debian.amd64.gz", "/usr/share/doc/libsemanage2/changelog.Debian.gz", "/usr/share/doc/libsemanage2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsensors-config@1:3.6.0-7.1", "Name": "libsensors-config", "Identifier": { "PURL": "pkg:deb/debian/libsensors-config@3.6.0-7.1?arch=all\u0026distro=debian-12.15\u0026epoch=1", "UID": "dc525d79586a8e4d" }, "Version": "3.6.0", "Release": "7.1", "Epoch": 1, "Arch": "all", "SrcName": "lm-sensors", "SrcVersion": "3.6.0", "SrcRelease": "7.1", "SrcEpoch": 1, "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Aurelien Jarno \u003caurel32@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/libsensors-config/changelog.Debian.gz", "/usr/share/doc/libsensors-config/changelog.gz", "/usr/share/doc/libsensors-config/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsensors5@1:3.6.0-7.1", "Name": "libsensors5", "Identifier": { "PURL": "pkg:deb/debian/libsensors5@3.6.0-7.1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "51fa04748aeb4797" }, "Version": "3.6.0", "Release": "7.1", "Epoch": 1, "Arch": "amd64", "SrcName": "lm-sensors", "SrcVersion": "3.6.0", "SrcRelease": "7.1", "SrcEpoch": 1, "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Aurelien Jarno \u003caurel32@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libsensors-config@1:3.6.0-7.1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsensors.so.5.0.0", "/usr/share/doc/libsensors5/README.Debian", "/usr/share/doc/libsensors5/changelog.Debian.gz", "/usr/share/doc/libsensors5/changelog.gz", "/usr/share/doc/libsensors5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsepol2@3.4-2.1", "Name": "libsepol2", "Identifier": { "PURL": "pkg:deb/debian/libsepol2@3.4-2.1?arch=amd64\u0026distro=debian-12.15", "UID": "ac408a49f94903ef" }, "Version": "3.4", "Release": "2.1", "Arch": "amd64", "SrcName": "libsepol", "SrcVersion": "3.4", "SrcRelease": "2.1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "Zlib", "GPL-2.0-only", "GPL-2.0-or-later" ], "Maintainer": "Debian SELinux maintainers \u003cselinux-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libsepol.so.2", "/usr/share/doc/libsepol2/changelog.Debian.gz", "/usr/share/doc/libsepol2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libserd-0-0@0.30.16-1", "Name": "libserd-0-0", "Identifier": { "PURL": "pkg:deb/debian/libserd-0-0@0.30.16-1?arch=amd64\u0026distro=debian-12.15", "UID": "b6b1828d7fd60349" }, "Version": "0.30.16", "Release": "1", "Arch": "amd64", "SrcName": "serd", "SrcVersion": "0.30.16", "SrcRelease": "1", "Licenses": [ "ISC" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libserd-0.so.0.30.16", "/usr/share/doc/libserd-0-0/changelog.Debian.gz", "/usr/share/doc/libserd-0-0/changelog.gz", "/usr/share/doc/libserd-0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libshine3@3.1.1-2", "Name": "libshine3", "Identifier": { "PURL": "pkg:deb/debian/libshine3@3.1.1-2?arch=amd64\u0026distro=debian-12.15", "UID": "2e43baf6ec55608c" }, "Version": "3.1.1", "Release": "2", "Arch": "amd64", "SrcName": "shine", "SrcVersion": "3.1.1", "SrcRelease": "2", "Licenses": [ "LGPL-2.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libshine.so.3.0.1", "/usr/share/doc/libshine3/changelog.Debian.gz", "/usr/share/doc/libshine3/changelog.gz", "/usr/share/doc/libshine3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libslang2@2.3.3-3", "Name": "libslang2", "Identifier": { "PURL": "pkg:deb/debian/libslang2@2.3.3-3?arch=amd64\u0026distro=debian-12.15", "UID": "ca72fa4542f28bda" }, "Version": "2.3.3", "Release": "3", "Arch": "amd64", "SrcName": "slang2", "SrcVersion": "2.3.3", "SrcRelease": "3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Alastair McKinstry \u003cmckinstry@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libslang.so.2.3.3", "/usr/share/doc/libslang2/NEWS.gz", "/usr/share/doc/libslang2/README", "/usr/share/doc/libslang2/changelog.Debian.gz", "/usr/share/doc/libslang2/changelog.gz", "/usr/share/doc/libslang2/copyright", "/usr/share/doc/libslang2/slang.txt.gz", "/usr/share/doc/libslang2/slangfun.txt.gz", "/usr/share/lintian/overrides/libslang2" ], "AnalyzedBy": "dpkg" }, { "ID": "libsmartcols1@2.38.1-5+deb12u3", "Name": "libsmartcols1", "Identifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "5724e02241dee022" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsmartcols.so.1.1.0", "/usr/share/doc/libsmartcols1/changelog.Debian.gz", "/usr/share/doc/libsmartcols1/changelog.gz", "/usr/share/doc/libsmartcols1/copyright", "/usr/share/lintian/overrides/libsmartcols1" ], "AnalyzedBy": "dpkg" }, { "ID": "libsnappy1v5@1.1.9-3", "Name": "libsnappy1v5", "Identifier": { "PURL": "pkg:deb/debian/libsnappy1v5@1.1.9-3?arch=amd64\u0026distro=debian-12.15", "UID": "449128ea45f1bce5" }, "Version": "1.1.9", "Release": "3", "Arch": "amd64", "SrcName": "snappy", "SrcVersion": "1.1.9", "SrcRelease": "3", "Licenses": [ "BSD-3-Clause", "CC-BY-3.0", "MIT", "CC-BY-4.0", "public-domain" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsnappy.so.1.1.9", "/usr/share/doc/libsnappy1v5/changelog.Debian.gz", "/usr/share/doc/libsnappy1v5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsndfile1@1.2.0-1+deb12u1", "Name": "libsndfile1", "Identifier": { "PURL": "pkg:deb/debian/libsndfile1@1.2.0-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "bb37a3f1a33c240e" }, "Version": "1.2.0", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "libsndfile", "SrcVersion": "1.2.0", "SrcRelease": "1+deb12u1", "Licenses": [ "LGPL-2.1-or-later", "gsm", "Apache-2.0", "sun", "GPL-2.0-or-later", "LGPL-2.0-or-later", "BSD-3-Clause", "BSD-2-Clause", "FSFAP", "GPL-3.0-or-later", "NTP", "LGPL-2.1-only", "LGPL-2.0-only", "GPL-2.0-only", "GPL-3.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libflac12@1.4.2+ds-2", "libmp3lame0@3.100-6", "libmpg123-0@1.31.2-1+deb12u1", "libogg0@1.3.5-3", "libopus0@1.3.1-3", "libvorbis0a@1.3.7-1", "libvorbisenc2@1.3.7-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsndfile.so.1.0.35", "/usr/share/doc/libsndfile1/changelog.Debian.gz", "/usr/share/doc/libsndfile1/changelog.gz", "/usr/share/doc/libsndfile1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsndio7.0@1.9.0-0.3+b2", "Name": "libsndio7.0", "Identifier": { "PURL": "pkg:deb/debian/libsndio7.0@1.9.0-0.3%2Bb2?arch=amd64\u0026distro=debian-12.15", "UID": "c819a501cc704388" }, "Version": "1.9.0", "Release": "0.3+b2", "Arch": "amd64", "SrcName": "sndio", "SrcVersion": "1.9.0", "SrcRelease": "0.3", "Licenses": [ "ISC", "ISC-packaging" ], "Maintainer": "Peter Piwowarski \u003cpeterjpiwowarski@gmail.com\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libasound2@1.2.8-1+b1", "libbsd0@0.11.7-2", "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsndio.so.7.2", "/usr/share/doc/libsndio7.0/README.Debian", "/usr/share/doc/libsndio7.0/changelog.Debian.amd64.gz", "/usr/share/doc/libsndio7.0/changelog.Debian.gz", "/usr/share/doc/libsndio7.0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsodium23@1.0.18-1+deb12u1", "Name": "libsodium23", "Identifier": { "PURL": "pkg:deb/debian/libsodium23@1.0.18-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "c5695ccb57b2956a" }, "Version": "1.0.18", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "libsodium", "SrcVersion": "1.0.18", "SrcRelease": "1+deb12u1", "Licenses": [ "ISC", "BSD-2-Clause", "public-domain", "CC0-1.0", "MIT", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsodium.so.23.3.0", "/usr/share/doc/libsodium23/AUTHORS.gz", "/usr/share/doc/libsodium23/README.markdown", "/usr/share/doc/libsodium23/THANKS", "/usr/share/doc/libsodium23/changelog.Debian.gz", "/usr/share/doc/libsodium23/changelog.gz", "/usr/share/doc/libsodium23/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsord-0-0@0.16.14+git221008-1", "Name": "libsord-0-0", "Identifier": { "PURL": "pkg:deb/debian/libsord-0-0@0.16.14%2Bgit221008-1?arch=amd64\u0026distro=debian-12.15", "UID": "81999b82343ca02" }, "Version": "0.16.14+git221008", "Release": "1", "Arch": "amd64", "SrcName": "sord", "SrcVersion": "0.16.14+git221008", "SrcRelease": "1", "Licenses": [ "ISC" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libserd-0-0@0.30.16-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsord-0.so.0.16.15", "/usr/share/doc/libsord-0-0/changelog.Debian.gz", "/usr/share/doc/libsord-0-0/changelog.gz", "/usr/share/doc/libsord-0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsoxr0@0.1.3-4", "Name": "libsoxr0", "Identifier": { "PURL": "pkg:deb/debian/libsoxr0@0.1.3-4?arch=amd64\u0026distro=debian-12.15", "UID": "eb1607b799ac444" }, "Version": "0.1.3", "Release": "4", "Arch": "amd64", "SrcName": "libsoxr", "SrcVersion": "0.1.3", "SrcRelease": "4", "Licenses": [ "LGPL-2.1-or-later", "Spherepack", "permissive1", "permissive2", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgomp1@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsoxr.so.0.1.2", "/usr/share/doc/libsoxr0/changelog.Debian.gz", "/usr/share/doc/libsoxr0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libspeex1@1.2.1-2", "Name": "libspeex1", "Identifier": { "PURL": "pkg:deb/debian/libspeex1@1.2.1-2?arch=amd64\u0026distro=debian-12.15", "UID": "cb790490c5872c5" }, "Version": "1.2.1", "Release": "2", "Arch": "amd64", "SrcName": "speex", "SrcVersion": "1.2.1", "SrcRelease": "2", "Licenses": [ "BSD-3-Clause", "GFDL-1.1-or-later", "custom-1", "LGPL-2.0-or-later", "LGPL-2.0-only", "GFDL-1.2-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libspeex.so.1.5.2", "/usr/share/doc/libspeex1/changelog.Debian.gz", "/usr/share/doc/libspeex1/changelog.gz", "/usr/share/doc/libspeex1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsphinxbase3@0.8+5prealpha+1-16", "Name": "libsphinxbase3", "Identifier": { "PURL": "pkg:deb/debian/libsphinxbase3@0.8%2B5prealpha%2B1-16?arch=amd64\u0026distro=debian-12.15", "UID": "65cfebeab755a22f" }, "Version": "0.8+5prealpha+1", "Release": "16", "Arch": "amd64", "SrcName": "sphinxbase", "SrcVersion": "0.8+5prealpha+1", "SrcRelease": "16", "Licenses": [ "BSD-2-Clause", "BSD-3-clause-carnegie", "BSD-2-clause-beyond", "u-o-tennesee", "lucent", "BSD-3-Clause", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Accessibility Team \u003cpkg-a11y-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libblas3@3.11.0-2", "libc6@2.36-9+deb12u14", "liblapack3@3.11.0-2", "libpulse0@16.1+dfsg1-2+b1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsphinxad.so.3.0.0", "/usr/lib/x86_64-linux-gnu/libsphinxbase.so.3.0.0", "/usr/share/doc/libsphinxbase3/changelog.Debian.gz", "/usr/share/doc/libsphinxbase3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsratom-0-0@0.6.14-1", "Name": "libsratom-0-0", "Identifier": { "PURL": "pkg:deb/debian/libsratom-0-0@0.6.14-1?arch=amd64\u0026distro=debian-12.15", "UID": "75b628c1e38f4200" }, "Version": "0.6.14", "Release": "1", "Arch": "amd64", "SrcName": "sratom", "SrcVersion": "0.6.14", "SrcRelease": "1", "Licenses": [ "ISC" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libserd-0-0@0.30.16-1", "libsord-0-0@0.16.14+git221008-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsratom-0.so.0.6.14", "/usr/share/doc/libsratom-0-0/changelog.Debian.gz", "/usr/share/doc/libsratom-0-0/changelog.gz", "/usr/share/doc/libsratom-0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libsrt1.5-gnutls@1.5.1-1+deb12u1", "Name": "libsrt1.5-gnutls", "Identifier": { "PURL": "pkg:deb/debian/libsrt1.5-gnutls@1.5.1-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "b5cb6c92aaa5f2ac" }, "Version": "1.5.1", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "srt", "SrcVersion": "1.5.1", "SrcRelease": "1+deb12u1", "Licenses": [ "MPL-2.0", "BSD-3-Clause", "Zlib", "Unlicense", "LGPL-2.1-or-later", "LGPL-2.1-only" ], "Maintainer": "Florian Ernst \u003cflorian@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libgnutls30@3.7.9-2+deb12u7", "libnettle8@3.8.1-2", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsrt-gnutls.so.1.5.1", "/usr/share/doc/libsrt1.5-gnutls/changelog.Debian.gz", "/usr/share/doc/libsrt1.5-gnutls/copyright", "/usr/share/lintian/overrides/libsrt1.5-gnutls" ], "AnalyzedBy": "dpkg" }, { "ID": "libss2@1.47.0-2+b2", "Name": "libss2", "Identifier": { "PURL": "pkg:deb/debian/libss2@1.47.0-2%2Bb2?arch=amd64\u0026distro=debian-12.15", "UID": "ccae692f48632a09" }, "Version": "1.47.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.0", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.0-only", "BSD-3-Clause", "Apache-2.0", "ISC", "GPL-2.0-or-later", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libcom-err2@1.47.0-2+b2" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libss.so.2.0", "/usr/share/doc/libss2/changelog.Debian.amd64.gz", "/usr/share/doc/libss2/changelog.Debian.gz", "/usr/share/doc/libss2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "Name": "libssh-gcrypt-4", "Identifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "Version": "0.10.6", "Release": "0+deb12u2", "Arch": "amd64", "SrcName": "libssh", "SrcVersion": "0.10.6", "SrcRelease": "0+deb12u2", "Licenses": [ "LGPL-2.1+~OpenSSL", "public-domain", "LGPL-2.1-only", "BSD-2-Clause", "BSD-3-Clause" ], "Maintainer": "Laurent Bigonville \u003cbigon@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcrypt20@1.10.1-3+deb12u1", "libgpg-error0@1.46-1", "libgssapi-krb5-2@1.20.1-2+deb12u5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libssh-gcrypt.so.4.9.6", "/usr/share/doc/libssh-gcrypt-4/changelog.Debian.gz", "/usr/share/doc/libssh-gcrypt-4/changelog.gz", "/usr/share/doc/libssh-gcrypt-4/copyright", "/usr/share/lintian/overrides/libssh-gcrypt-4" ], "AnalyzedBy": "dpkg" }, { "ID": "libssl3@3.0.20-1~deb12u2", "Name": "libssl3", "Identifier": { "PURL": "pkg:deb/debian/libssl3@3.0.20-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "2291278c434e08b5" }, "Version": "3.0.20", "Release": "1~deb12u2", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.0.20", "SrcRelease": "1~deb12u2", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/engines-3/afalg.so", "/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so", "/usr/lib/x86_64-linux-gnu/engines-3/padlock.so", "/usr/lib/x86_64-linux-gnu/libcrypto.so.3", "/usr/lib/x86_64-linux-gnu/libssl.so.3", "/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so", "/usr/share/doc/libssl3/changelog.Debian.gz", "/usr/share/doc/libssl3/changelog.gz", "/usr/share/doc/libssl3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libstdc++6@12.2.0-14+deb12u1", "Name": "libstdc++6", "Identifier": { "PURL": "pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "4d5941cb5d8b3963" }, "Version": "12.2.0", "Release": "14+deb12u1", "Arch": "amd64", "SrcName": "gcc-12", "SrcVersion": "12.2.0", "SrcRelease": "14+deb12u1", "Maintainer": "Debian GCC Maintainers \u003cdebian-gcc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "gcc-12-base@12.2.0-14+deb12u1", "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.30", "/usr/share/gcc/python/libstdcxx/__init__.py", "/usr/share/gcc/python/libstdcxx/v6/__init__.py", "/usr/share/gcc/python/libstdcxx/v6/printers.py", "/usr/share/gcc/python/libstdcxx/v6/xmethods.py", "/usr/share/gdb/auto-load/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.30-gdb.py" ], "AnalyzedBy": "dpkg" }, { "ID": "libsvtav1enc1@1.4.1+dfsg-1", "Name": "libsvtav1enc1", "Identifier": { "PURL": "pkg:deb/debian/libsvtav1enc1@1.4.1%2Bdfsg-1?arch=amd64\u0026distro=debian-12.15", "UID": "89ea7e2f549f4290" }, "Version": "1.4.1+dfsg", "Release": "1", "Arch": "amd64", "SrcName": "svt-av1", "SrcVersion": "1.4.1+dfsg", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause-Clear", "LGPL-2.1-or-later", "ISC", "MIT", "BSD-2-Clause", "BSD-3-Clause", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libSvtAv1Enc.so.1.4.1", "/usr/share/doc/libsvtav1enc1/changelog.Debian.gz", "/usr/share/doc/libsvtav1enc1/changelog.gz", "/usr/share/doc/libsvtav1enc1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libswresample4@7:5.1.9-0+deb12u1", "Name": "libswresample4", "Identifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "Version": "5.1.9", "Release": "0+deb12u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "5.1.9", "SrcRelease": "0+deb12u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavutil57@7:5.1.9-0+deb12u1", "libc6@2.36-9+deb12u14", "libsoxr0@0.1.3-4" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libswresample.so.4.7.100", "/usr/share/doc/libswresample4/changelog.Debian.gz", "/usr/share/doc/libswresample4/changelog.gz", "/usr/share/doc/libswresample4/copyright", "/usr/share/lintian/overrides/libswresample4" ], "AnalyzedBy": "dpkg" }, { "ID": "libswscale6@7:5.1.9-0+deb12u1", "Name": "libswscale6", "Identifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "Version": "5.1.9", "Release": "0+deb12u1", "Epoch": 7, "Arch": "amd64", "SrcName": "ffmpeg", "SrcVersion": "5.1.9", "SrcRelease": "0+deb12u1", "SrcEpoch": 7, "Licenses": [ "LGPL-2.1-or-later", "Sundry", "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "GPL-3.0-only", "MIT", "BSD-3-Clause", "public-domain", "ISC", "IJG", "BSD-2-Clause", "Zlib", "BSD-1-Clause", "LGPL-2.0-or-later", "BSL-1.0", "man-page", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libavutil57@7:5.1.9-0+deb12u1", "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libswscale.so.6.7.100", "/usr/share/doc/libswscale6/changelog.Debian.gz", "/usr/share/doc/libswscale6/changelog.gz", "/usr/share/doc/libswscale6/copyright", "/usr/share/lintian/overrides/libswscale6" ], "AnalyzedBy": "dpkg" }, { "ID": "libsystemd0@252.39-1~deb12u2", "Name": "libsystemd0", "Identifier": { "PURL": "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "39a9ef8237c534db" }, "Version": "252.39", "Release": "1~deb12u2", "Arch": "amd64", "SrcName": "systemd", "SrcVersion": "252.39", "SrcRelease": "1~deb12u2", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "GPL-2 with Linux-syscall-note exception", "MIT", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libcap2@1:2.66-4+deb12u3+b1", "libgcrypt20@1.10.1-3+deb12u1", "liblz4-1@1.9.4-1", "liblzma5@5.4.1-1+deb12u1", "libzstd1@1.5.4+dfsg2-5" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libsystemd.so.0.35.0", "/usr/share/doc/libsystemd0/NEWS.Debian.gz", "/usr/share/doc/libsystemd0/changelog.Debian.gz", "/usr/share/doc/libsystemd0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtasn1-6@4.19.0-2+deb12u1", "Name": "libtasn1-6", "Identifier": { "PURL": "pkg:deb/debian/libtasn1-6@4.19.0-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "484c57438715f01f" }, "Version": "4.19.0", "Release": "2+deb12u1", "Arch": "amd64", "SrcName": "libtasn1-6", "SrcVersion": "4.19.0", "SrcRelease": "2+deb12u1", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.1-only", "GPL-3.0-only", "GFDL-1.3-only" ], "Maintainer": "Debian GnuTLS Maintainers \u003cpkg-gnutls-maint@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtasn1.so.6.6.3", "/usr/share/doc/libtasn1-6/AUTHORS", "/usr/share/doc/libtasn1-6/README.md", "/usr/share/doc/libtasn1-6/THANKS", "/usr/share/doc/libtasn1-6/changelog.Debian.gz", "/usr/share/doc/libtasn1-6/changelog.gz", "/usr/share/doc/libtasn1-6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libthai-data@0.1.29-1", "Name": "libthai-data", "Identifier": { "PURL": "pkg:deb/debian/libthai-data@0.1.29-1?arch=all\u0026distro=debian-12.15", "UID": "676267aadd4bf8a5" }, "Version": "0.1.29", "Release": "1", "Arch": "all", "SrcName": "libthai", "SrcVersion": "0.1.29", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Theppitak Karoonboonyanan \u003cthep@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/libthai-data/changelog.Debian.gz", "/usr/share/doc/libthai-data/changelog.gz", "/usr/share/doc/libthai-data/copyright", "/usr/share/libthai/thbrk.tri" ], "AnalyzedBy": "dpkg" }, { "ID": "libthai0@0.1.29-1", "Name": "libthai0", "Identifier": { "PURL": "pkg:deb/debian/libthai0@0.1.29-1?arch=amd64\u0026distro=debian-12.15", "UID": "7180f8a38da6b55f" }, "Version": "0.1.29", "Release": "1", "Arch": "amd64", "SrcName": "libthai", "SrcVersion": "0.1.29", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "LGPL-2.1-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Theppitak Karoonboonyanan \u003cthep@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdatrie1@0.2.13-2+b1", "libthai-data@0.1.29-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libthai.so.0.3.1", "/usr/share/doc/libthai0/changelog.Debian.gz", "/usr/share/doc/libthai0/changelog.gz", "/usr/share/doc/libthai0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtheora0@1.1.1+dfsg.1-16.1+deb12u1", "Name": "libtheora0", "Identifier": { "PURL": "pkg:deb/debian/libtheora0@1.1.1%2Bdfsg.1-16.1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "2b4af0e14c9e90de" }, "Version": "1.1.1+dfsg.1", "Release": "16.1+deb12u1", "Arch": "amd64", "SrcName": "libtheora", "SrcVersion": "1.1.1+dfsg.1", "SrcRelease": "16.1+deb12u1", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libcairo2@1.16.0-7", "libogg0@1.3.5-3" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtheora.so.0.3.10", "/usr/lib/x86_64-linux-gnu/libtheoradec.so.1.1.4", "/usr/lib/x86_64-linux-gnu/libtheoraenc.so.1.1.2", "/usr/share/doc/libtheora0/changelog.Debian.gz", "/usr/share/doc/libtheora0/changelog.gz", "/usr/share/doc/libtheora0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtiff6@4.5.0-6+deb12u4", "Name": "libtiff6", "Identifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "Version": "4.5.0", "Release": "6+deb12u4", "Arch": "amd64", "SrcName": "tiff", "SrcVersion": "4.5.0", "SrcRelease": "6+deb12u4", "Licenses": [ "Hylafax" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdeflate0@1.14-1", "libjbig0@2.1-6.1", "libjpeg62-turbo@1:2.1.5-2", "liblerc4@4.0.0+ds-2", "liblzma5@5.4.1-1+deb12u1", "libwebp7@1.2.4-0.2+deb12u1", "libzstd1@1.5.4+dfsg2-5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtiff.so.6.0.0", "/usr/share/doc/libtiff6/changelog.Debian.gz", "/usr/share/doc/libtiff6/changelog.gz", "/usr/share/doc/libtiff6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtinfo6@6.4-4", "Name": "libtinfo6", "Identifier": { "PURL": "pkg:deb/debian/libtinfo6@6.4-4?arch=amd64\u0026distro=debian-12.15", "UID": "35a440edb17e1ce3" }, "Version": "6.4", "Release": "4", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.4", "SrcRelease": "4", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Craig Small \u003ccsmall@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libtinfo.so.6.4", "/usr/lib/x86_64-linux-gnu/libtic.so.6.4", "/usr/share/doc/libtinfo6/changelog.Debian.gz", "/usr/share/doc/libtinfo6/changelog.gz", "/usr/share/doc/libtinfo6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libtwolame0@0.4.0-2", "Name": "libtwolame0", "Identifier": { "PURL": "pkg:deb/debian/libtwolame0@0.4.0-2?arch=amd64\u0026distro=debian-12.15", "UID": "96426089ddcef4d2" }, "Version": "0.4.0", "Release": "2", "Arch": "amd64", "SrcName": "twolame", "SrcVersion": "0.4.0", "SrcRelease": "2", "Licenses": [ "LGPL-2.0-or-later", "LGPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libtwolame.so.0.0.0", "/usr/share/doc/libtwolame0/changelog.Debian.gz", "/usr/share/doc/libtwolame0/changelog.gz", "/usr/share/doc/libtwolame0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libudev1@252.39-1~deb12u2", "Name": "libudev1", "Identifier": { "PURL": "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3c4724c0041c8265" }, "Version": "252.39", "Release": "1~deb12u2", "Arch": "amd64", "SrcName": "systemd", "SrcVersion": "252.39", "SrcRelease": "1~deb12u2", "Licenses": [ "LGPL-2.1-or-later", "CC0-1.0", "GPL-2 with Linux-syscall-note exception", "MIT", "public-domain", "GPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian systemd Maintainers \u003cpkg-systemd-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libudev.so.1.7.5", "/usr/share/doc/libudev1/NEWS.Debian.gz", "/usr/share/doc/libudev1/changelog.Debian.gz", "/usr/share/doc/libudev1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libudfread0@1.1.2-1", "Name": "libudfread0", "Identifier": { "PURL": "pkg:deb/debian/libudfread0@1.1.2-1?arch=amd64\u0026distro=debian-12.15", "UID": "f9a440280af6ede" }, "Version": "1.1.2", "Release": "1", "Arch": "amd64", "SrcName": "libudfread", "SrcVersion": "1.1.2", "SrcRelease": "1", "Licenses": [ "LGPL-2.1-or-later", "GPL-2+ with autoconf-macro exception", "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libudfread.so.0.1.0", "/usr/share/doc/libudfread0/changelog.Debian.gz", "/usr/share/doc/libudfread0/changelog.gz", "/usr/share/doc/libudfread0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libunistring2@1.0-2", "Name": "libunistring2", "Identifier": { "PURL": "pkg:deb/debian/libunistring2@1.0-2?arch=amd64\u0026distro=debian-12.15", "UID": "70fad769e12ed4a0" }, "Version": "1.0", "Release": "2", "Arch": "amd64", "SrcName": "libunistring", "SrcVersion": "1.0", "SrcRelease": "2", "Licenses": [ "LGPL-3.0-or-later", "GPL-2.0-or-later", "FreeSoftware", "GPL-3.0-or-later", "GFDL-1.2-or-later", "GPL-2+ with distribution exception", "MIT", "LGPL-3.0-only", "GPL-3.0-only", "GPL-2.0-only", "GFDL-1.2-only" ], "Maintainer": "Jörg Frings-Fürst \u003cdebian@jff.email\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libunistring.so.2.2.0", "/usr/share/doc/libunistring2/changelog.Debian.gz", "/usr/share/doc/libunistring2/changelog.gz", "/usr/share/doc/libunistring2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libusb-1.0-0@2:1.0.26-1", "Name": "libusb-1.0-0", "Identifier": { "PURL": "pkg:deb/debian/libusb-1.0-0@1.0.26-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "135a14008821d03b" }, "Version": "1.0.26", "Release": "1", "Epoch": 2, "Arch": "amd64", "SrcName": "libusb-1.0", "SrcVersion": "1.0.26", "SrcRelease": "1", "SrcEpoch": 2, "Licenses": [ "LGPL-2.1-only", "GPL-2.0-only" ], "Maintainer": "Aurelien Jarno \u003caurel32@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libudev1@252.39-1~deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libusb-1.0.so.0.3.0", "/usr/share/doc/libusb-1.0-0/README", "/usr/share/doc/libusb-1.0-0/changelog.Debian.gz", "/usr/share/doc/libusb-1.0-0/changelog.gz", "/usr/share/doc/libusb-1.0-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libuuid1@2.38.1-5+deb12u3", "Name": "libuuid1", "Identifier": { "PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d649adb64a1fff7d" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0", "/usr/share/doc/libuuid1/changelog.Debian.gz", "/usr/share/doc/libuuid1/changelog.gz", "/usr/share/doc/libuuid1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libva-drm2@2.17.0-1", "Name": "libva-drm2", "Identifier": { "PURL": "pkg:deb/debian/libva-drm2@2.17.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "a7534f03103d3f61" }, "Version": "2.17.0", "Release": "1", "Arch": "amd64", "SrcName": "libva", "SrcVersion": "2.17.0", "SrcRelease": "1", "Licenses": [ "MIT", "Expat-advertising", "other", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm2@2.4.114-1+b1", "libva2@2.17.0-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libva-drm.so.2.1700.0", "/usr/share/doc/libva-drm2/changelog.Debian.gz", "/usr/share/doc/libva-drm2/changelog.gz", "/usr/share/doc/libva-drm2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libva-wayland2@2.17.0-1", "Name": "libva-wayland2", "Identifier": { "PURL": "pkg:deb/debian/libva-wayland2@2.17.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "d31195b3c29ddeb4" }, "Version": "2.17.0", "Release": "1", "Arch": "amd64", "SrcName": "libva", "SrcVersion": "2.17.0", "SrcRelease": "1", "Licenses": [ "MIT", "Expat-advertising", "other", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm2@2.4.114-1+b1", "libva2@2.17.0-1", "libwayland-client0@1.21.0-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libva-wayland.so.2.1700.0", "/usr/share/doc/libva-wayland2/changelog.Debian.gz", "/usr/share/doc/libva-wayland2/changelog.gz", "/usr/share/doc/libva-wayland2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libva-x11-2@2.17.0-1", "Name": "libva-x11-2", "Identifier": { "PURL": "pkg:deb/debian/libva-x11-2@2.17.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "ecc39b20117ea1e8" }, "Version": "2.17.0", "Release": "1", "Arch": "amd64", "SrcName": "libva", "SrcVersion": "2.17.0", "SrcRelease": "1", "Licenses": [ "MIT", "Expat-advertising", "other", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm2@2.4.114-1+b1", "libva2@2.17.0-1", "libx11-6@2:1.8.4-2+deb12u2", "libx11-xcb1@2:1.8.4-2+deb12u2", "libxcb-dri3-0@1.15-1", "libxcb1@1.15-1", "libxext6@2:1.3.4-1+b1", "libxfixes3@1:6.0.0-2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libva-x11.so.2.1700.0", "/usr/share/doc/libva-x11-2/changelog.Debian.gz", "/usr/share/doc/libva-x11-2/changelog.gz", "/usr/share/doc/libva-x11-2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libva2@2.17.0-1", "Name": "libva2", "Identifier": { "PURL": "pkg:deb/debian/libva2@2.17.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "9c3404316fc3ab93" }, "Version": "2.17.0", "Release": "1", "Arch": "amd64", "SrcName": "libva", "SrcVersion": "2.17.0", "SrcRelease": "1", "Licenses": [ "MIT", "Expat-advertising", "other", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libva.so.2.1700.0", "/usr/share/doc/libva2/changelog.Debian.gz", "/usr/share/doc/libva2/changelog.gz", "/usr/share/doc/libva2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvdpau1@1.5-2", "Name": "libvdpau1", "Identifier": { "PURL": "pkg:deb/debian/libvdpau1@1.5-2?arch=amd64\u0026distro=debian-12.15", "UID": "83e8f20942ffbb54" }, "Version": "1.5", "Release": "2", "Arch": "amd64", "SrcName": "libvdpau", "SrcVersion": "1.5", "SrcRelease": "2", "Licenses": [ "MIT", "other" ], "Maintainer": "Debian NVIDIA Maintainers \u003cpkg-nvidia-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libx11-6@2:1.8.4-2+deb12u2", "libxext6@2:1.3.4-1+b1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvdpau.so.1.0.0", "/usr/lib/x86_64-linux-gnu/vdpau/libvdpau_trace.so.1.0.0", "/usr/share/bug/libvdpau1", "/usr/share/doc/libvdpau1/changelog.Debian.gz", "/usr/share/doc/libvdpau1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvidstab1.1@1.1.0-2+b1", "Name": "libvidstab1.1", "Identifier": { "PURL": "pkg:deb/debian/libvidstab1.1@1.1.0-2%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "dcab132b940c28cf" }, "Version": "1.1.0", "Release": "2+b1", "Arch": "amd64", "SrcName": "libvidstab", "SrcVersion": "1.1.0", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Keng-Yu Lin \u003ckengyu@lexical.tw\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgomp1@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvidstab.so.1.1", "/usr/share/doc/libvidstab1.1/changelog.Debian.amd64.gz", "/usr/share/doc/libvidstab1.1/changelog.Debian.gz", "/usr/share/doc/libvidstab1.1/changelog.gz", "/usr/share/doc/libvidstab1.1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvorbis0a@1.3.7-1", "Name": "libvorbis0a", "Identifier": { "PURL": "pkg:deb/debian/libvorbis0a@1.3.7-1?arch=amd64\u0026distro=debian-12.15", "UID": "9ecafce761ca455d" }, "Version": "1.3.7", "Release": "1", "Arch": "amd64", "SrcName": "libvorbis", "SrcVersion": "1.3.7", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "RFC-special" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libogg0@1.3.5-3" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvorbis.so.0.4.9", "/usr/share/doc/libvorbis0a/changelog.Debian.gz", "/usr/share/doc/libvorbis0a/changelog.gz", "/usr/share/doc/libvorbis0a/copyright", "/usr/share/lintian/overrides/libvorbis0a" ], "AnalyzedBy": "dpkg" }, { "ID": "libvorbisenc2@1.3.7-1", "Name": "libvorbisenc2", "Identifier": { "PURL": "pkg:deb/debian/libvorbisenc2@1.3.7-1?arch=amd64\u0026distro=debian-12.15", "UID": "d30cf62d397c0395" }, "Version": "1.3.7", "Release": "1", "Arch": "amd64", "SrcName": "libvorbis", "SrcVersion": "1.3.7", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "RFC-special" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libvorbis0a@1.3.7-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvorbisenc.so.2.0.12", "/usr/share/doc/libvorbisenc2/changelog.Debian.gz", "/usr/share/doc/libvorbisenc2/changelog.gz", "/usr/share/doc/libvorbisenc2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvorbisfile3@1.3.7-1", "Name": "libvorbisfile3", "Identifier": { "PURL": "pkg:deb/debian/libvorbisfile3@1.3.7-1?arch=amd64\u0026distro=debian-12.15", "UID": "befe470f4933a8a5" }, "Version": "1.3.7", "Release": "1", "Arch": "amd64", "SrcName": "libvorbis", "SrcVersion": "1.3.7", "SrcRelease": "1", "Licenses": [ "BSD-3-Clause", "RFC-special" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libogg0@1.3.5-3", "libvorbis0a@1.3.7-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvorbisfile.so.3.3.8", "/usr/share/doc/libvorbisfile3/changelog.Debian.gz", "/usr/share/doc/libvorbisfile3/changelog.gz", "/usr/share/doc/libvorbisfile3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvpx7@1.12.0-1+deb12u5", "Name": "libvpx7", "Identifier": { "PURL": "pkg:deb/debian/libvpx7@1.12.0-1%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "725196e7971f22e3" }, "Version": "1.12.0", "Release": "1+deb12u5", "Arch": "amd64", "SrcName": "libvpx", "SrcVersion": "1.12.0", "SrcRelease": "1+deb12u5", "Licenses": [ "BSD-3-Clause", "public-domain", "ISC" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvpx.so.7.1.0", "/usr/share/doc/libvpx7/changelog.Debian.gz", "/usr/share/doc/libvpx7/changelog.gz", "/usr/share/doc/libvpx7/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libvulkan1@1.3.239.0-1", "Name": "libvulkan1", "Identifier": { "PURL": "pkg:deb/debian/libvulkan1@1.3.239.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "964510e5476d39f8" }, "Version": "1.3.239.0", "Release": "1", "Arch": "amd64", "SrcName": "vulkan-loader", "SrcVersion": "1.3.239.0", "SrcRelease": "1", "Licenses": [ "Apache-2.0", "MIT" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libvulkan.so.1.3.239", "/usr/share/doc/libvulkan1/changelog.Debian.gz", "/usr/share/doc/libvulkan1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwayland-client0@1.21.0-1", "Name": "libwayland-client0", "Identifier": { "PURL": "pkg:deb/debian/libwayland-client0@1.21.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "2bd76ee8563f6fab" }, "Version": "1.21.0", "Release": "1", "Arch": "amd64", "SrcName": "wayland", "SrcVersion": "1.21.0", "SrcRelease": "1", "Licenses": [ "X11" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libffi8@3.4.4-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwayland-client.so.0.21.0", "/usr/share/doc/libwayland-client0/changelog.Debian.gz", "/usr/share/doc/libwayland-client0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwayland-cursor0@1.21.0-1", "Name": "libwayland-cursor0", "Identifier": { "PURL": "pkg:deb/debian/libwayland-cursor0@1.21.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "c406c6a39f4e9979" }, "Version": "1.21.0", "Release": "1", "Arch": "amd64", "SrcName": "wayland", "SrcVersion": "1.21.0", "SrcRelease": "1", "Licenses": [ "X11" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libwayland-client0@1.21.0-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwayland-cursor.so.0.21.0", "/usr/share/doc/libwayland-cursor0/changelog.Debian.gz", "/usr/share/doc/libwayland-cursor0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwayland-egl1@1.21.0-1", "Name": "libwayland-egl1", "Identifier": { "PURL": "pkg:deb/debian/libwayland-egl1@1.21.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "8a69b89f41a9b750" }, "Version": "1.21.0", "Release": "1", "Arch": "amd64", "SrcName": "wayland", "SrcVersion": "1.21.0", "SrcRelease": "1", "Licenses": [ "X11" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwayland-egl.so.1.21.0", "/usr/share/doc/libwayland-egl1/changelog.Debian.gz", "/usr/share/doc/libwayland-egl1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwayland-server0@1.21.0-1", "Name": "libwayland-server0", "Identifier": { "PURL": "pkg:deb/debian/libwayland-server0@1.21.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "f8bc8a6ff7a3c910" }, "Version": "1.21.0", "Release": "1", "Arch": "amd64", "SrcName": "wayland", "SrcVersion": "1.21.0", "SrcRelease": "1", "Licenses": [ "X11" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libffi8@3.4.4-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwayland-server.so.0.21.0", "/usr/share/doc/libwayland-server0/changelog.Debian.gz", "/usr/share/doc/libwayland-server0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwebp7@1.2.4-0.2+deb12u1", "Name": "libwebp7", "Identifier": { "PURL": "pkg:deb/debian/libwebp7@1.2.4-0.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "43a59d4232ea5f77" }, "Version": "1.2.4", "Release": "0.2+deb12u1", "Arch": "amd64", "SrcName": "libwebp", "SrcVersion": "1.2.4", "SrcRelease": "0.2+deb12u1", "Licenses": [ "Apache-2.0" ], "Maintainer": "Jeff Breidenbach \u003cjab@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwebp.so.7.1.5", "/usr/share/doc/libwebp7/changelog.Debian.gz", "/usr/share/doc/libwebp7/changelog.gz", "/usr/share/doc/libwebp7/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libwebpmux3@1.2.4-0.2+deb12u1", "Name": "libwebpmux3", "Identifier": { "PURL": "pkg:deb/debian/libwebpmux3@1.2.4-0.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "7d86ab7809c0e3ee" }, "Version": "1.2.4", "Release": "0.2+deb12u1", "Arch": "amd64", "SrcName": "libwebp", "SrcVersion": "1.2.4", "SrcRelease": "0.2+deb12u1", "Licenses": [ "Apache-2.0" ], "Maintainer": "Jeff Breidenbach \u003cjab@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libwebp7@1.2.4-0.2+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libwebpmux.so.3.0.10", "/usr/share/doc/libwebpmux3/changelog.Debian.gz", "/usr/share/doc/libwebpmux3/changelog.gz", "/usr/share/doc/libwebpmux3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libx11-6@2:1.8.4-2+deb12u2", "Name": "libx11-6", "Identifier": { "PURL": "pkg:deb/debian/libx11-6@1.8.4-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "796f11d9d5f6726a" }, "Version": "1.8.4", "Release": "2+deb12u2", "Epoch": 2, "Arch": "amd64", "SrcName": "libx11", "SrcVersion": "1.8.4", "SrcRelease": "2+deb12u2", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libx11-data@2:1.8.4-2+deb12u2", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libX11.so.6.4.0", "/usr/share/doc/libx11-6/NEWS.Debian.gz", "/usr/share/doc/libx11-6/changelog.Debian.gz", "/usr/share/doc/libx11-6/changelog.gz", "/usr/share/doc/libx11-6/copyright", "/usr/share/lintian/overrides/libx11-6" ], "AnalyzedBy": "dpkg" }, { "ID": "libx11-data@2:1.8.4-2+deb12u2", "Name": "libx11-data", "Identifier": { "PURL": "pkg:deb/debian/libx11-data@1.8.4-2%2Bdeb12u2?arch=all\u0026distro=debian-12.15\u0026epoch=2", "UID": "f827acf1217240fc" }, "Version": "1.8.4", "Release": "2+deb12u2", "Epoch": 2, "Arch": "all", "SrcName": "libx11", "SrcVersion": "1.8.4", "SrcRelease": "2+deb12u2", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/X11/XErrorDB", "/usr/share/X11/locale/C/Compose", "/usr/share/X11/locale/C/XI18N_OBJS", "/usr/share/X11/locale/C/XLC_LOCALE", "/usr/share/X11/locale/am_ET.UTF-8/Compose", "/usr/share/X11/locale/am_ET.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/am_ET.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/armscii-8/Compose", "/usr/share/X11/locale/armscii-8/XI18N_OBJS", "/usr/share/X11/locale/armscii-8/XLC_LOCALE", "/usr/share/X11/locale/compose.dir", "/usr/share/X11/locale/cs_CZ.UTF-8/Compose", "/usr/share/X11/locale/cs_CZ.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/cs_CZ.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/el_GR.UTF-8/Compose", "/usr/share/X11/locale/el_GR.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/el_GR.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/en_US.UTF-8/Compose", "/usr/share/X11/locale/en_US.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/en_US.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/fi_FI.UTF-8/Compose", "/usr/share/X11/locale/fi_FI.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/fi_FI.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/georgian-academy/Compose", "/usr/share/X11/locale/georgian-academy/XI18N_OBJS", "/usr/share/X11/locale/georgian-academy/XLC_LOCALE", "/usr/share/X11/locale/georgian-ps/Compose", "/usr/share/X11/locale/georgian-ps/XI18N_OBJS", "/usr/share/X11/locale/georgian-ps/XLC_LOCALE", "/usr/share/X11/locale/ibm-cp1133/Compose", "/usr/share/X11/locale/ibm-cp1133/XI18N_OBJS", "/usr/share/X11/locale/ibm-cp1133/XLC_LOCALE", "/usr/share/X11/locale/iscii-dev/Compose", "/usr/share/X11/locale/iscii-dev/XI18N_OBJS", "/usr/share/X11/locale/iscii-dev/XLC_LOCALE", "/usr/share/X11/locale/isiri-3342/Compose", "/usr/share/X11/locale/isiri-3342/XI18N_OBJS", "/usr/share/X11/locale/isiri-3342/XLC_LOCALE", "/usr/share/X11/locale/iso8859-1/Compose", "/usr/share/X11/locale/iso8859-1/XI18N_OBJS", "/usr/share/X11/locale/iso8859-1/XLC_LOCALE", "/usr/share/X11/locale/iso8859-10/Compose", "/usr/share/X11/locale/iso8859-10/XI18N_OBJS", "/usr/share/X11/locale/iso8859-10/XLC_LOCALE", "/usr/share/X11/locale/iso8859-11/Compose", "/usr/share/X11/locale/iso8859-11/XI18N_OBJS", "/usr/share/X11/locale/iso8859-11/XLC_LOCALE", "/usr/share/X11/locale/iso8859-13/Compose", "/usr/share/X11/locale/iso8859-13/XI18N_OBJS", "/usr/share/X11/locale/iso8859-13/XLC_LOCALE", "/usr/share/X11/locale/iso8859-14/Compose", "/usr/share/X11/locale/iso8859-14/XI18N_OBJS", "/usr/share/X11/locale/iso8859-14/XLC_LOCALE", "/usr/share/X11/locale/iso8859-15/Compose", "/usr/share/X11/locale/iso8859-15/XI18N_OBJS", "/usr/share/X11/locale/iso8859-15/XLC_LOCALE", "/usr/share/X11/locale/iso8859-2/Compose", "/usr/share/X11/locale/iso8859-2/XI18N_OBJS", "/usr/share/X11/locale/iso8859-2/XLC_LOCALE", "/usr/share/X11/locale/iso8859-3/Compose", "/usr/share/X11/locale/iso8859-3/XI18N_OBJS", "/usr/share/X11/locale/iso8859-3/XLC_LOCALE", "/usr/share/X11/locale/iso8859-4/Compose", "/usr/share/X11/locale/iso8859-4/XI18N_OBJS", "/usr/share/X11/locale/iso8859-4/XLC_LOCALE", "/usr/share/X11/locale/iso8859-5/Compose", "/usr/share/X11/locale/iso8859-5/XI18N_OBJS", "/usr/share/X11/locale/iso8859-5/XLC_LOCALE", "/usr/share/X11/locale/iso8859-6/Compose", "/usr/share/X11/locale/iso8859-6/XI18N_OBJS", "/usr/share/X11/locale/iso8859-6/XLC_LOCALE", "/usr/share/X11/locale/iso8859-7/Compose", "/usr/share/X11/locale/iso8859-7/XI18N_OBJS", "/usr/share/X11/locale/iso8859-7/XLC_LOCALE", "/usr/share/X11/locale/iso8859-8/Compose", "/usr/share/X11/locale/iso8859-8/XI18N_OBJS", "/usr/share/X11/locale/iso8859-8/XLC_LOCALE", "/usr/share/X11/locale/iso8859-9/Compose", "/usr/share/X11/locale/iso8859-9/XI18N_OBJS", "/usr/share/X11/locale/iso8859-9/XLC_LOCALE", "/usr/share/X11/locale/iso8859-9e/Compose", "/usr/share/X11/locale/iso8859-9e/XI18N_OBJS", "/usr/share/X11/locale/iso8859-9e/XLC_LOCALE", "/usr/share/X11/locale/ja.JIS/Compose", "/usr/share/X11/locale/ja.JIS/XI18N_OBJS", "/usr/share/X11/locale/ja.JIS/XLC_LOCALE", "/usr/share/X11/locale/ja.SJIS/Compose", "/usr/share/X11/locale/ja.SJIS/XI18N_OBJS", "/usr/share/X11/locale/ja.SJIS/XLC_LOCALE", "/usr/share/X11/locale/ja/Compose", "/usr/share/X11/locale/ja/XI18N_OBJS", "/usr/share/X11/locale/ja/XLC_LOCALE", "/usr/share/X11/locale/ja_JP.UTF-8/Compose", "/usr/share/X11/locale/ja_JP.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/ja_JP.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/km_KH.UTF-8/Compose", "/usr/share/X11/locale/km_KH.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/km_KH.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/ko/Compose", "/usr/share/X11/locale/ko/XI18N_OBJS", "/usr/share/X11/locale/ko/XLC_LOCALE", "/usr/share/X11/locale/ko_KR.UTF-8/Compose", "/usr/share/X11/locale/ko_KR.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/ko_KR.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/koi8-c/Compose", "/usr/share/X11/locale/koi8-c/XI18N_OBJS", "/usr/share/X11/locale/koi8-c/XLC_LOCALE", "/usr/share/X11/locale/koi8-r/Compose", "/usr/share/X11/locale/koi8-r/XI18N_OBJS", "/usr/share/X11/locale/koi8-r/XLC_LOCALE", "/usr/share/X11/locale/koi8-u/Compose", "/usr/share/X11/locale/koi8-u/XI18N_OBJS", "/usr/share/X11/locale/koi8-u/XLC_LOCALE", "/usr/share/X11/locale/locale.alias", "/usr/share/X11/locale/locale.dir", "/usr/share/X11/locale/microsoft-cp1251/Compose", "/usr/share/X11/locale/microsoft-cp1251/XI18N_OBJS", "/usr/share/X11/locale/microsoft-cp1251/XLC_LOCALE", "/usr/share/X11/locale/microsoft-cp1255/Compose", "/usr/share/X11/locale/microsoft-cp1255/XI18N_OBJS", "/usr/share/X11/locale/microsoft-cp1255/XLC_LOCALE", "/usr/share/X11/locale/microsoft-cp1256/Compose", "/usr/share/X11/locale/microsoft-cp1256/XI18N_OBJS", "/usr/share/X11/locale/microsoft-cp1256/XLC_LOCALE", "/usr/share/X11/locale/mulelao-1/Compose", "/usr/share/X11/locale/mulelao-1/XI18N_OBJS", "/usr/share/X11/locale/mulelao-1/XLC_LOCALE", "/usr/share/X11/locale/nokhchi-1/Compose", "/usr/share/X11/locale/nokhchi-1/XI18N_OBJS", "/usr/share/X11/locale/nokhchi-1/XLC_LOCALE", "/usr/share/X11/locale/pt_BR.UTF-8/Compose", "/usr/share/X11/locale/pt_BR.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/pt_BR.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/pt_PT.UTF-8/Compose", "/usr/share/X11/locale/pt_PT.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/pt_PT.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/ru_RU.UTF-8/Compose", "/usr/share/X11/locale/ru_RU.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/ru_RU.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/sr_RS.UTF-8/Compose", "/usr/share/X11/locale/sr_RS.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/sr_RS.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/tatar-cyr/Compose", "/usr/share/X11/locale/tatar-cyr/XI18N_OBJS", "/usr/share/X11/locale/tatar-cyr/XLC_LOCALE", "/usr/share/X11/locale/th_TH.UTF-8/Compose", "/usr/share/X11/locale/th_TH.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/th_TH.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/th_TH/Compose", "/usr/share/X11/locale/th_TH/XI18N_OBJS", "/usr/share/X11/locale/th_TH/XLC_LOCALE", "/usr/share/X11/locale/tscii-0/Compose", "/usr/share/X11/locale/tscii-0/XI18N_OBJS", "/usr/share/X11/locale/tscii-0/XLC_LOCALE", "/usr/share/X11/locale/vi_VN.tcvn/Compose", "/usr/share/X11/locale/vi_VN.tcvn/XI18N_OBJS", "/usr/share/X11/locale/vi_VN.tcvn/XLC_LOCALE", "/usr/share/X11/locale/vi_VN.viscii/Compose", "/usr/share/X11/locale/vi_VN.viscii/XI18N_OBJS", "/usr/share/X11/locale/vi_VN.viscii/XLC_LOCALE", "/usr/share/X11/locale/zh_CN.UTF-8/Compose", "/usr/share/X11/locale/zh_CN.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/zh_CN.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/zh_CN.gb18030/Compose", "/usr/share/X11/locale/zh_CN.gb18030/XI18N_OBJS", "/usr/share/X11/locale/zh_CN.gb18030/XLC_LOCALE", "/usr/share/X11/locale/zh_CN.gbk/Compose", "/usr/share/X11/locale/zh_CN.gbk/XI18N_OBJS", "/usr/share/X11/locale/zh_CN.gbk/XLC_LOCALE", "/usr/share/X11/locale/zh_CN/Compose", "/usr/share/X11/locale/zh_CN/XI18N_OBJS", "/usr/share/X11/locale/zh_CN/XLC_LOCALE", "/usr/share/X11/locale/zh_HK.UTF-8/Compose", "/usr/share/X11/locale/zh_HK.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/zh_HK.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/zh_HK.big5/Compose", "/usr/share/X11/locale/zh_HK.big5/XI18N_OBJS", "/usr/share/X11/locale/zh_HK.big5/XLC_LOCALE", "/usr/share/X11/locale/zh_HK.big5hkscs/Compose", "/usr/share/X11/locale/zh_HK.big5hkscs/XI18N_OBJS", "/usr/share/X11/locale/zh_HK.big5hkscs/XLC_LOCALE", "/usr/share/X11/locale/zh_TW.UTF-8/Compose", "/usr/share/X11/locale/zh_TW.UTF-8/XI18N_OBJS", "/usr/share/X11/locale/zh_TW.UTF-8/XLC_LOCALE", "/usr/share/X11/locale/zh_TW.big5/Compose", "/usr/share/X11/locale/zh_TW.big5/XI18N_OBJS", "/usr/share/X11/locale/zh_TW.big5/XLC_LOCALE", "/usr/share/X11/locale/zh_TW/Compose", "/usr/share/X11/locale/zh_TW/XI18N_OBJS", "/usr/share/X11/locale/zh_TW/XLC_LOCALE", "/usr/share/doc/libx11-data/changelog.Debian.gz", "/usr/share/doc/libx11-data/changelog.gz", "/usr/share/doc/libx11-data/copyright", "/usr/share/man/man5/Compose.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "libx11-xcb1@2:1.8.4-2+deb12u2", "Name": "libx11-xcb1", "Identifier": { "PURL": "pkg:deb/debian/libx11-xcb1@1.8.4-2%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "23557bc8226ebca5" }, "Version": "1.8.4", "Release": "2+deb12u2", "Epoch": 2, "Arch": "amd64", "SrcName": "libx11", "SrcVersion": "1.8.4", "SrcRelease": "2+deb12u2", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libX11-xcb.so.1.0.0", "/usr/share/doc/libx11-xcb1/changelog.Debian.gz", "/usr/share/doc/libx11-xcb1/changelog.gz", "/usr/share/doc/libx11-xcb1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libx264-164@2:0.164.3095+gitbaee400-3", "Name": "libx264-164", "Identifier": { "PURL": "pkg:deb/debian/libx264-164@0.164.3095%2Bgitbaee400-3?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "7af7e7d1cc47e2b2" }, "Version": "0.164.3095+gitbaee400", "Release": "3", "Epoch": 2, "Arch": "amd64", "SrcName": "x264", "SrcVersion": "0.164.3095+gitbaee400", "SrcRelease": "3", "SrcEpoch": 2, "Licenses": [ "GPL-2.0-or-later", "ISC", "GPL-2+ with other exception", "LGPL-2.1-or-later", "BSD-3-Clause", "public-domain", "MIT", "GPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libx264.so.164", "/usr/share/doc/libx264-164/changelog.Debian.gz", "/usr/share/doc/libx264-164/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libx265-199@3.5-2+b1", "Name": "libx265-199", "Identifier": { "PURL": "pkg:deb/debian/libx265-199@3.5-2%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "54a65230224644bf" }, "Version": "3.5", "Release": "2+b1", "Arch": "amd64", "SrcName": "x265", "SrcVersion": "3.5", "SrcRelease": "2", "Licenses": [ "GPL-2.0-or-later", "MIT", "LGPL-2.1-or-later", "ISC", "GPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libnuma1@2.0.16-1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libx265.so.199", "/usr/share/doc/libx265-199/changelog.Debian.amd64.gz", "/usr/share/doc/libx265-199/changelog.Debian.gz", "/usr/share/doc/libx265-199/changelog.gz", "/usr/share/doc/libx265-199/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxau6@1:1.0.9-1", "Name": "libxau6", "Identifier": { "PURL": "pkg:deb/debian/libxau6@1.0.9-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "4f4cd028b8c8514a" }, "Version": "1.0.9", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxau", "SrcVersion": "1.0.9", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXau.so.6.0.0", "/usr/share/doc/libxau6/changelog.Debian.gz", "/usr/share/doc/libxau6/changelog.gz", "/usr/share/doc/libxau6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-dri2-0@1.15-1", "Name": "libxcb-dri2-0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-dri2-0@1.15-1?arch=amd64\u0026distro=debian-12.15", "UID": "e1188ab9fd01011" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-dri2.so.0.0.0", "/usr/share/doc/libxcb-dri2-0/changelog.Debian.gz", "/usr/share/doc/libxcb-dri2-0/changelog.gz", "/usr/share/doc/libxcb-dri2-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-dri3-0@1.15-1", "Name": "libxcb-dri3-0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-dri3-0@1.15-1?arch=amd64\u0026distro=debian-12.15", "UID": "696c461a79c81d5f" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-dri3.so.0.1.0", "/usr/share/doc/libxcb-dri3-0/changelog.Debian.gz", "/usr/share/doc/libxcb-dri3-0/changelog.gz", "/usr/share/doc/libxcb-dri3-0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-glx0@1.15-1", "Name": "libxcb-glx0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-glx0@1.15-1?arch=amd64\u0026distro=debian-12.15", "UID": "cc31086b21b8b592" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-glx.so.0.0.0", "/usr/share/doc/libxcb-glx0/changelog.Debian.gz", "/usr/share/doc/libxcb-glx0/changelog.gz", "/usr/share/doc/libxcb-glx0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-present0@1.15-1", "Name": "libxcb-present0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-present0@1.15-1?arch=amd64\u0026distro=debian-12.15", "UID": "cde2ac037f46c6a5" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-present.so.0.0.0", "/usr/share/doc/libxcb-present0/changelog.Debian.gz", "/usr/share/doc/libxcb-present0/changelog.gz", "/usr/share/doc/libxcb-present0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-randr0@1.15-1", "Name": "libxcb-randr0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-randr0@1.15-1?arch=amd64\u0026distro=debian-12.15", "UID": "ffb3c1e2d7b92f83" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-randr.so.0.1.0", "/usr/share/doc/libxcb-randr0/changelog.Debian.gz", "/usr/share/doc/libxcb-randr0/changelog.gz", "/usr/share/doc/libxcb-randr0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-render0@1.15-1", "Name": "libxcb-render0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-render0@1.15-1?arch=amd64\u0026distro=debian-12.15", "UID": "238ed3a25368f885" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.0", "/usr/share/doc/libxcb-render0/changelog.Debian.gz", "/usr/share/doc/libxcb-render0/changelog.gz", "/usr/share/doc/libxcb-render0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-shape0@1.15-1", "Name": "libxcb-shape0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-shape0@1.15-1?arch=amd64\u0026distro=debian-12.15", "UID": "4f533bc309f2d564" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-shape.so.0.0.0", "/usr/share/doc/libxcb-shape0/changelog.Debian.gz", "/usr/share/doc/libxcb-shape0/changelog.gz", "/usr/share/doc/libxcb-shape0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-shm0@1.15-1", "Name": "libxcb-shm0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-shm0@1.15-1?arch=amd64\u0026distro=debian-12.15", "UID": "fc6ca5e6ddf255fd" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-shm.so.0.0.0", "/usr/share/doc/libxcb-shm0/changelog.Debian.gz", "/usr/share/doc/libxcb-shm0/changelog.gz", "/usr/share/doc/libxcb-shm0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-sync1@1.15-1", "Name": "libxcb-sync1", "Identifier": { "PURL": "pkg:deb/debian/libxcb-sync1@1.15-1?arch=amd64\u0026distro=debian-12.15", "UID": "28966826a1e011ad" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-sync.so.1.0.0", "/usr/share/doc/libxcb-sync1/changelog.Debian.gz", "/usr/share/doc/libxcb-sync1/changelog.gz", "/usr/share/doc/libxcb-sync1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb-xfixes0@1.15-1", "Name": "libxcb-xfixes0", "Identifier": { "PURL": "pkg:deb/debian/libxcb-xfixes0@1.15-1?arch=amd64\u0026distro=debian-12.15", "UID": "458bf2d9d799241e" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libxcb1@1.15-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb-xfixes.so.0.0.0", "/usr/share/doc/libxcb-xfixes0/changelog.Debian.gz", "/usr/share/doc/libxcb-xfixes0/changelog.gz", "/usr/share/doc/libxcb-xfixes0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcb1@1.15-1", "Name": "libxcb1", "Identifier": { "PURL": "pkg:deb/debian/libxcb1@1.15-1?arch=amd64\u0026distro=debian-12.15", "UID": "7dda4c0256c9524f" }, "Version": "1.15", "Release": "1", "Arch": "amd64", "SrcName": "libxcb", "SrcVersion": "1.15", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libxau6@1:1.0.9-1", "libxdmcp6@1:1.1.2-3" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxcb.so.1.1.0", "/usr/share/doc/libxcb1/changelog.Debian.gz", "/usr/share/doc/libxcb1/changelog.gz", "/usr/share/doc/libxcb1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxcursor1@1:1.2.1-1", "Name": "libxcursor1", "Identifier": { "PURL": "pkg:deb/debian/libxcursor1@1.2.1-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "55d9615433d9e9b2" }, "Version": "1.2.1", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxcursor", "SrcVersion": "1.2.1", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libx11-6@2:1.8.4-2+deb12u2", "libxfixes3@1:6.0.0-2", "libxrender1@1:0.9.10-1.1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2", "/usr/share/doc/libxcursor1/changelog.Debian.gz", "/usr/share/doc/libxcursor1/changelog.gz", "/usr/share/doc/libxcursor1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxdmcp6@1:1.1.2-3", "Name": "libxdmcp6", "Identifier": { "PURL": "pkg:deb/debian/libxdmcp6@1.1.2-3?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "e87bf32dd03285f1" }, "Version": "1.1.2", "Release": "3", "Epoch": 1, "Arch": "amd64", "SrcName": "libxdmcp", "SrcVersion": "1.1.2", "SrcRelease": "3", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbsd0@0.11.7-2", "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0", "/usr/share/doc/libxdmcp6/changelog.Debian.gz", "/usr/share/doc/libxdmcp6/changelog.gz", "/usr/share/doc/libxdmcp6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxext6@2:1.3.4-1+b1", "Name": "libxext6", "Identifier": { "PURL": "pkg:deb/debian/libxext6@1.3.4-1%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "64c2c313f0eb6f76" }, "Version": "1.3.4", "Release": "1+b1", "Epoch": 2, "Arch": "amd64", "SrcName": "libxext", "SrcVersion": "1.3.4", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXext.so.6.4.0", "/usr/share/doc/libxext6/changelog.Debian.amd64.gz", "/usr/share/doc/libxext6/changelog.Debian.gz", "/usr/share/doc/libxext6/changelog.gz", "/usr/share/doc/libxext6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxfixes3@1:6.0.0-2", "Name": "libxfixes3", "Identifier": { "PURL": "pkg:deb/debian/libxfixes3@6.0.0-2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "d16b24f6d59d2a05" }, "Version": "6.0.0", "Release": "2", "Epoch": 1, "Arch": "amd64", "SrcName": "libxfixes", "SrcVersion": "6.0.0", "SrcRelease": "2", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0", "/usr/share/doc/libxfixes3/changelog.Debian.gz", "/usr/share/doc/libxfixes3/changelog.gz", "/usr/share/doc/libxfixes3/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxi6@2:1.8-1+b1", "Name": "libxi6", "Identifier": { "PURL": "pkg:deb/debian/libxi6@1.8-1%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "6c017affe065ce76" }, "Version": "1.8", "Release": "1+b1", "Epoch": 2, "Arch": "amd64", "SrcName": "libxi", "SrcVersion": "1.8", "SrcRelease": "1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libx11-6@2:1.8.4-2+deb12u2", "libxext6@2:1.3.4-1+b1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXi.so.6.1.0", "/usr/share/doc/libxi6/changelog.Debian.amd64.gz", "/usr/share/doc/libxi6/changelog.Debian.gz", "/usr/share/doc/libxi6/changelog.gz", "/usr/share/doc/libxi6/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxkbcommon0@1.5.0-1", "Name": "libxkbcommon0", "Identifier": { "PURL": "pkg:deb/debian/libxkbcommon0@1.5.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "34e3eab37e495c24" }, "Version": "1.5.0", "Release": "1", "Arch": "amd64", "SrcName": "libxkbcommon", "SrcVersion": "1.5.0", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "xkb-data@2.35.1-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxkbcommon.so.0.0.0", "/usr/share/doc/libxkbcommon0/changelog.Debian.gz", "/usr/share/doc/libxkbcommon0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxml2@2.9.14+dfsg-1.3~deb12u6", "Name": "libxml2", "Identifier": { "PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u6?arch=amd64\u0026distro=debian-12.15", "UID": "6e17f8e68de5666e" }, "Version": "2.9.14+dfsg", "Release": "1.3~deb12u6", "Arch": "amd64", "SrcName": "libxml2", "SrcVersion": "2.9.14+dfsg", "SrcRelease": "1.3~deb12u6", "Licenses": [ "MIT-1", "ISC" ], "Maintainer": "Debian XML/SGML Group \u003cdebian-xml-sgml-pkgs@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libicu72@72.1-3+deb12u1", "liblzma5@5.4.1-1+deb12u1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxml2.so.2.9.14", "/usr/share/doc/libxml2/README.Debian", "/usr/share/doc/libxml2/README.md", "/usr/share/doc/libxml2/changelog.Debian.gz", "/usr/share/doc/libxml2/changelog.gz", "/usr/share/doc/libxml2/copyright", "/usr/share/lintian/overrides/libxml2" ], "AnalyzedBy": "dpkg" }, { "ID": "libxrandr2@2:1.5.2-2+b1", "Name": "libxrandr2", "Identifier": { "PURL": "pkg:deb/debian/libxrandr2@1.5.2-2%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "6c9cd4b3f8eeb332" }, "Version": "1.5.2", "Release": "2+b1", "Epoch": 2, "Arch": "amd64", "SrcName": "libxrandr", "SrcVersion": "1.5.2", "SrcRelease": "2", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libx11-6@2:1.8.4-2+deb12u2", "libxext6@2:1.3.4-1+b1", "libxrender1@1:0.9.10-1.1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXrandr.so.2.2.0", "/usr/share/doc/libxrandr2/changelog.Debian.amd64.gz", "/usr/share/doc/libxrandr2/changelog.Debian.gz", "/usr/share/doc/libxrandr2/changelog.gz", "/usr/share/doc/libxrandr2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxrender1@1:0.9.10-1.1", "Name": "libxrender1", "Identifier": { "PURL": "pkg:deb/debian/libxrender1@0.9.10-1.1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "22937829a17f04e4" }, "Version": "0.9.10", "Release": "1.1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxrender", "SrcVersion": "0.9.10", "SrcRelease": "1.1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0", "/usr/share/doc/libxrender1/changelog.Debian.gz", "/usr/share/doc/libxrender1/changelog.gz", "/usr/share/doc/libxrender1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxshmfence1@1.3-1", "Name": "libxshmfence1", "Identifier": { "PURL": "pkg:deb/debian/libxshmfence1@1.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "23dad9699aef7dd3" }, "Version": "1.3", "Release": "1", "Arch": "amd64", "SrcName": "libxshmfence", "SrcVersion": "1.3", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxshmfence.so.1.0.0", "/usr/share/doc/libxshmfence1/changelog.Debian.gz", "/usr/share/doc/libxshmfence1/changelog.gz", "/usr/share/doc/libxshmfence1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxss1@1:1.2.3-1", "Name": "libxss1", "Identifier": { "PURL": "pkg:deb/debian/libxss1@1.2.3-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "8ac4ec10cf1e4990" }, "Version": "1.2.3", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "libxss", "SrcVersion": "1.2.3", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libx11-6@2:1.8.4-2+deb12u2", "libxext6@2:1.3.4-1+b1", "x11-common@1:7.7+23" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXss.so.1.0.0", "/usr/share/doc/libxss1/changelog.Debian.gz", "/usr/share/doc/libxss1/changelog.gz", "/usr/share/doc/libxss1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxv1@2:1.0.11-1.1", "Name": "libxv1", "Identifier": { "PURL": "pkg:deb/debian/libxv1@1.0.11-1.1?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "14c31c19ef972a4c" }, "Version": "1.0.11", "Release": "1.1", "Epoch": 2, "Arch": "amd64", "SrcName": "libxv", "SrcVersion": "1.0.11", "SrcRelease": "1.1", "SrcEpoch": 2, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libx11-6@2:1.8.4-2+deb12u2", "libxext6@2:1.3.4-1+b1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXv.so.1.0.0", "/usr/share/doc/libxv1/changelog.Debian.gz", "/usr/share/doc/libxv1/changelog.gz", "/usr/share/doc/libxv1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxvidcore4@2:1.3.7-1", "Name": "libxvidcore4", "Identifier": { "PURL": "pkg:deb/debian/libxvidcore4@1.3.7-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "45a6d67fb9769b7b" }, "Version": "1.3.7", "Release": "1", "Epoch": 2, "Arch": "amd64", "SrcName": "xvidcore", "SrcVersion": "1.3.7", "SrcRelease": "1", "SrcEpoch": 2, "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "GPL-2.0-only", "LGPL-2.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxvidcore.so.4.3", "/usr/share/doc/libxvidcore4/changelog.Debian.gz", "/usr/share/doc/libxvidcore4/changelog.gz", "/usr/share/doc/libxvidcore4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxxf86vm1@1:1.1.4-1+b2", "Name": "libxxf86vm1", "Identifier": { "PURL": "pkg:deb/debian/libxxf86vm1@1.1.4-1%2Bb2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "4e31df68e3b74917" }, "Version": "1.1.4", "Release": "1+b2", "Epoch": 1, "Arch": "amd64", "SrcName": "libxxf86vm", "SrcVersion": "1.1.4", "SrcRelease": "1", "SrcEpoch": 1, "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libx11-6@2:1.8.4-2+deb12u2", "libxext6@2:1.3.4-1+b1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libXxf86vm.so.1.0.0", "/usr/share/doc/libxxf86vm1/changelog.Debian.amd64.gz", "/usr/share/doc/libxxf86vm1/changelog.Debian.gz", "/usr/share/doc/libxxf86vm1/changelog.gz", "/usr/share/doc/libxxf86vm1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libxxhash0@0.8.1-1", "Name": "libxxhash0", "Identifier": { "PURL": "pkg:deb/debian/libxxhash0@0.8.1-1?arch=amd64\u0026distro=debian-12.15", "UID": "7a5128d9907c6eb3" }, "Version": "0.8.1", "Release": "1", "Arch": "amd64", "SrcName": "xxhash", "SrcVersion": "0.8.1", "SrcRelease": "1", "Licenses": [ "BSD-2-Clause", "GPL-2.0-only" ], "Maintainer": "Josue Ortega \u003cjosue@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libxxhash.so.0.8.1", "/usr/share/doc/libxxhash0/changelog.Debian.gz", "/usr/share/doc/libxxhash0/changelog.gz", "/usr/share/doc/libxxhash0/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libz3-4@4.8.12-3.1", "Name": "libz3-4", "Identifier": { "PURL": "pkg:deb/debian/libz3-4@4.8.12-3.1?arch=amd64\u0026distro=debian-12.15", "UID": "544de4382c2ac112" }, "Version": "4.8.12", "Release": "3.1", "Arch": "amd64", "SrcName": "z3", "SrcVersion": "4.8.12", "SrcRelease": "3.1", "Licenses": [ "MIT", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "LLVM Packaging Team \u003cpkg-llvm-team@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libz3.so.4", "/usr/share/doc/libz3-4/changelog.Debian.gz", "/usr/share/doc/libz3-4/changelog.gz", "/usr/share/doc/libz3-4/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzimg2@3.0.4+ds1-1", "Name": "libzimg2", "Identifier": { "PURL": "pkg:deb/debian/libzimg2@3.0.4%2Bds1-1?arch=amd64\u0026distro=debian-12.15", "UID": "98e43f1b5dca431b" }, "Version": "3.0.4+ds1", "Release": "1", "Arch": "amd64", "SrcName": "zimg", "SrcVersion": "3.0.4+ds1", "SrcRelease": "1", "Licenses": [ "WTFPL-2", "GPL-3.0-with-autoconf-exception+", "GPL-3.0-only" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzimg.so.2.0.0", "/usr/share/doc/libzimg2/changelog.Debian.gz", "/usr/share/doc/libzimg2/changelog.gz", "/usr/share/doc/libzimg2/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzmq5@4.3.4-6", "Name": "libzmq5", "Identifier": { "PURL": "pkg:deb/debian/libzmq5@4.3.4-6?arch=amd64\u0026distro=debian-12.15", "UID": "1f8f1a68298dd3f9" }, "Version": "4.3.4", "Release": "6", "Arch": "amd64", "SrcName": "zeromq3", "SrcVersion": "4.3.4", "SrcRelease": "6", "Licenses": [ "LGPL-3.0+ with special exception granted by copyright holders", "LGPL-2.0-or-later", "LGPL-2.0-only", "LGPL-3.0-only", "MIT" ], "Maintainer": "Laszlo Boszormenyi (GCS) \u003cgcs@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libbsd0@0.11.7-2", "libc6@2.36-9+deb12u14", "libgcc-s1@12.2.0-14+deb12u1", "libgssapi-krb5-2@1.20.1-2+deb12u5", "libnorm1@1.5.9+dfsg-2", "libpgm-5.3-0@5.3.128~dfsg-2", "libsodium23@1.0.18-1+deb12u1", "libstdc++6@12.2.0-14+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzmq.so.5.2.4", "/usr/share/doc/libzmq5/AUTHORS", "/usr/share/doc/libzmq5/NEWS.gz", "/usr/share/doc/libzmq5/changelog.Debian.gz", "/usr/share/doc/libzmq5/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzstd1@1.5.4+dfsg2-5", "Name": "libzstd1", "Identifier": { "PURL": "pkg:deb/debian/libzstd1@1.5.4%2Bdfsg2-5?arch=amd64\u0026distro=debian-12.15", "UID": "f58570fe4ab7b9f5" }, "Version": "1.5.4+dfsg2", "Release": "5", "Arch": "amd64", "SrcName": "libzstd", "SrcVersion": "1.5.4+dfsg2", "SrcRelease": "5", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only", "Zlib", "MIT" ], "Maintainer": "RPM packaging team \u003cteam+pkg-rpm@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzstd.so.1.5.4", "/usr/share/doc/libzstd1/changelog.Debian.gz", "/usr/share/doc/libzstd1/changelog.gz", "/usr/share/doc/libzstd1/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "libzvbi-common@0.2.41-1+deb12u1", "Name": "libzvbi-common", "Identifier": { "PURL": "pkg:deb/debian/libzvbi-common@0.2.41-1%2Bdeb12u1?arch=all\u0026distro=debian-12.15", "UID": "7a956dab1b62a7c" }, "Version": "0.2.41", "Release": "1+deb12u1", "Arch": "all", "SrcName": "zvbi", "SrcVersion": "0.2.41", "SrcRelease": "1+deb12u1", "Licenses": [ "GPL-2.0-or-later", "BSD-2-Clause", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "GPL-2.0-only", "MIT", "BSD-3-Clause", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Ileana Dumitrescu \u003cileanadumitrescu95@gmail.com\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/libzvbi-common/AUTHORS.gz", "/usr/share/doc/libzvbi-common/NEWS.gz", "/usr/share/doc/libzvbi-common/README.md.gz", "/usr/share/doc/libzvbi-common/TODO", "/usr/share/doc/libzvbi-common/changelog.Debian.gz", "/usr/share/doc/libzvbi-common/changelog.gz", "/usr/share/doc/libzvbi-common/copyright", "/usr/share/locale/de/LC_MESSAGES/zvbi.mo", "/usr/share/locale/en@boldquot/LC_MESSAGES/zvbi.mo", "/usr/share/locale/en@quot/LC_MESSAGES/zvbi.mo", "/usr/share/locale/es/LC_MESSAGES/zvbi.mo", "/usr/share/locale/fr/LC_MESSAGES/zvbi.mo", "/usr/share/locale/it/LC_MESSAGES/zvbi.mo", "/usr/share/locale/ka/LC_MESSAGES/zvbi.mo", "/usr/share/locale/nl/LC_MESSAGES/zvbi.mo", "/usr/share/locale/pl/LC_MESSAGES/zvbi.mo" ], "AnalyzedBy": "dpkg" }, { "ID": "libzvbi0@0.2.41-1+deb12u1", "Name": "libzvbi0", "Identifier": { "PURL": "pkg:deb/debian/libzvbi0@0.2.41-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "42216b504fbd2054" }, "Version": "0.2.41", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "zvbi", "SrcVersion": "0.2.41", "SrcRelease": "1+deb12u1", "Licenses": [ "GPL-2.0-or-later", "BSD-2-Clause", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "GPL-2.0-only", "MIT", "BSD-3-Clause", "LGPL-2.0-only", "LGPL-2.1-only" ], "Maintainer": "Ileana Dumitrescu \u003cileanadumitrescu95@gmail.com\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libpng16-16@1.6.39-2+deb12u5", "libzvbi-common@0.2.41-1+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libzvbi-chains.so.0.0.0", "/usr/lib/x86_64-linux-gnu/libzvbi.so.0.13.2", "/usr/share/doc/libzvbi0/AUTHORS.gz", "/usr/share/doc/libzvbi0/NEWS.gz", "/usr/share/doc/libzvbi0/README.md.gz", "/usr/share/doc/libzvbi0/TODO", "/usr/share/doc/libzvbi0/changelog.Debian.gz", "/usr/share/doc/libzvbi0/changelog.gz", "/usr/share/doc/libzvbi0/copyright", "/usr/share/lintian/overrides/libzvbi0" ], "AnalyzedBy": "dpkg" }, { "ID": "login@1:4.13+dfsg1-1+deb12u2", "Name": "login", "Identifier": { "PURL": "pkg:deb/debian/login@4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "38a1786e5b20bfe2" }, "Version": "4.13+dfsg1", "Release": "1+deb12u2", "Epoch": 1, "Arch": "amd64", "SrcName": "shadow", "SrcVersion": "4.13+dfsg1", "SrcRelease": "1+deb12u2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-1.0-only", "GPL-2.0-or-later", "public-domain", "GPL-2.0-only" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/bin/login", "/usr/bin/faillog", "/usr/bin/lastlog", "/usr/bin/newgrp", "/usr/sbin/nologin", "/usr/share/doc/login/NEWS.Debian.gz", "/usr/share/doc/login/changelog.Debian.gz", "/usr/share/doc/login/changelog.gz", "/usr/share/doc/login/copyright", "/usr/share/lintian/overrides/login", "/usr/share/locale/bs/LC_MESSAGES/shadow.mo", "/usr/share/locale/ca/LC_MESSAGES/shadow.mo", "/usr/share/locale/cs/LC_MESSAGES/shadow.mo", "/usr/share/locale/da/LC_MESSAGES/shadow.mo", "/usr/share/locale/de/LC_MESSAGES/shadow.mo", "/usr/share/locale/dz/LC_MESSAGES/shadow.mo", "/usr/share/locale/el/LC_MESSAGES/shadow.mo", "/usr/share/locale/es/LC_MESSAGES/shadow.mo", "/usr/share/locale/eu/LC_MESSAGES/shadow.mo", "/usr/share/locale/fi/LC_MESSAGES/shadow.mo", "/usr/share/locale/fr/LC_MESSAGES/shadow.mo", "/usr/share/locale/gl/LC_MESSAGES/shadow.mo", "/usr/share/locale/he/LC_MESSAGES/shadow.mo", "/usr/share/locale/hu/LC_MESSAGES/shadow.mo", "/usr/share/locale/id/LC_MESSAGES/shadow.mo", "/usr/share/locale/it/LC_MESSAGES/shadow.mo", "/usr/share/locale/ja/LC_MESSAGES/shadow.mo", "/usr/share/locale/ka/LC_MESSAGES/shadow.mo", "/usr/share/locale/kk/LC_MESSAGES/shadow.mo", "/usr/share/locale/km/LC_MESSAGES/shadow.mo", "/usr/share/locale/ko/LC_MESSAGES/shadow.mo", "/usr/share/locale/nb/LC_MESSAGES/shadow.mo", "/usr/share/locale/ne/LC_MESSAGES/shadow.mo", "/usr/share/locale/nl/LC_MESSAGES/shadow.mo", "/usr/share/locale/nn/LC_MESSAGES/shadow.mo", "/usr/share/locale/pl/LC_MESSAGES/shadow.mo", "/usr/share/locale/pt/LC_MESSAGES/shadow.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/shadow.mo", "/usr/share/locale/ro/LC_MESSAGES/shadow.mo", "/usr/share/locale/ru/LC_MESSAGES/shadow.mo", "/usr/share/locale/sk/LC_MESSAGES/shadow.mo", "/usr/share/locale/sq/LC_MESSAGES/shadow.mo", "/usr/share/locale/sv/LC_MESSAGES/shadow.mo", "/usr/share/locale/tl/LC_MESSAGES/shadow.mo", "/usr/share/locale/tr/LC_MESSAGES/shadow.mo", "/usr/share/locale/uk/LC_MESSAGES/shadow.mo", "/usr/share/locale/vi/LC_MESSAGES/shadow.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/shadow.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/shadow.mo", "/usr/share/man/cs/man5/faillog.5.gz", "/usr/share/man/cs/man8/faillog.8.gz", "/usr/share/man/cs/man8/lastlog.8.gz", "/usr/share/man/cs/man8/nologin.8.gz", "/usr/share/man/da/man1/newgrp.1.gz", "/usr/share/man/da/man1/sg.1.gz", "/usr/share/man/da/man8/nologin.8.gz", "/usr/share/man/de/man1/login.1.gz", "/usr/share/man/de/man1/newgrp.1.gz", "/usr/share/man/de/man1/sg.1.gz", "/usr/share/man/de/man5/faillog.5.gz", "/usr/share/man/de/man5/login.defs.5.gz", "/usr/share/man/de/man8/faillog.8.gz", "/usr/share/man/de/man8/lastlog.8.gz", "/usr/share/man/de/man8/nologin.8.gz", "/usr/share/man/fr/man1/login.1.gz", "/usr/share/man/fr/man1/newgrp.1.gz", "/usr/share/man/fr/man1/sg.1.gz", "/usr/share/man/fr/man5/faillog.5.gz", "/usr/share/man/fr/man5/login.defs.5.gz", "/usr/share/man/fr/man8/faillog.8.gz", "/usr/share/man/fr/man8/lastlog.8.gz", "/usr/share/man/fr/man8/nologin.8.gz", "/usr/share/man/hu/man1/login.1.gz", "/usr/share/man/hu/man1/newgrp.1.gz", "/usr/share/man/hu/man8/lastlog.8.gz", "/usr/share/man/id/man1/login.1.gz", "/usr/share/man/it/man1/login.1.gz", "/usr/share/man/it/man1/newgrp.1.gz", "/usr/share/man/it/man1/sg.1.gz", "/usr/share/man/it/man5/faillog.5.gz", "/usr/share/man/it/man5/login.defs.5.gz", "/usr/share/man/it/man8/faillog.8.gz", "/usr/share/man/it/man8/lastlog.8.gz", "/usr/share/man/it/man8/nologin.8.gz", "/usr/share/man/ja/man1/login.1.gz", "/usr/share/man/ja/man1/newgrp.1.gz", "/usr/share/man/ja/man5/faillog.5.gz", "/usr/share/man/ja/man5/login.defs.5.gz", "/usr/share/man/ja/man8/faillog.8.gz", "/usr/share/man/ja/man8/lastlog.8.gz", "/usr/share/man/ko/man1/login.1.gz", "/usr/share/man/man1/login.1.gz", "/usr/share/man/man1/newgrp.1.gz", "/usr/share/man/man1/sg.1.gz", "/usr/share/man/man5/faillog.5.gz", "/usr/share/man/man5/login.defs.5.gz", "/usr/share/man/man8/faillog.8.gz", "/usr/share/man/man8/lastlog.8.gz", "/usr/share/man/man8/nologin.8.gz", "/usr/share/man/pl/man1/newgrp.1.gz", "/usr/share/man/pl/man1/sg.1.gz", "/usr/share/man/pl/man5/faillog.5.gz", "/usr/share/man/pl/man8/faillog.8.gz", "/usr/share/man/pl/man8/lastlog.8.gz", "/usr/share/man/ru/man1/login.1.gz", "/usr/share/man/ru/man1/newgrp.1.gz", "/usr/share/man/ru/man1/sg.1.gz", "/usr/share/man/ru/man5/faillog.5.gz", "/usr/share/man/ru/man5/login.defs.5.gz", "/usr/share/man/ru/man8/faillog.8.gz", "/usr/share/man/ru/man8/lastlog.8.gz", "/usr/share/man/ru/man8/nologin.8.gz", "/usr/share/man/sv/man1/newgrp.1.gz", "/usr/share/man/sv/man1/sg.1.gz", "/usr/share/man/sv/man5/faillog.5.gz", "/usr/share/man/sv/man8/faillog.8.gz", "/usr/share/man/sv/man8/lastlog.8.gz", "/usr/share/man/sv/man8/nologin.8.gz", "/usr/share/man/tr/man1/login.1.gz", "/usr/share/man/uk/man1/login.1.gz", "/usr/share/man/uk/man1/newgrp.1.gz", "/usr/share/man/uk/man1/sg.1.gz", "/usr/share/man/uk/man5/faillog.5.gz", "/usr/share/man/uk/man5/login.defs.5.gz", "/usr/share/man/uk/man8/faillog.8.gz", "/usr/share/man/uk/man8/lastlog.8.gz", "/usr/share/man/uk/man8/nologin.8.gz", "/usr/share/man/zh_CN/man1/login.1.gz", "/usr/share/man/zh_CN/man1/newgrp.1.gz", "/usr/share/man/zh_CN/man1/sg.1.gz", "/usr/share/man/zh_CN/man5/faillog.5.gz", "/usr/share/man/zh_CN/man5/login.defs.5.gz", "/usr/share/man/zh_CN/man8/faillog.8.gz", "/usr/share/man/zh_CN/man8/lastlog.8.gz", "/usr/share/man/zh_CN/man8/nologin.8.gz", "/usr/share/man/zh_TW/man1/newgrp.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "logsave@1.47.0-2+b2", "Name": "logsave", "Identifier": { "PURL": "pkg:deb/debian/logsave@1.47.0-2%2Bb2?arch=amd64\u0026distro=debian-12.15", "UID": "5623730c4d6c3f45" }, "Version": "1.47.0", "Release": "2+b2", "Arch": "amd64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.0", "SrcRelease": "2", "Licenses": [ "GPL-2.0-only", "LGPL-2.0-only", "BSD-3-Clause", "Apache-2.0", "ISC", "GPL-2.0-or-later", "MIT-US-export", "Kazlib", "Latex2e", "GPL-2+ with Texinfo exception" ], "Maintainer": "Theodore Y. Ts'o \u003ctytso@mit.edu\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/sbin/logsave", "/usr/share/doc/logsave/changelog.Debian.amd64.gz", "/usr/share/doc/logsave/changelog.Debian.gz", "/usr/share/doc/logsave/copyright", "/usr/share/man/man8/logsave.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "mawk@1.3.4.20200120-3.1", "Name": "mawk", "Identifier": { "PURL": "pkg:deb/debian/mawk@1.3.4.20200120-3.1?arch=amd64\u0026distro=debian-12.15", "UID": "d66b16acd7a3e504" }, "Version": "1.3.4.20200120", "Release": "3.1", "Arch": "amd64", "SrcName": "mawk", "SrcVersion": "1.3.4.20200120", "SrcRelease": "3.1", "Licenses": [ "GPL-2.0-only", "X11", "CC-BY-3.0" ], "Maintainer": "Boyuan Yang \u003cbyang@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/bin/mawk", "/usr/share/doc/mawk/ACKNOWLEDGMENT", "/usr/share/doc/mawk/README", "/usr/share/doc/mawk/changelog.Debian.gz", "/usr/share/doc/mawk/changelog.gz", "/usr/share/doc/mawk/copyright", "/usr/share/doc/mawk/examples/ct_length.awk", "/usr/share/doc/mawk/examples/decl.awk", "/usr/share/doc/mawk/examples/deps.awk", "/usr/share/doc/mawk/examples/eatc.awk", "/usr/share/doc/mawk/examples/gdecl.awk", "/usr/share/doc/mawk/examples/hcal", "/usr/share/doc/mawk/examples/hical", "/usr/share/doc/mawk/examples/nocomment.awk", "/usr/share/doc/mawk/examples/primes.awk", "/usr/share/doc/mawk/examples/qsort.awk", "/usr/share/man/man1/mawk.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "mesa-va-drivers@22.3.6-1+deb12u2", "Name": "mesa-va-drivers", "Identifier": { "PURL": "pkg:deb/debian/mesa-va-drivers@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "94e4ab95868a544" }, "Version": "22.3.6", "Release": "1+deb12u2", "Arch": "amd64", "SrcName": "mesa", "SrcVersion": "22.3.6", "SrcRelease": "1+deb12u2", "Licenses": [ "MIT", "BSD-3-google", "Khronos", "Apache-2.0", "BSL-1.0", "MLAA", "SGI", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libdrm-amdgpu1@2.4.114-1+b1", "libdrm-nouveau2@2.4.114-1+b1", "libdrm-radeon1@2.4.114-1+b1", "libdrm2@2.4.114-1+b1", "libelf1@0.188-2.1", "libexpat1@2.5.0-1+deb12u2", "libgcc-s1@12.2.0-14+deb12u1", "libllvm15@1:15.0.6-4+b1", "libstdc++6@12.2.0-14+deb12u1", "libx11-xcb1@2:1.8.4-2+deb12u2", "libxcb-dri2-0@1.15-1", "libxcb-dri3-0@1.15-1", "libxcb-present0@1.15-1", "libxcb-sync1@1.15-1", "libxcb-xfixes0@1.15-1", "libxcb1@1.15-1", "libxshmfence1@1.3-1", "libzstd1@1.5.4+dfsg2-5", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/dri/d3d12_drv_video.so", "/usr/lib/x86_64-linux-gnu/dri/nouveau_drv_video.so", "/usr/lib/x86_64-linux-gnu/dri/r600_drv_video.so", "/usr/lib/x86_64-linux-gnu/dri/radeonsi_drv_video.so", "/usr/lib/x86_64-linux-gnu/dri/virtio_gpu_drv_video.so", "/usr/share/bug/mesa-va-drivers/control", "/usr/share/bug/mesa-va-drivers/script", "/usr/share/doc/mesa-va-drivers/changelog.Debian.gz", "/usr/share/doc/mesa-va-drivers/changelog.gz", "/usr/share/doc/mesa-va-drivers/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "mount@2.38.1-5+deb12u3", "Name": "mount", "Identifier": { "PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "db6b596e9b2c0272" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/bin/mount", "/bin/umount", "/sbin/losetup", "/sbin/swapoff", "/sbin/swapon", "/usr/share/bash-completion/completions/losetup", "/usr/share/bash-completion/completions/mount", "/usr/share/bash-completion/completions/swapoff", "/usr/share/bash-completion/completions/swapon", "/usr/share/bash-completion/completions/umount", "/usr/share/doc/mount/changelog.Debian.gz", "/usr/share/doc/mount/changelog.gz", "/usr/share/doc/mount/copyright", "/usr/share/doc/mount/examples/filesystems", "/usr/share/doc/mount/examples/fstab", "/usr/share/doc/mount/examples/mount.fstab", "/usr/share/doc/mount/mount.txt", "/usr/share/lintian/overrides/mount", "/usr/share/man/man5/fstab.5.gz", "/usr/share/man/man8/losetup.8.gz", "/usr/share/man/man8/mount.8.gz", "/usr/share/man/man8/swapon.8.gz", "/usr/share/man/man8/umount.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "ncurses-base@6.4-4", "Name": "ncurses-base", "Identifier": { "PURL": "pkg:deb/debian/ncurses-base@6.4-4?arch=all\u0026distro=debian-12.15", "UID": "8e69deb4f19b17b3" }, "Version": "6.4", "Release": "4", "Arch": "all", "SrcName": "ncurses", "SrcVersion": "6.4", "SrcRelease": "4", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Craig Small \u003ccsmall@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/terminfo/E/Eterm", "/lib/terminfo/a/ansi", "/lib/terminfo/c/cons25", "/lib/terminfo/c/cons25-debian", "/lib/terminfo/c/cygwin", "/lib/terminfo/d/dumb", "/lib/terminfo/h/hurd", "/lib/terminfo/l/linux", "/lib/terminfo/m/mach", "/lib/terminfo/m/mach-bold", "/lib/terminfo/m/mach-color", "/lib/terminfo/m/mach-gnu", "/lib/terminfo/m/mach-gnu-color", "/lib/terminfo/p/pcansi", "/lib/terminfo/r/rxvt", "/lib/terminfo/r/rxvt-basic", "/lib/terminfo/r/rxvt-unicode", "/lib/terminfo/r/rxvt-unicode-256color", "/lib/terminfo/s/screen", "/lib/terminfo/s/screen-256color", "/lib/terminfo/s/screen-256color-bce", "/lib/terminfo/s/screen-bce", "/lib/terminfo/s/screen-s", "/lib/terminfo/s/screen-w", "/lib/terminfo/s/screen.xterm-256color", "/lib/terminfo/s/sun", "/lib/terminfo/t/tmux", "/lib/terminfo/t/tmux-256color", "/lib/terminfo/v/vt100", "/lib/terminfo/v/vt102", "/lib/terminfo/v/vt220", "/lib/terminfo/v/vt52", "/lib/terminfo/w/wsvt25", "/lib/terminfo/w/wsvt25m", "/lib/terminfo/x/xterm", "/lib/terminfo/x/xterm-256color", "/lib/terminfo/x/xterm-color", "/lib/terminfo/x/xterm-mono", "/lib/terminfo/x/xterm-r5", "/lib/terminfo/x/xterm-r6", "/lib/terminfo/x/xterm-vt220", "/lib/terminfo/x/xterm-xfree86", "/usr/share/doc/ncurses-base/FAQ", "/usr/share/doc/ncurses-base/TODO.Debian", "/usr/share/doc/ncurses-base/changelog.Debian.gz", "/usr/share/doc/ncurses-base/changelog.gz", "/usr/share/doc/ncurses-base/copyright", "/usr/share/lintian/overrides/ncurses-base", "/usr/share/tabset/std", "/usr/share/tabset/stdcrt", "/usr/share/tabset/vt100", "/usr/share/tabset/vt300" ], "AnalyzedBy": "dpkg" }, { "ID": "ncurses-bin@6.4-4", "Name": "ncurses-bin", "Identifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.4-4?arch=amd64\u0026distro=debian-12.15", "UID": "e3f559220e0fbad1" }, "Version": "6.4", "Release": "4", "Arch": "amd64", "SrcName": "ncurses", "SrcVersion": "6.4", "SrcRelease": "4", "Licenses": [ "MIT/X11", "X11", "BSD-3-Clause" ], "Maintainer": "Craig Small \u003ccsmall@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/bin/clear", "/usr/bin/infocmp", "/usr/bin/tabs", "/usr/bin/tic", "/usr/bin/toe", "/usr/bin/tput", "/usr/bin/tset", "/usr/share/doc/ncurses-bin/changelog.Debian.gz", "/usr/share/doc/ncurses-bin/changelog.gz", "/usr/share/doc/ncurses-bin/copyright", "/usr/share/man/man1/captoinfo.1.gz", "/usr/share/man/man1/clear.1.gz", "/usr/share/man/man1/infocmp.1.gz", "/usr/share/man/man1/infotocap.1.gz", "/usr/share/man/man1/tabs.1.gz", "/usr/share/man/man1/tic.1.gz", "/usr/share/man/man1/toe.1.gz", "/usr/share/man/man1/tput.1.gz", "/usr/share/man/man1/tset.1.gz", "/usr/share/man/man5/scr_dump.5.gz", "/usr/share/man/man5/term.5.gz", "/usr/share/man/man5/terminfo.5.gz", "/usr/share/man/man5/user_caps.5.gz", "/usr/share/man/man7/term.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "netbase@6.4", "Name": "netbase", "Identifier": { "PURL": "pkg:deb/debian/netbase@6.4?arch=all\u0026distro=debian-12.15", "UID": "64adcbea2e4e887c" }, "Version": "6.4", "Arch": "all", "SrcName": "netbase", "SrcVersion": "6.4", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/netbase/changelog.gz", "/usr/share/doc/netbase/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "ocl-icd-libopencl1@2.3.1-1", "Name": "ocl-icd-libopencl1", "Identifier": { "PURL": "pkg:deb/debian/ocl-icd-libopencl1@2.3.1-1?arch=amd64\u0026distro=debian-12.15", "UID": "49084cd1ae4a98c4" }, "Version": "2.3.1", "Release": "1", "Arch": "amd64", "SrcName": "ocl-icd", "SrcVersion": "2.3.1", "SrcRelease": "1", "Licenses": [ "BSD-2-Clause" ], "Maintainer": "Debian OpenCL Maintainers \u003cpkg-opencl-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/x86_64-linux-gnu/libOpenCL.so.1.0.0", "/usr/share/doc-base/ocl-icd-libopencl1.ocl-icd-libopencl1", "/usr/share/doc/ocl-icd-libopencl1/NEWS.Debian.gz", "/usr/share/doc/ocl-icd-libopencl1/README", "/usr/share/doc/ocl-icd-libopencl1/README.Debian.gz", "/usr/share/doc/ocl-icd-libopencl1/changelog.Debian.gz", "/usr/share/doc/ocl-icd-libopencl1/changelog.gz", "/usr/share/doc/ocl-icd-libopencl1/copyright", "/usr/share/doc/ocl-icd-libopencl1/html/libOpenCL.html", "/usr/share/lintian/overrides/ocl-icd-libopencl1", "/usr/share/man/man7/libOpenCL.7.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "openssl@3.0.20-1~deb12u2", "Name": "openssl", "Identifier": { "PURL": "pkg:deb/debian/openssl@3.0.20-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "a0263937aada4eab" }, "Version": "3.0.20", "Release": "1~deb12u2", "Arch": "amd64", "SrcName": "openssl", "SrcVersion": "3.0.20", "SrcRelease": "1~deb12u2", "Licenses": [ "Apache-2.0", "Artistic-2.0", "GPL-1.0-or-later", "GPL-1.0-only" ], "Maintainer": "Debian OpenSSL Team \u003cpkg-openssl-devel@alioth-lists.debian.net\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libssl3@3.0.20-1~deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/bin/c_rehash", "/usr/bin/openssl", "/usr/lib/ssl/misc/CA.pl", "/usr/lib/ssl/misc/tsget.pl", "/usr/share/doc/openssl/HOWTO/certificates.txt.gz", "/usr/share/doc/openssl/HOWTO/keys.txt", "/usr/share/doc/openssl/NEWS.Debian.gz", "/usr/share/doc/openssl/NEWS.md.gz", "/usr/share/doc/openssl/README-ENGINES.md.gz", "/usr/share/doc/openssl/README.Debian", "/usr/share/doc/openssl/README.md.gz", "/usr/share/doc/openssl/README.optimization", "/usr/share/doc/openssl/changelog.Debian.gz", "/usr/share/doc/openssl/changelog.gz", "/usr/share/doc/openssl/copyright", "/usr/share/doc/openssl/fingerprints.txt", "/usr/share/lintian/overrides/openssl", "/usr/share/man/man1/CA.pl.1ssl.gz", "/usr/share/man/man1/openssl-asn1parse.1ssl.gz", "/usr/share/man/man1/openssl-ca.1ssl.gz", "/usr/share/man/man1/openssl-ciphers.1ssl.gz", "/usr/share/man/man1/openssl-cmds.1ssl.gz", "/usr/share/man/man1/openssl-cmp.1ssl.gz", "/usr/share/man/man1/openssl-cms.1ssl.gz", "/usr/share/man/man1/openssl-crl.1ssl.gz", "/usr/share/man/man1/openssl-crl2pkcs7.1ssl.gz", "/usr/share/man/man1/openssl-dgst.1ssl.gz", "/usr/share/man/man1/openssl-dhparam.1ssl.gz", "/usr/share/man/man1/openssl-dsa.1ssl.gz", "/usr/share/man/man1/openssl-dsaparam.1ssl.gz", "/usr/share/man/man1/openssl-ec.1ssl.gz", "/usr/share/man/man1/openssl-ecparam.1ssl.gz", "/usr/share/man/man1/openssl-enc.1ssl.gz", "/usr/share/man/man1/openssl-engine.1ssl.gz", "/usr/share/man/man1/openssl-errstr.1ssl.gz", "/usr/share/man/man1/openssl-fipsinstall.1ssl.gz", "/usr/share/man/man1/openssl-format-options.1ssl.gz", "/usr/share/man/man1/openssl-gendsa.1ssl.gz", "/usr/share/man/man1/openssl-genpkey.1ssl.gz", "/usr/share/man/man1/openssl-genrsa.1ssl.gz", "/usr/share/man/man1/openssl-info.1ssl.gz", "/usr/share/man/man1/openssl-kdf.1ssl.gz", "/usr/share/man/man1/openssl-list.1ssl.gz", "/usr/share/man/man1/openssl-mac.1ssl.gz", "/usr/share/man/man1/openssl-namedisplay-options.1ssl.gz", "/usr/share/man/man1/openssl-nseq.1ssl.gz", "/usr/share/man/man1/openssl-ocsp.1ssl.gz", "/usr/share/man/man1/openssl-passphrase-options.1ssl.gz", "/usr/share/man/man1/openssl-passwd.1ssl.gz", "/usr/share/man/man1/openssl-pkcs12.1ssl.gz", "/usr/share/man/man1/openssl-pkcs7.1ssl.gz", "/usr/share/man/man1/openssl-pkcs8.1ssl.gz", "/usr/share/man/man1/openssl-pkey.1ssl.gz", "/usr/share/man/man1/openssl-pkeyparam.1ssl.gz", "/usr/share/man/man1/openssl-pkeyutl.1ssl.gz", "/usr/share/man/man1/openssl-prime.1ssl.gz", "/usr/share/man/man1/openssl-rand.1ssl.gz", "/usr/share/man/man1/openssl-rehash.1ssl.gz", "/usr/share/man/man1/openssl-req.1ssl.gz", "/usr/share/man/man1/openssl-rsa.1ssl.gz", "/usr/share/man/man1/openssl-rsautl.1ssl.gz", "/usr/share/man/man1/openssl-s_client.1ssl.gz", "/usr/share/man/man1/openssl-s_server.1ssl.gz", "/usr/share/man/man1/openssl-s_time.1ssl.gz", "/usr/share/man/man1/openssl-sess_id.1ssl.gz", "/usr/share/man/man1/openssl-smime.1ssl.gz", "/usr/share/man/man1/openssl-speed.1ssl.gz", "/usr/share/man/man1/openssl-spkac.1ssl.gz", "/usr/share/man/man1/openssl-srp.1ssl.gz", "/usr/share/man/man1/openssl-storeutl.1ssl.gz", "/usr/share/man/man1/openssl-ts.1ssl.gz", "/usr/share/man/man1/openssl-verification-options.1ssl.gz", "/usr/share/man/man1/openssl-verify.1ssl.gz", "/usr/share/man/man1/openssl-version.1ssl.gz", "/usr/share/man/man1/openssl-x509.1ssl.gz", "/usr/share/man/man1/openssl.1ssl.gz", "/usr/share/man/man1/tsget.1ssl.gz", "/usr/share/man/man5/config.5ssl.gz", "/usr/share/man/man5/fips_config.5ssl.gz", "/usr/share/man/man5/x509v3_config.5ssl.gz", "/usr/share/man/man7/EVP_ASYM_CIPHER-RSA.7ssl.gz", "/usr/share/man/man7/EVP_ASYM_CIPHER-SM2.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-AES.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-ARIA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-BLOWFISH.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CAMELLIA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CAST.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-CHACHA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-DES.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-IDEA.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-NULL.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC2.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC4.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-RC5.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-SEED.7ssl.gz", "/usr/share/man/man7/EVP_CIPHER-SM4.7ssl.gz", "/usr/share/man/man7/EVP_KDF-HKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-KB.7ssl.gz", "/usr/share/man/man7/EVP_KDF-KRB5KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PBKDF1.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PBKDF2.7ssl.gz", "/usr/share/man/man7/EVP_KDF-PKCS12KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SCRYPT.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SS.7ssl.gz", "/usr/share/man/man7/EVP_KDF-SSHKDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-TLS13_KDF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-TLS1_PRF.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X942-ASN1.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X942-CONCAT.7ssl.gz", "/usr/share/man/man7/EVP_KDF-X963.7ssl.gz", "/usr/share/man/man7/EVP_KEM-RSA.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-DH.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-ECDH.7ssl.gz", "/usr/share/man/man7/EVP_KEYEXCH-X25519.7ssl.gz", "/usr/share/man/man7/EVP_MAC-BLAKE2.7ssl.gz", "/usr/share/man/man7/EVP_MAC-CMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-GMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-KMAC.7ssl.gz", "/usr/share/man/man7/EVP_MAC-Poly1305.7ssl.gz", "/usr/share/man/man7/EVP_MAC-Siphash.7ssl.gz", "/usr/share/man/man7/EVP_MD-BLAKE2.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD2.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD4.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD5-SHA1.7ssl.gz", "/usr/share/man/man7/EVP_MD-MD5.7ssl.gz", "/usr/share/man/man7/EVP_MD-MDC2.7ssl.gz", "/usr/share/man/man7/EVP_MD-NULL.7ssl.gz", "/usr/share/man/man7/EVP_MD-RIPEMD160.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA1.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA2.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHA3.7ssl.gz", "/usr/share/man/man7/EVP_MD-SHAKE.7ssl.gz", "/usr/share/man/man7/EVP_MD-SM3.7ssl.gz", "/usr/share/man/man7/EVP_MD-WHIRLPOOL.7ssl.gz", "/usr/share/man/man7/EVP_MD-common.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-DH.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-DSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-EC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-FFC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-RSA.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-SM2.7ssl.gz", "/usr/share/man/man7/EVP_PKEY-X25519.7ssl.gz", "/usr/share/man/man7/EVP_RAND-CTR-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-HASH-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-HMAC-DRBG.7ssl.gz", "/usr/share/man/man7/EVP_RAND-SEED-SRC.7ssl.gz", "/usr/share/man/man7/EVP_RAND-TEST-RAND.7ssl.gz", "/usr/share/man/man7/EVP_RAND.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-DSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ECDSA.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-ED25519.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-HMAC.7ssl.gz", "/usr/share/man/man7/EVP_SIGNATURE-RSA.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-FIPS.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-base.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-default.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-legacy.7ssl.gz", "/usr/share/man/man7/OSSL_PROVIDER-null.7ssl.gz", "/usr/share/man/man7/RAND.7ssl.gz", "/usr/share/man/man7/RSA-PSS.7ssl.gz", "/usr/share/man/man7/X25519.7ssl.gz", "/usr/share/man/man7/bio.7ssl.gz", "/usr/share/man/man7/crypto.7ssl.gz", "/usr/share/man/man7/ct.7ssl.gz", "/usr/share/man/man7/des_modes.7ssl.gz", "/usr/share/man/man7/evp.7ssl.gz", "/usr/share/man/man7/fips_module.7ssl.gz", "/usr/share/man/man7/life_cycle-cipher.7ssl.gz", "/usr/share/man/man7/life_cycle-digest.7ssl.gz", "/usr/share/man/man7/life_cycle-kdf.7ssl.gz", "/usr/share/man/man7/life_cycle-mac.7ssl.gz", "/usr/share/man/man7/life_cycle-pkey.7ssl.gz", "/usr/share/man/man7/life_cycle-rand.7ssl.gz", "/usr/share/man/man7/migration_guide.7ssl.gz", "/usr/share/man/man7/openssl-core.h.7ssl.gz", "/usr/share/man/man7/openssl-core_dispatch.h.7ssl.gz", "/usr/share/man/man7/openssl-core_names.h.7ssl.gz", "/usr/share/man/man7/openssl-env.7ssl.gz", "/usr/share/man/man7/openssl-glossary.7ssl.gz", "/usr/share/man/man7/openssl-threads.7ssl.gz", "/usr/share/man/man7/openssl_user_macros.7ssl.gz", "/usr/share/man/man7/ossl_store-file.7ssl.gz", "/usr/share/man/man7/ossl_store.7ssl.gz", "/usr/share/man/man7/passphrase-encoding.7ssl.gz", "/usr/share/man/man7/property.7ssl.gz", "/usr/share/man/man7/provider-asym_cipher.7ssl.gz", "/usr/share/man/man7/provider-base.7ssl.gz", "/usr/share/man/man7/provider-cipher.7ssl.gz", "/usr/share/man/man7/provider-decoder.7ssl.gz", "/usr/share/man/man7/provider-digest.7ssl.gz", "/usr/share/man/man7/provider-encoder.7ssl.gz", "/usr/share/man/man7/provider-kdf.7ssl.gz", "/usr/share/man/man7/provider-kem.7ssl.gz", "/usr/share/man/man7/provider-keyexch.7ssl.gz", "/usr/share/man/man7/provider-keymgmt.7ssl.gz", "/usr/share/man/man7/provider-mac.7ssl.gz", "/usr/share/man/man7/provider-object.7ssl.gz", "/usr/share/man/man7/provider-rand.7ssl.gz", "/usr/share/man/man7/provider-signature.7ssl.gz", "/usr/share/man/man7/provider-storemgmt.7ssl.gz", "/usr/share/man/man7/provider.7ssl.gz", "/usr/share/man/man7/proxy-certificates.7ssl.gz", "/usr/share/man/man7/ssl.7ssl.gz", "/usr/share/man/man7/x509.7ssl.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "passwd@1:4.13+dfsg1-1+deb12u2", "Name": "passwd", "Identifier": { "PURL": "pkg:deb/debian/passwd@4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "8c2b119c05698e6a" }, "Version": "4.13+dfsg1", "Release": "1+deb12u2", "Epoch": 1, "Arch": "amd64", "SrcName": "shadow", "SrcVersion": "4.13+dfsg1", "SrcRelease": "1+deb12u2", "SrcEpoch": 1, "Licenses": [ "BSD-3-Clause", "GPL-1.0-only", "GPL-2.0-or-later", "public-domain", "GPL-2.0-only" ], "Maintainer": "Shadow package maintainers \u003cpkg-shadow-devel@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:3.0.9-1", "libc6@2.36-9+deb12u14", "libcrypt1@1:4.4.33-2", "libpam-modules@1.5.2-6+deb12u2", "libpam0g@1.5.2-6+deb12u2", "libselinux1@3.4-1+b6", "libsemanage2@3.4-1+b5" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/sbin/shadowconfig", "/usr/bin/chage", "/usr/bin/chfn", "/usr/bin/chsh", "/usr/bin/expiry", "/usr/bin/gpasswd", "/usr/bin/passwd", "/usr/lib/tmpfiles.d/passwd.conf", "/usr/sbin/chgpasswd", "/usr/sbin/chpasswd", "/usr/sbin/cppw", "/usr/sbin/groupadd", "/usr/sbin/groupdel", "/usr/sbin/groupmems", "/usr/sbin/groupmod", "/usr/sbin/grpck", "/usr/sbin/grpconv", "/usr/sbin/grpunconv", "/usr/sbin/newusers", "/usr/sbin/pwck", "/usr/sbin/pwconv", "/usr/sbin/pwunconv", "/usr/sbin/useradd", "/usr/sbin/userdel", "/usr/sbin/usermod", "/usr/sbin/vipw", "/usr/share/doc/passwd/NEWS.Debian.gz", "/usr/share/doc/passwd/README.Debian", "/usr/share/doc/passwd/TODO.Debian", "/usr/share/doc/passwd/changelog.Debian.gz", "/usr/share/doc/passwd/changelog.gz", "/usr/share/doc/passwd/copyright", "/usr/share/doc/passwd/examples/passwd.expire.cron", "/usr/share/lintian/overrides/passwd", "/usr/share/man/cs/man1/expiry.1.gz", "/usr/share/man/cs/man1/gpasswd.1.gz", "/usr/share/man/cs/man5/gshadow.5.gz", "/usr/share/man/cs/man5/passwd.5.gz", "/usr/share/man/cs/man5/shadow.5.gz", "/usr/share/man/cs/man8/groupadd.8.gz", "/usr/share/man/cs/man8/groupdel.8.gz", "/usr/share/man/cs/man8/groupmod.8.gz", "/usr/share/man/cs/man8/grpck.8.gz", "/usr/share/man/cs/man8/vipw.8.gz", "/usr/share/man/da/man1/chfn.1.gz", "/usr/share/man/da/man5/gshadow.5.gz", "/usr/share/man/da/man8/groupdel.8.gz", "/usr/share/man/da/man8/vipw.8.gz", "/usr/share/man/de/man1/chage.1.gz", "/usr/share/man/de/man1/chfn.1.gz", "/usr/share/man/de/man1/chsh.1.gz", "/usr/share/man/de/man1/expiry.1.gz", "/usr/share/man/de/man1/gpasswd.1.gz", "/usr/share/man/de/man1/passwd.1.gz", "/usr/share/man/de/man5/gshadow.5.gz", "/usr/share/man/de/man5/passwd.5.gz", "/usr/share/man/de/man5/shadow.5.gz", "/usr/share/man/de/man8/chgpasswd.8.gz", "/usr/share/man/de/man8/chpasswd.8.gz", "/usr/share/man/de/man8/groupadd.8.gz", "/usr/share/man/de/man8/groupdel.8.gz", "/usr/share/man/de/man8/groupmems.8.gz", "/usr/share/man/de/man8/groupmod.8.gz", "/usr/share/man/de/man8/grpck.8.gz", "/usr/share/man/de/man8/newusers.8.gz", "/usr/share/man/de/man8/pwck.8.gz", "/usr/share/man/de/man8/pwconv.8.gz", "/usr/share/man/de/man8/useradd.8.gz", "/usr/share/man/de/man8/userdel.8.gz", "/usr/share/man/de/man8/usermod.8.gz", "/usr/share/man/de/man8/vipw.8.gz", "/usr/share/man/fi/man1/chfn.1.gz", "/usr/share/man/fi/man1/chsh.1.gz", "/usr/share/man/fr/man1/chage.1.gz", "/usr/share/man/fr/man1/chfn.1.gz", "/usr/share/man/fr/man1/chsh.1.gz", "/usr/share/man/fr/man1/expiry.1.gz", "/usr/share/man/fr/man1/gpasswd.1.gz", "/usr/share/man/fr/man1/passwd.1.gz", "/usr/share/man/fr/man5/gshadow.5.gz", "/usr/share/man/fr/man5/passwd.5.gz", "/usr/share/man/fr/man5/shadow.5.gz", "/usr/share/man/fr/man5/subgid.5.gz", "/usr/share/man/fr/man5/subuid.5.gz", "/usr/share/man/fr/man8/chgpasswd.8.gz", "/usr/share/man/fr/man8/chpasswd.8.gz", "/usr/share/man/fr/man8/groupadd.8.gz", "/usr/share/man/fr/man8/groupdel.8.gz", "/usr/share/man/fr/man8/groupmems.8.gz", "/usr/share/man/fr/man8/groupmod.8.gz", "/usr/share/man/fr/man8/grpck.8.gz", "/usr/share/man/fr/man8/newusers.8.gz", "/usr/share/man/fr/man8/pwck.8.gz", "/usr/share/man/fr/man8/pwconv.8.gz", "/usr/share/man/fr/man8/useradd.8.gz", "/usr/share/man/fr/man8/userdel.8.gz", "/usr/share/man/fr/man8/usermod.8.gz", "/usr/share/man/fr/man8/vipw.8.gz", "/usr/share/man/hu/man1/chsh.1.gz", "/usr/share/man/hu/man1/gpasswd.1.gz", "/usr/share/man/hu/man1/passwd.1.gz", "/usr/share/man/hu/man5/passwd.5.gz", "/usr/share/man/id/man1/chsh.1.gz", "/usr/share/man/id/man8/useradd.8.gz", "/usr/share/man/it/man1/chage.1.gz", "/usr/share/man/it/man1/chfn.1.gz", "/usr/share/man/it/man1/chsh.1.gz", "/usr/share/man/it/man1/expiry.1.gz", "/usr/share/man/it/man1/gpasswd.1.gz", "/usr/share/man/it/man1/passwd.1.gz", "/usr/share/man/it/man5/gshadow.5.gz", "/usr/share/man/it/man5/passwd.5.gz", "/usr/share/man/it/man5/shadow.5.gz", "/usr/share/man/it/man8/chgpasswd.8.gz", "/usr/share/man/it/man8/chpasswd.8.gz", "/usr/share/man/it/man8/groupadd.8.gz", "/usr/share/man/it/man8/groupdel.8.gz", "/usr/share/man/it/man8/groupmems.8.gz", "/usr/share/man/it/man8/groupmod.8.gz", "/usr/share/man/it/man8/grpck.8.gz", "/usr/share/man/it/man8/newusers.8.gz", "/usr/share/man/it/man8/pwck.8.gz", "/usr/share/man/it/man8/pwconv.8.gz", "/usr/share/man/it/man8/useradd.8.gz", "/usr/share/man/it/man8/userdel.8.gz", "/usr/share/man/it/man8/usermod.8.gz", "/usr/share/man/it/man8/vipw.8.gz", "/usr/share/man/ja/man1/chage.1.gz", "/usr/share/man/ja/man1/chfn.1.gz", "/usr/share/man/ja/man1/chsh.1.gz", "/usr/share/man/ja/man1/expiry.1.gz", "/usr/share/man/ja/man1/gpasswd.1.gz", "/usr/share/man/ja/man1/passwd.1.gz", "/usr/share/man/ja/man5/passwd.5.gz", "/usr/share/man/ja/man5/shadow.5.gz", "/usr/share/man/ja/man8/chpasswd.8.gz", "/usr/share/man/ja/man8/groupadd.8.gz", "/usr/share/man/ja/man8/groupdel.8.gz", "/usr/share/man/ja/man8/groupmod.8.gz", "/usr/share/man/ja/man8/grpck.8.gz", "/usr/share/man/ja/man8/newusers.8.gz", "/usr/share/man/ja/man8/pwck.8.gz", "/usr/share/man/ja/man8/pwconv.8.gz", "/usr/share/man/ja/man8/useradd.8.gz", "/usr/share/man/ja/man8/userdel.8.gz", "/usr/share/man/ja/man8/usermod.8.gz", "/usr/share/man/ja/man8/vipw.8.gz", "/usr/share/man/ko/man1/chfn.1.gz", "/usr/share/man/ko/man1/chsh.1.gz", "/usr/share/man/ko/man5/passwd.5.gz", "/usr/share/man/ko/man8/vipw.8.gz", "/usr/share/man/man1/chage.1.gz", "/usr/share/man/man1/chfn.1.gz", "/usr/share/man/man1/chsh.1.gz", "/usr/share/man/man1/expiry.1.gz", "/usr/share/man/man1/gpasswd.1.gz", "/usr/share/man/man1/passwd.1.gz", "/usr/share/man/man5/gshadow.5.gz", "/usr/share/man/man5/passwd.5.gz", "/usr/share/man/man5/shadow.5.gz", "/usr/share/man/man5/subgid.5.gz", "/usr/share/man/man5/subuid.5.gz", "/usr/share/man/man8/chgpasswd.8.gz", "/usr/share/man/man8/chpasswd.8.gz", "/usr/share/man/man8/cppw.8.gz", "/usr/share/man/man8/groupadd.8.gz", "/usr/share/man/man8/groupdel.8.gz", "/usr/share/man/man8/groupmems.8.gz", "/usr/share/man/man8/groupmod.8.gz", "/usr/share/man/man8/grpck.8.gz", "/usr/share/man/man8/newusers.8.gz", "/usr/share/man/man8/pwck.8.gz", "/usr/share/man/man8/pwconv.8.gz", "/usr/share/man/man8/useradd.8.gz", "/usr/share/man/man8/userdel.8.gz", "/usr/share/man/man8/usermod.8.gz", "/usr/share/man/man8/vipw.8.gz", "/usr/share/man/pl/man1/chage.1.gz", "/usr/share/man/pl/man1/chsh.1.gz", "/usr/share/man/pl/man1/expiry.1.gz", "/usr/share/man/pl/man8/groupadd.8.gz", "/usr/share/man/pl/man8/groupdel.8.gz", "/usr/share/man/pl/man8/groupmems.8.gz", "/usr/share/man/pl/man8/groupmod.8.gz", "/usr/share/man/pl/man8/grpck.8.gz", "/usr/share/man/pl/man8/userdel.8.gz", "/usr/share/man/pl/man8/usermod.8.gz", "/usr/share/man/pl/man8/vipw.8.gz", "/usr/share/man/pt_BR/man1/gpasswd.1.gz", "/usr/share/man/pt_BR/man5/passwd.5.gz", "/usr/share/man/pt_BR/man5/shadow.5.gz", "/usr/share/man/pt_BR/man8/groupadd.8.gz", "/usr/share/man/pt_BR/man8/groupdel.8.gz", "/usr/share/man/pt_BR/man8/groupmod.8.gz", "/usr/share/man/ru/man1/chage.1.gz", "/usr/share/man/ru/man1/chfn.1.gz", "/usr/share/man/ru/man1/chsh.1.gz", "/usr/share/man/ru/man1/expiry.1.gz", "/usr/share/man/ru/man1/gpasswd.1.gz", "/usr/share/man/ru/man1/passwd.1.gz", "/usr/share/man/ru/man5/gshadow.5.gz", "/usr/share/man/ru/man5/passwd.5.gz", "/usr/share/man/ru/man5/shadow.5.gz", "/usr/share/man/ru/man8/chgpasswd.8.gz", "/usr/share/man/ru/man8/chpasswd.8.gz", "/usr/share/man/ru/man8/groupadd.8.gz", "/usr/share/man/ru/man8/groupdel.8.gz", "/usr/share/man/ru/man8/groupmems.8.gz", "/usr/share/man/ru/man8/groupmod.8.gz", "/usr/share/man/ru/man8/grpck.8.gz", "/usr/share/man/ru/man8/newusers.8.gz", "/usr/share/man/ru/man8/pwck.8.gz", "/usr/share/man/ru/man8/pwconv.8.gz", "/usr/share/man/ru/man8/useradd.8.gz", "/usr/share/man/ru/man8/userdel.8.gz", "/usr/share/man/ru/man8/usermod.8.gz", "/usr/share/man/ru/man8/vipw.8.gz", "/usr/share/man/sv/man1/chage.1.gz", "/usr/share/man/sv/man1/chsh.1.gz", "/usr/share/man/sv/man1/expiry.1.gz", "/usr/share/man/sv/man1/passwd.1.gz", "/usr/share/man/sv/man5/gshadow.5.gz", "/usr/share/man/sv/man5/passwd.5.gz", "/usr/share/man/sv/man8/groupadd.8.gz", "/usr/share/man/sv/man8/groupdel.8.gz", "/usr/share/man/sv/man8/groupmems.8.gz", "/usr/share/man/sv/man8/groupmod.8.gz", "/usr/share/man/sv/man8/grpck.8.gz", "/usr/share/man/sv/man8/pwck.8.gz", "/usr/share/man/sv/man8/userdel.8.gz", "/usr/share/man/sv/man8/vipw.8.gz", "/usr/share/man/tr/man1/chage.1.gz", "/usr/share/man/tr/man1/chfn.1.gz", "/usr/share/man/tr/man1/passwd.1.gz", "/usr/share/man/tr/man5/passwd.5.gz", "/usr/share/man/tr/man5/shadow.5.gz", "/usr/share/man/tr/man8/groupadd.8.gz", "/usr/share/man/tr/man8/groupdel.8.gz", "/usr/share/man/tr/man8/groupmod.8.gz", "/usr/share/man/tr/man8/useradd.8.gz", "/usr/share/man/tr/man8/userdel.8.gz", "/usr/share/man/tr/man8/usermod.8.gz", "/usr/share/man/uk/man1/chage.1.gz", "/usr/share/man/uk/man1/chfn.1.gz", "/usr/share/man/uk/man1/chsh.1.gz", "/usr/share/man/uk/man1/expiry.1.gz", "/usr/share/man/uk/man1/gpasswd.1.gz", "/usr/share/man/uk/man1/passwd.1.gz", "/usr/share/man/uk/man5/gshadow.5.gz", "/usr/share/man/uk/man5/passwd.5.gz", "/usr/share/man/uk/man5/shadow.5.gz", "/usr/share/man/uk/man8/chgpasswd.8.gz", "/usr/share/man/uk/man8/chpasswd.8.gz", "/usr/share/man/uk/man8/groupadd.8.gz", "/usr/share/man/uk/man8/groupdel.8.gz", "/usr/share/man/uk/man8/groupmems.8.gz", "/usr/share/man/uk/man8/groupmod.8.gz", "/usr/share/man/uk/man8/grpck.8.gz", "/usr/share/man/uk/man8/newusers.8.gz", "/usr/share/man/uk/man8/pwck.8.gz", "/usr/share/man/uk/man8/pwconv.8.gz", "/usr/share/man/uk/man8/useradd.8.gz", "/usr/share/man/uk/man8/userdel.8.gz", "/usr/share/man/uk/man8/usermod.8.gz", "/usr/share/man/uk/man8/vipw.8.gz", "/usr/share/man/zh_CN/man1/chage.1.gz", "/usr/share/man/zh_CN/man1/chfn.1.gz", "/usr/share/man/zh_CN/man1/chsh.1.gz", "/usr/share/man/zh_CN/man1/expiry.1.gz", "/usr/share/man/zh_CN/man1/gpasswd.1.gz", "/usr/share/man/zh_CN/man1/passwd.1.gz", "/usr/share/man/zh_CN/man5/gshadow.5.gz", "/usr/share/man/zh_CN/man5/passwd.5.gz", "/usr/share/man/zh_CN/man5/shadow.5.gz", "/usr/share/man/zh_CN/man8/chgpasswd.8.gz", "/usr/share/man/zh_CN/man8/chpasswd.8.gz", "/usr/share/man/zh_CN/man8/groupadd.8.gz", "/usr/share/man/zh_CN/man8/groupdel.8.gz", "/usr/share/man/zh_CN/man8/groupmems.8.gz", "/usr/share/man/zh_CN/man8/groupmod.8.gz", "/usr/share/man/zh_CN/man8/grpck.8.gz", "/usr/share/man/zh_CN/man8/newusers.8.gz", "/usr/share/man/zh_CN/man8/pwck.8.gz", "/usr/share/man/zh_CN/man8/pwconv.8.gz", "/usr/share/man/zh_CN/man8/useradd.8.gz", "/usr/share/man/zh_CN/man8/userdel.8.gz", "/usr/share/man/zh_CN/man8/usermod.8.gz", "/usr/share/man/zh_CN/man8/vipw.8.gz", "/usr/share/man/zh_TW/man1/chfn.1.gz", "/usr/share/man/zh_TW/man1/chsh.1.gz", "/usr/share/man/zh_TW/man5/passwd.5.gz", "/usr/share/man/zh_TW/man8/chpasswd.8.gz", "/usr/share/man/zh_TW/man8/groupadd.8.gz", "/usr/share/man/zh_TW/man8/groupdel.8.gz", "/usr/share/man/zh_TW/man8/groupmod.8.gz", "/usr/share/man/zh_TW/man8/useradd.8.gz", "/usr/share/man/zh_TW/man8/userdel.8.gz", "/usr/share/man/zh_TW/man8/usermod.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "perl@5.36.0-7+deb12u3", "Name": "perl", "Identifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "Version": "5.36.0", "Release": "7+deb12u3", "Arch": "amd64", "SrcName": "perl", "SrcVersion": "5.36.0", "SrcRelease": "7+deb12u3", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "RRA-KEEP-THIS-NOTICE", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2", "HSIEH-DERIVATIVE", "HSIEH-BSD" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libperl5.36@5.36.0-7+deb12u3", "perl-base@5.36.0-7+deb12u3", "perl-modules-5.36@5.36.0-7+deb12u3" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/bin/corelist", "/usr/bin/cpan", "/usr/bin/enc2xs", "/usr/bin/encguess", "/usr/bin/h2ph", "/usr/bin/h2xs", "/usr/bin/instmodsh", "/usr/bin/json_pp", "/usr/bin/libnetcfg", "/usr/bin/perlbug", "/usr/bin/perldoc", "/usr/bin/perlivp", "/usr/bin/perlthanks", "/usr/bin/piconv", "/usr/bin/pl2pm", "/usr/bin/pod2html", "/usr/bin/pod2man", "/usr/bin/pod2text", "/usr/bin/pod2usage", "/usr/bin/podchecker", "/usr/bin/prove", "/usr/bin/ptar", "/usr/bin/ptardiff", "/usr/bin/ptargrep", "/usr/bin/shasum", "/usr/bin/splain", "/usr/bin/streamzip", "/usr/bin/xsubpp", "/usr/bin/zipdetails", "/usr/share/doc/perl/README.Debian", "/usr/share/doc/perl/changelog.Debian.gz", "/usr/share/doc/perl/changelog.gz", "/usr/share/doc/perl/copyright", "/usr/share/lintian/overrides/perl", "/usr/share/man/man1/corelist.1.gz", "/usr/share/man/man1/cpan.1.gz", "/usr/share/man/man1/enc2xs.1.gz", "/usr/share/man/man1/encguess.1.gz", "/usr/share/man/man1/h2ph.1.gz", "/usr/share/man/man1/h2xs.1.gz", "/usr/share/man/man1/instmodsh.1.gz", "/usr/share/man/man1/json_pp.1.gz", "/usr/share/man/man1/libnetcfg.1.gz", "/usr/share/man/man1/perlbug.1.gz", "/usr/share/man/man1/perlivp.1.gz", "/usr/share/man/man1/piconv.1.gz", "/usr/share/man/man1/pl2pm.1.gz", "/usr/share/man/man1/pod2html.1.gz", "/usr/share/man/man1/pod2man.1.gz", "/usr/share/man/man1/pod2text.1.gz", "/usr/share/man/man1/pod2usage.1.gz", "/usr/share/man/man1/podchecker.1.gz", "/usr/share/man/man1/prove.1.gz", "/usr/share/man/man1/ptar.1.gz", "/usr/share/man/man1/ptardiff.1.gz", "/usr/share/man/man1/ptargrep.1.gz", "/usr/share/man/man1/shasum.1.gz", "/usr/share/man/man1/splain.1.gz", "/usr/share/man/man1/streamzip.1.gz", "/usr/share/man/man1/xsubpp.1.gz", "/usr/share/man/man1/zipdetails.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "perl-base@5.36.0-7+deb12u3", "Name": "perl-base", "Identifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "Version": "5.36.0", "Release": "7+deb12u3", "Arch": "amd64", "SrcName": "perl", "SrcVersion": "5.36.0", "SrcRelease": "7+deb12u3", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "RRA-KEEP-THIS-NOTICE", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2", "HSIEH-DERIVATIVE", "HSIEH-BSD" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/bin/perl", "/usr/bin/perl5.36.0", "/usr/lib/x86_64-linux-gnu/perl-base/AutoLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Carp.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Carp/Heavy.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Config.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Config_git.pl", "/usr/lib/x86_64-linux-gnu/perl-base/Config_heavy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/Cwd.pm", "/usr/lib/x86_64-linux-gnu/perl-base/DynaLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Errno.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Exporter.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Exporter/Heavy.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Fcntl.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Basename.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Glob.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Path.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Spec.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Spec/Unix.pm", "/usr/lib/x86_64-linux-gnu/perl-base/File/Temp.pm", "/usr/lib/x86_64-linux-gnu/perl-base/FileHandle.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Getopt/Long.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Hash/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/File.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Handle.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Pipe.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Seekable.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Select.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/INET.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/IP.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IO/Socket/UNIX.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open2.pm", "/usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm", "/usr/lib/x86_64-linux-gnu/perl-base/List/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/POSIX.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Scalar/Util.pm", "/usr/lib/x86_64-linux-gnu/perl-base/SelectSaver.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Socket.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Symbol.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/ParseWords.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/Tabs.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Text/Wrap.pm", "/usr/lib/x86_64-linux-gnu/perl-base/Tie/Hash.pm", "/usr/lib/x86_64-linux-gnu/perl-base/XSLoader.pm", "/usr/lib/x86_64-linux-gnu/perl-base/attributes.pm", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Cwd/Cwd.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Fcntl/Fcntl.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/File/Glob/Glob.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Hash/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/IO/IO.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/List/Util/Util.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/POSIX/POSIX.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/Socket/Socket.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/attributes/attributes.so", "/usr/lib/x86_64-linux-gnu/perl-base/auto/re/re.so", "/usr/lib/x86_64-linux-gnu/perl-base/base.pm", "/usr/lib/x86_64-linux-gnu/perl-base/builtin.pm", "/usr/lib/x86_64-linux-gnu/perl-base/bytes.pm", "/usr/lib/x86_64-linux-gnu/perl-base/bytes_heavy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/constant.pm", "/usr/lib/x86_64-linux-gnu/perl-base/feature.pm", "/usr/lib/x86_64-linux-gnu/perl-base/fields.pm", "/usr/lib/x86_64-linux-gnu/perl-base/integer.pm", "/usr/lib/x86_64-linux-gnu/perl-base/lib.pm", "/usr/lib/x86_64-linux-gnu/perl-base/locale.pm", "/usr/lib/x86_64-linux-gnu/perl-base/overload.pm", "/usr/lib/x86_64-linux-gnu/perl-base/overloading.pm", "/usr/lib/x86_64-linux-gnu/perl-base/parent.pm", "/usr/lib/x86_64-linux-gnu/perl-base/re.pm", "/usr/lib/x86_64-linux-gnu/perl-base/strict.pm", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Age.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bmg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bpb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Bpt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Cf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Ea.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/EqUIdeo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/GCB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Gc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Hst.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Identif2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Identifi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/InPC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/InSC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Isc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Jg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Jt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Lb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Lc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFCQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFDQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKCCF.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKCQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NFKDQC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Na1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/NameAlia.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Nt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Nv.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/PerlDeci.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/SB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Sc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Scx.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Tc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Uc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/Vo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/WB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/_PerlLB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/To/_PerlSCX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V100.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V11.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V110.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V120.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V130.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V140.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V20.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V30.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V31.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V32.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V40.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V41.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V50.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V51.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V52.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V60.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V61.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V70.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V80.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V90.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Alpha/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/AN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/B.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/BN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/CS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/EN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ES.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ET.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/NSM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/ON.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bc/WS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/BidiC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/BidiM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Blk/NB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Bpt/O.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CE/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CI/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWCF/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWCM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWKCF/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWL/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWT/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CWU/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Cased/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/A.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/AR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/ATAR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/B.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/BR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/DB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/NK.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/NR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/OV.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ccc/VR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/CompEx/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/DI/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dash/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dep/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dia/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Com.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Enc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Fin.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Font.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Init.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Iso.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Med.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Nar.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Nb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/NonCanon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sqr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sub.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Sup.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Dt/Vert.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EBase/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EComp/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/EPres/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/A.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/H.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/Na.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ea/W.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Emoji/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ext/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/ExtPict/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/CN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/LV.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/LVT.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/PP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/SM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GCB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Cf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Cn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/LC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Ll.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Lu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/M.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Mc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Me.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Mn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Nd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Nl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/No.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/P.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pe.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Pi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Po.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Ps.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/S.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sk.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Sm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/So.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Z.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Gc/Zs.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GrBase/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/GrExt/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hex/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hst/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Hyphen/T.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IDC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IDS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdStatus/Allowed.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdStatus/Restrict.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/DefaultI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Exclusio.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Inclusio.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/LimitedU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotChara.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotNFKC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/NotXID.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Obsolete.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Recommen.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Technica.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/IdType/Uncommon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Ideo/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/10_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/11_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/12_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/12_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/13_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/14_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/2_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/2_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/3_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/4_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/4_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/5_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/6_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/7_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/8_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/In/9_0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Bottom.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/BottomAn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Left.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/LeftAndR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/NA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Overstru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Right.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/Top.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndBo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndL2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndLe.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/TopAndRi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InPC/VisualOr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Avagraha.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Bindu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Cantilla.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona5.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona7.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consona8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Consonan.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Invisibl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Nukta.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Number.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Other.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/PureKill.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Syllable.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/ToneMark.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Virama.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Visarga.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/Vowel.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/VowelDep.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/InSC/VowelInd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Ain.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Alef.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Beh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Dal.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/FarsiYeh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Feh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Gaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Hah.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/HanifiRo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Kaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Lam.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/NoJoinin.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Noon.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Qaf.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Reh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Sad.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Seen.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Tah.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Waw.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jg/Yeh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/C.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/D.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/L.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/T.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Jt/U.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/AI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/AL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/BA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/BB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CJ.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/CM.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/GL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/ID.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/IN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/IS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/NS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/OP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/PO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/PR.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/QU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/SA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lb/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Lower/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Math/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFCQC/M.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFCQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFDQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFDQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKCQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKCQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKDQC/N.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/NFKDQC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/Di.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/None.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nt/Nu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/0.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/10.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/100.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/10000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/100000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/11.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/12.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/13.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/14.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/15.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/17.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/18.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/19.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/1_8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/20.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/200.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/20000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/2_3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/30.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/300.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/30000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3_16.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/3_4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/4.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/40.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/400.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/4000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/40000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/5.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/50.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/500.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/5000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/50000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/6.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/60.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/600.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/6000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/60000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/7.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/70.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/700.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/7000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/70000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/8.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/80.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/800.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/8000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/80000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/9.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/90.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/900.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/9000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Nv/90000.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/PCM/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/PatSyn/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Alnum.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Assigned.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Blank.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Graph.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/PerlWord.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/PosixPun.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Print.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/SpacePer.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Title.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/Word.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/XPosixPu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlAny.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlCh2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlCha.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlFol.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIDC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIDS.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlIsI.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlNch.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPat.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPr2.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlPro.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Perl/_PerlQuo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/QMark/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/AT.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/CL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/FO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/LE.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/LO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/SC.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/ST.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/Sp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/UP.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/SD/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/STerm/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Arab.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Beng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Cprt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Cyrl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Deva.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Dupl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Geor.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Glag.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gonm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gran.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Grek.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Gujr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Guru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Han.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Hang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Hira.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Kana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Knda.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Latn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Limb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Linb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mlym.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Mult.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Orya.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Sinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Syrc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Taml.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Telu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Zinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Sc/Zyyy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Adlm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Arab.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Armn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Beng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Bhks.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Bopo.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cakm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cham.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Copt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cprt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Cyrl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Deva.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Diak.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Dupl.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Ethi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Geor.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Glag.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gonm.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gran.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Grek.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Gujr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Guru.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Han.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hebr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hira.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hmng.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Hmnp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Kana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khar.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khmr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Khoj.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Knda.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Kthi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lana.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lao.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Latn.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Limb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Lina.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Linb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mlym.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mong.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mult.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Mymr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Nand.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Nko.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Orya.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Phlp.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Rohg.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Shrd.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Sind.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Sinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Syrc.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tagb.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Takr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Talu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Taml.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tang.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Telu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Thaa.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tibt.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Tirh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Vith.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Xsux.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Yezi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Yi.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zinh.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zyyy.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Scx/Zzzz.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Term/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/UIdeo/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Upper/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/VS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/R.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/Tr.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/Tu.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Vo/U.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/EX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/Extend.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/FO.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/HL.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/KA.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/LE.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/MB.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/ML.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/MN.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/NU.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/WSegSpac.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/WB/XX.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/XIDC/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/XIDS/Y.pl", "/usr/lib/x86_64-linux-gnu/perl-base/utf8.pm", "/usr/lib/x86_64-linux-gnu/perl-base/vars.pm", "/usr/lib/x86_64-linux-gnu/perl-base/warnings.pm", "/usr/lib/x86_64-linux-gnu/perl-base/warnings/register.pm", "/usr/share/doc/perl-base/changelog.Debian.gz", "/usr/share/doc/perl-base/changelog.gz", "/usr/share/doc/perl-base/copyright", "/usr/share/doc/perl/AUTHORS.gz", "/usr/share/doc/perl/Documentation", "/usr/share/lintian/overrides/perl-base", "/usr/share/man/man1/perl.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "perl-modules-5.36@5.36.0-7+deb12u3", "Name": "perl-modules-5.36", "Identifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "Version": "5.36.0", "Release": "7+deb12u3", "Arch": "all", "SrcName": "perl", "SrcVersion": "5.36.0", "SrcRelease": "7+deb12u3", "Licenses": [ "GPL-1.0-or-later", "Artistic-2.0", "MIT", "REGCOMP", "GPL-2.0-with-bison-exception+", "Unicode", "BZIP", "Zlib", "GPL-2.0-or-later", "RRA-KEEP-THIS-NOTICE", "BSD-3-clause-with-weird-numbering", "CC0-1.0", "TEXT-TABS", "BSD-4-clause-POWERDOG", "BSD-3-clause-GENERIC", "BSD-3-Clause", "SDBM-PUBLIC-DOMAIN", "DONT-CHANGE-THE-GPL", "Artistic-dist", "LGPL-2.1-only", "GPL-1.0-only", "GPL-2.0-only", "Artistic-2", "HSIEH-DERIVATIVE", "HSIEH-BSD" ], "Maintainer": "Niko Tyni \u003cntyni@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "perl-base@5.36.0-7+deb12u3" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/perl-modules-5.36/README.Debian", "/usr/share/doc/perl-modules-5.36/changelog.Debian.gz", "/usr/share/doc/perl-modules-5.36/changelog.gz", "/usr/share/doc/perl-modules-5.36/copyright", "/usr/share/perl/5.36.0/AnyDBM_File.pm", "/usr/share/perl/5.36.0/App/Cpan.pm", "/usr/share/perl/5.36.0/App/Prove.pm", "/usr/share/perl/5.36.0/App/Prove/State.pm", "/usr/share/perl/5.36.0/App/Prove/State/Result.pm", "/usr/share/perl/5.36.0/App/Prove/State/Result/Test.pm", "/usr/share/perl/5.36.0/Archive/Tar.pm", "/usr/share/perl/5.36.0/Archive/Tar/Constant.pm", "/usr/share/perl/5.36.0/Archive/Tar/File.pm", "/usr/share/perl/5.36.0/Attribute/Handlers.pm", "/usr/share/perl/5.36.0/AutoLoader.pm", "/usr/share/perl/5.36.0/AutoSplit.pm", "/usr/share/perl/5.36.0/B/Deparse.pm", "/usr/share/perl/5.36.0/B/Op_private.pm", "/usr/share/perl/5.36.0/Benchmark.pm", "/usr/share/perl/5.36.0/CORE.pod", "/usr/share/perl/5.36.0/CPAN.pm", "/usr/share/perl/5.36.0/CPAN/API/HOWTO.pod", "/usr/share/perl/5.36.0/CPAN/Author.pm", "/usr/share/perl/5.36.0/CPAN/Bundle.pm", "/usr/share/perl/5.36.0/CPAN/CacheMgr.pm", "/usr/share/perl/5.36.0/CPAN/Complete.pm", "/usr/share/perl/5.36.0/CPAN/Debug.pm", "/usr/share/perl/5.36.0/CPAN/DeferredCode.pm", "/usr/share/perl/5.36.0/CPAN/Distribution.pm", "/usr/share/perl/5.36.0/CPAN/Distroprefs.pm", "/usr/share/perl/5.36.0/CPAN/Distrostatus.pm", "/usr/share/perl/5.36.0/CPAN/Exception/RecursiveDependency.pm", "/usr/share/perl/5.36.0/CPAN/Exception/blocked_urllist.pm", "/usr/share/perl/5.36.0/CPAN/Exception/yaml_not_installed.pm", "/usr/share/perl/5.36.0/CPAN/Exception/yaml_process_error.pm", "/usr/share/perl/5.36.0/CPAN/FTP.pm", "/usr/share/perl/5.36.0/CPAN/FTP/netrc.pm", "/usr/share/perl/5.36.0/CPAN/FirstTime.pm", "/usr/share/perl/5.36.0/CPAN/HTTP/Client.pm", "/usr/share/perl/5.36.0/CPAN/HTTP/Credentials.pm", "/usr/share/perl/5.36.0/CPAN/HandleConfig.pm", "/usr/share/perl/5.36.0/CPAN/Index.pm", "/usr/share/perl/5.36.0/CPAN/InfoObj.pm", "/usr/share/perl/5.36.0/CPAN/Kwalify.pm", "/usr/share/perl/5.36.0/CPAN/Kwalify/distroprefs.dd", "/usr/share/perl/5.36.0/CPAN/Kwalify/distroprefs.yml", "/usr/share/perl/5.36.0/CPAN/LWP/UserAgent.pm", "/usr/share/perl/5.36.0/CPAN/Meta.pm", "/usr/share/perl/5.36.0/CPAN/Meta/Converter.pm", "/usr/share/perl/5.36.0/CPAN/Meta/Feature.pm", "/usr/share/perl/5.36.0/CPAN/Meta/History.pm", "/usr/share/perl/5.36.0/CPAN/Meta/History/Meta_1_0.pod", "/usr/share/perl/5.36.0/CPAN/Meta/History/Meta_1_1.pod", "/usr/share/perl/5.36.0/CPAN/Meta/History/Meta_1_2.pod", "/usr/share/perl/5.36.0/CPAN/Meta/History/Meta_1_3.pod", "/usr/share/perl/5.36.0/CPAN/Meta/History/Meta_1_4.pod", "/usr/share/perl/5.36.0/CPAN/Meta/Merge.pm", "/usr/share/perl/5.36.0/CPAN/Meta/Prereqs.pm", "/usr/share/perl/5.36.0/CPAN/Meta/Requirements.pm", "/usr/share/perl/5.36.0/CPAN/Meta/Spec.pm", "/usr/share/perl/5.36.0/CPAN/Meta/Validator.pm", "/usr/share/perl/5.36.0/CPAN/Meta/YAML.pm", "/usr/share/perl/5.36.0/CPAN/Mirrors.pm", "/usr/share/perl/5.36.0/CPAN/Module.pm", "/usr/share/perl/5.36.0/CPAN/Nox.pm", "/usr/share/perl/5.36.0/CPAN/Plugin.pm", "/usr/share/perl/5.36.0/CPAN/Plugin/Specfile.pm", "/usr/share/perl/5.36.0/CPAN/Prompt.pm", "/usr/share/perl/5.36.0/CPAN/Queue.pm", "/usr/share/perl/5.36.0/CPAN/Shell.pm", "/usr/share/perl/5.36.0/CPAN/Tarzip.pm", "/usr/share/perl/5.36.0/CPAN/URL.pm", "/usr/share/perl/5.36.0/CPAN/Version.pm", "/usr/share/perl/5.36.0/Carp.pm", "/usr/share/perl/5.36.0/Carp/Heavy.pm", "/usr/share/perl/5.36.0/Class/Struct.pm", "/usr/share/perl/5.36.0/Compress/Zlib.pm", "/usr/share/perl/5.36.0/Config/Extensions.pm", "/usr/share/perl/5.36.0/Config/Perl/V.pm", "/usr/share/perl/5.36.0/DB.pm", "/usr/share/perl/5.36.0/DBM_Filter.pm", "/usr/share/perl/5.36.0/DBM_Filter/compress.pm", "/usr/share/perl/5.36.0/DBM_Filter/encode.pm", "/usr/share/perl/5.36.0/DBM_Filter/int32.pm", "/usr/share/perl/5.36.0/DBM_Filter/null.pm", "/usr/share/perl/5.36.0/DBM_Filter/utf8.pm", "/usr/share/perl/5.36.0/Devel/SelfStubber.pm", "/usr/share/perl/5.36.0/Digest.pm", "/usr/share/perl/5.36.0/Digest/base.pm", "/usr/share/perl/5.36.0/Digest/file.pm", "/usr/share/perl/5.36.0/DirHandle.pm", "/usr/share/perl/5.36.0/Dumpvalue.pm", "/usr/share/perl/5.36.0/Encode/Changes.e2x", "/usr/share/perl/5.36.0/Encode/ConfigLocal_PM.e2x", "/usr/share/perl/5.36.0/Encode/Makefile_PL.e2x", "/usr/share/perl/5.36.0/Encode/PerlIO.pod", "/usr/share/perl/5.36.0/Encode/README.e2x", "/usr/share/perl/5.36.0/Encode/Supported.pod", "/usr/share/perl/5.36.0/Encode/_PM.e2x", "/usr/share/perl/5.36.0/Encode/_T.e2x", "/usr/share/perl/5.36.0/Encode/encode.h", "/usr/share/perl/5.36.0/English.pm", "/usr/share/perl/5.36.0/Env.pm", "/usr/share/perl/5.36.0/Exporter.pm", "/usr/share/perl/5.36.0/Exporter/Heavy.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Base.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/Unix.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/VMS.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/Windows.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/Windows/BCC.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/Windows/GCC.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/Windows/MSVC.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/aix.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/android.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/cygwin.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/darwin.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/dec_osf.pm", "/usr/share/perl/5.36.0/ExtUtils/CBuilder/Platform/os2.pm", "/usr/share/perl/5.36.0/ExtUtils/Command.pm", "/usr/share/perl/5.36.0/ExtUtils/Command/MM.pm", "/usr/share/perl/5.36.0/ExtUtils/Constant.pm", "/usr/share/perl/5.36.0/ExtUtils/Constant/Base.pm", "/usr/share/perl/5.36.0/ExtUtils/Constant/ProxySubs.pm", "/usr/share/perl/5.36.0/ExtUtils/Constant/Utils.pm", "/usr/share/perl/5.36.0/ExtUtils/Constant/XS.pm", "/usr/share/perl/5.36.0/ExtUtils/Embed.pm", "/usr/share/perl/5.36.0/ExtUtils/Install.pm", "/usr/share/perl/5.36.0/ExtUtils/Installed.pm", "/usr/share/perl/5.36.0/ExtUtils/Liblist.pm", "/usr/share/perl/5.36.0/ExtUtils/Liblist/Kid.pm", "/usr/share/perl/5.36.0/ExtUtils/MANIFEST.SKIP", "/usr/share/perl/5.36.0/ExtUtils/MM.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_AIX.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_Any.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_BeOS.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_Cygwin.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_DOS.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_Darwin.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_MacOS.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_NW5.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_OS2.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_OS390.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_QNX.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_UWIN.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_Unix.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_VMS.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_VOS.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_Win32.pm", "/usr/share/perl/5.36.0/ExtUtils/MM_Win95.pm", "/usr/share/perl/5.36.0/ExtUtils/MY.pm", "/usr/share/perl/5.36.0/ExtUtils/MakeMaker.pm", "/usr/share/perl/5.36.0/ExtUtils/MakeMaker/Config.pm", "/usr/share/perl/5.36.0/ExtUtils/MakeMaker/FAQ.pod", "/usr/share/perl/5.36.0/ExtUtils/MakeMaker/Locale.pm", "/usr/share/perl/5.36.0/ExtUtils/MakeMaker/Tutorial.pod", "/usr/share/perl/5.36.0/ExtUtils/MakeMaker/version.pm", "/usr/share/perl/5.36.0/ExtUtils/Manifest.pm", "/usr/share/perl/5.36.0/ExtUtils/Miniperl.pm", "/usr/share/perl/5.36.0/ExtUtils/Mkbootstrap.pm", "/usr/share/perl/5.36.0/ExtUtils/Mksymlists.pm", "/usr/share/perl/5.36.0/ExtUtils/PL2Bat.pm", "/usr/share/perl/5.36.0/ExtUtils/Packlist.pm", "/usr/share/perl/5.36.0/ExtUtils/ParseXS.pm", "/usr/share/perl/5.36.0/ExtUtils/ParseXS.pod", "/usr/share/perl/5.36.0/ExtUtils/ParseXS/Constants.pm", "/usr/share/perl/5.36.0/ExtUtils/ParseXS/CountLines.pm", "/usr/share/perl/5.36.0/ExtUtils/ParseXS/Eval.pm", "/usr/share/perl/5.36.0/ExtUtils/ParseXS/Utilities.pm", "/usr/share/perl/5.36.0/ExtUtils/Typemaps.pm", "/usr/share/perl/5.36.0/ExtUtils/Typemaps/Cmd.pm", "/usr/share/perl/5.36.0/ExtUtils/Typemaps/InputMap.pm", "/usr/share/perl/5.36.0/ExtUtils/Typemaps/OutputMap.pm", "/usr/share/perl/5.36.0/ExtUtils/Typemaps/Type.pm", "/usr/share/perl/5.36.0/ExtUtils/testlib.pm", "/usr/share/perl/5.36.0/ExtUtils/typemap", "/usr/share/perl/5.36.0/ExtUtils/xsubpp", "/usr/share/perl/5.36.0/Fatal.pm", "/usr/share/perl/5.36.0/File/Basename.pm", "/usr/share/perl/5.36.0/File/Compare.pm", "/usr/share/perl/5.36.0/File/Copy.pm", "/usr/share/perl/5.36.0/File/Fetch.pm", "/usr/share/perl/5.36.0/File/Find.pm", "/usr/share/perl/5.36.0/File/GlobMapper.pm", "/usr/share/perl/5.36.0/File/Path.pm", "/usr/share/perl/5.36.0/File/Temp.pm", "/usr/share/perl/5.36.0/File/stat.pm", "/usr/share/perl/5.36.0/FileCache.pm", "/usr/share/perl/5.36.0/FileHandle.pm", "/usr/share/perl/5.36.0/Filter/Simple.pm", "/usr/share/perl/5.36.0/FindBin.pm", "/usr/share/perl/5.36.0/Getopt/Long.pm", "/usr/share/perl/5.36.0/Getopt/Std.pm", "/usr/share/perl/5.36.0/HTTP/Tiny.pm", "/usr/share/perl/5.36.0/I18N/Collate.pm", "/usr/share/perl/5.36.0/I18N/LangTags.pm", "/usr/share/perl/5.36.0/I18N/LangTags/Detect.pm", "/usr/share/perl/5.36.0/I18N/LangTags/List.pm", "/usr/share/perl/5.36.0/IO/Compress/Adapter/Bzip2.pm", "/usr/share/perl/5.36.0/IO/Compress/Adapter/Deflate.pm", "/usr/share/perl/5.36.0/IO/Compress/Adapter/Identity.pm", "/usr/share/perl/5.36.0/IO/Compress/Base.pm", "/usr/share/perl/5.36.0/IO/Compress/Base/Common.pm", "/usr/share/perl/5.36.0/IO/Compress/Bzip2.pm", "/usr/share/perl/5.36.0/IO/Compress/Deflate.pm", "/usr/share/perl/5.36.0/IO/Compress/FAQ.pod", "/usr/share/perl/5.36.0/IO/Compress/Gzip.pm", "/usr/share/perl/5.36.0/IO/Compress/Gzip/Constants.pm", "/usr/share/perl/5.36.0/IO/Compress/RawDeflate.pm", "/usr/share/perl/5.36.0/IO/Compress/Zip.pm", "/usr/share/perl/5.36.0/IO/Compress/Zip/Constants.pm", "/usr/share/perl/5.36.0/IO/Compress/Zlib/Constants.pm", "/usr/share/perl/5.36.0/IO/Compress/Zlib/Extra.pm", "/usr/share/perl/5.36.0/IO/Socket/IP.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Adapter/Bunzip2.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Adapter/Identity.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Adapter/Inflate.pm", "/usr/share/perl/5.36.0/IO/Uncompress/AnyInflate.pm", "/usr/share/perl/5.36.0/IO/Uncompress/AnyUncompress.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Base.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Bunzip2.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Gunzip.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Inflate.pm", "/usr/share/perl/5.36.0/IO/Uncompress/RawInflate.pm", "/usr/share/perl/5.36.0/IO/Uncompress/Unzip.pm", "/usr/share/perl/5.36.0/IO/Zlib.pm", "/usr/share/perl/5.36.0/IPC/Cmd.pm", "/usr/share/perl/5.36.0/IPC/Open2.pm", "/usr/share/perl/5.36.0/IPC/Open3.pm", "/usr/share/perl/5.36.0/Internals.pod", "/usr/share/perl/5.36.0/JSON/PP.pm", "/usr/share/perl/5.36.0/JSON/PP/Boolean.pm", "/usr/share/perl/5.36.0/Locale/Maketext.pm", "/usr/share/perl/5.36.0/Locale/Maketext.pod", "/usr/share/perl/5.36.0/Locale/Maketext/Cookbook.pod", "/usr/share/perl/5.36.0/Locale/Maketext/Guts.pm", "/usr/share/perl/5.36.0/Locale/Maketext/GutsLoader.pm", "/usr/share/perl/5.36.0/Locale/Maketext/Simple.pm", "/usr/share/perl/5.36.0/Locale/Maketext/TPJ13.pod", "/usr/share/perl/5.36.0/Math/BigFloat.pm", "/usr/share/perl/5.36.0/Math/BigFloat/Trace.pm", "/usr/share/perl/5.36.0/Math/BigInt.pm", "/usr/share/perl/5.36.0/Math/BigInt/Calc.pm", "/usr/share/perl/5.36.0/Math/BigInt/Lib.pm", "/usr/share/perl/5.36.0/Math/BigInt/Trace.pm", "/usr/share/perl/5.36.0/Math/BigRat.pm", "/usr/share/perl/5.36.0/Math/BigRat/Trace.pm", "/usr/share/perl/5.36.0/Math/Complex.pm", "/usr/share/perl/5.36.0/Math/Trig.pm", "/usr/share/perl/5.36.0/Memoize.pm", "/usr/share/perl/5.36.0/Memoize/AnyDBM_File.pm", "/usr/share/perl/5.36.0/Memoize/Expire.pm", "/usr/share/perl/5.36.0/Memoize/ExpireFile.pm", "/usr/share/perl/5.36.0/Memoize/ExpireTest.pm", "/usr/share/perl/5.36.0/Memoize/NDBM_File.pm", "/usr/share/perl/5.36.0/Memoize/SDBM_File.pm", "/usr/share/perl/5.36.0/Memoize/Storable.pm", "/usr/share/perl/5.36.0/Module/CoreList.pm", "/usr/share/perl/5.36.0/Module/CoreList.pod", "/usr/share/perl/5.36.0/Module/CoreList/Utils.pm", "/usr/share/perl/5.36.0/Module/Load.pm", "/usr/share/perl/5.36.0/Module/Load/Conditional.pm", "/usr/share/perl/5.36.0/Module/Loaded.pm", "/usr/share/perl/5.36.0/Module/Metadata.pm", "/usr/share/perl/5.36.0/NEXT.pm", "/usr/share/perl/5.36.0/Net/Cmd.pm", "/usr/share/perl/5.36.0/Net/Config.pm", "/usr/share/perl/5.36.0/Net/Domain.pm", "/usr/share/perl/5.36.0/Net/FTP.pm", "/usr/share/perl/5.36.0/Net/FTP/A.pm", "/usr/share/perl/5.36.0/Net/FTP/E.pm", "/usr/share/perl/5.36.0/Net/FTP/I.pm", "/usr/share/perl/5.36.0/Net/FTP/L.pm", "/usr/share/perl/5.36.0/Net/FTP/dataconn.pm", "/usr/share/perl/5.36.0/Net/NNTP.pm", "/usr/share/perl/5.36.0/Net/Netrc.pm", "/usr/share/perl/5.36.0/Net/POP3.pm", "/usr/share/perl/5.36.0/Net/Ping.pm", "/usr/share/perl/5.36.0/Net/SMTP.pm", "/usr/share/perl/5.36.0/Net/Time.pm", "/usr/share/perl/5.36.0/Net/hostent.pm", "/usr/share/perl/5.36.0/Net/libnetFAQ.pod", "/usr/share/perl/5.36.0/Net/netent.pm", "/usr/share/perl/5.36.0/Net/protoent.pm", "/usr/share/perl/5.36.0/Net/servent.pm", "/usr/share/perl/5.36.0/Params/Check.pm", "/usr/share/perl/5.36.0/Parse/CPAN/Meta.pm", "/usr/share/perl/5.36.0/Perl/OSType.pm", "/usr/share/perl/5.36.0/PerlIO.pm", "/usr/share/perl/5.36.0/PerlIO/via/QuotedPrint.pm", "/usr/share/perl/5.36.0/Pod/Checker.pm", "/usr/share/perl/5.36.0/Pod/Escapes.pm", "/usr/share/perl/5.36.0/Pod/Functions.pm", "/usr/share/perl/5.36.0/Pod/Html.pm", "/usr/share/perl/5.36.0/Pod/Html/Util.pm", "/usr/share/perl/5.36.0/Pod/Man.pm", "/usr/share/perl/5.36.0/Pod/ParseLink.pm", "/usr/share/perl/5.36.0/Pod/Perldoc.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/BaseTo.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/GetOptsOO.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToANSI.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToChecker.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToMan.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToNroff.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToPod.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToRtf.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToTerm.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToText.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToTk.pm", "/usr/share/perl/5.36.0/Pod/Perldoc/ToXml.pm", "/usr/share/perl/5.36.0/Pod/Simple.pm", "/usr/share/perl/5.36.0/Pod/Simple.pod", "/usr/share/perl/5.36.0/Pod/Simple/BlackBox.pm", "/usr/share/perl/5.36.0/Pod/Simple/Checker.pm", "/usr/share/perl/5.36.0/Pod/Simple/Debug.pm", "/usr/share/perl/5.36.0/Pod/Simple/DumpAsText.pm", "/usr/share/perl/5.36.0/Pod/Simple/DumpAsXML.pm", "/usr/share/perl/5.36.0/Pod/Simple/HTML.pm", "/usr/share/perl/5.36.0/Pod/Simple/HTMLBatch.pm", "/usr/share/perl/5.36.0/Pod/Simple/HTMLLegacy.pm", "/usr/share/perl/5.36.0/Pod/Simple/JustPod.pm", "/usr/share/perl/5.36.0/Pod/Simple/LinkSection.pm", "/usr/share/perl/5.36.0/Pod/Simple/Methody.pm", "/usr/share/perl/5.36.0/Pod/Simple/Progress.pm", "/usr/share/perl/5.36.0/Pod/Simple/PullParser.pm", "/usr/share/perl/5.36.0/Pod/Simple/PullParserEndToken.pm", "/usr/share/perl/5.36.0/Pod/Simple/PullParserStartToken.pm", "/usr/share/perl/5.36.0/Pod/Simple/PullParserTextToken.pm", "/usr/share/perl/5.36.0/Pod/Simple/PullParserToken.pm", "/usr/share/perl/5.36.0/Pod/Simple/RTF.pm", "/usr/share/perl/5.36.0/Pod/Simple/Search.pm", "/usr/share/perl/5.36.0/Pod/Simple/SimpleTree.pm", "/usr/share/perl/5.36.0/Pod/Simple/Subclassing.pod", "/usr/share/perl/5.36.0/Pod/Simple/Text.pm", "/usr/share/perl/5.36.0/Pod/Simple/TextContent.pm", "/usr/share/perl/5.36.0/Pod/Simple/TiedOutFH.pm", "/usr/share/perl/5.36.0/Pod/Simple/Transcode.pm", "/usr/share/perl/5.36.0/Pod/Simple/TranscodeDumb.pm", "/usr/share/perl/5.36.0/Pod/Simple/TranscodeSmart.pm", "/usr/share/perl/5.36.0/Pod/Simple/XHTML.pm", "/usr/share/perl/5.36.0/Pod/Simple/XMLOutStream.pm", "/usr/share/perl/5.36.0/Pod/Text.pm", "/usr/share/perl/5.36.0/Pod/Text/Color.pm", "/usr/share/perl/5.36.0/Pod/Text/Overstrike.pm", "/usr/share/perl/5.36.0/Pod/Text/Termcap.pm", "/usr/share/perl/5.36.0/Pod/Usage.pm", "/usr/share/perl/5.36.0/Safe.pm", "/usr/share/perl/5.36.0/Search/Dict.pm", "/usr/share/perl/5.36.0/SelectSaver.pm", "/usr/share/perl/5.36.0/SelfLoader.pm", "/usr/share/perl/5.36.0/Symbol.pm", "/usr/share/perl/5.36.0/TAP/Base.pm", "/usr/share/perl/5.36.0/TAP/Formatter/Base.pm", "/usr/share/perl/5.36.0/TAP/Formatter/Color.pm", "/usr/share/perl/5.36.0/TAP/Formatter/Console.pm", "/usr/share/perl/5.36.0/TAP/Formatter/Console/ParallelSession.pm", "/usr/share/perl/5.36.0/TAP/Formatter/Console/Session.pm", "/usr/share/perl/5.36.0/TAP/Formatter/File.pm", "/usr/share/perl/5.36.0/TAP/Formatter/File/Session.pm", "/usr/share/perl/5.36.0/TAP/Formatter/Session.pm", "/usr/share/perl/5.36.0/TAP/Harness.pm", "/usr/share/perl/5.36.0/TAP/Harness/Beyond.pod", "/usr/share/perl/5.36.0/TAP/Harness/Env.pm", "/usr/share/perl/5.36.0/TAP/Object.pm", "/usr/share/perl/5.36.0/TAP/Parser.pm", "/usr/share/perl/5.36.0/TAP/Parser/Aggregator.pm", "/usr/share/perl/5.36.0/TAP/Parser/Grammar.pm", "/usr/share/perl/5.36.0/TAP/Parser/Iterator.pm", "/usr/share/perl/5.36.0/TAP/Parser/Iterator/Array.pm", "/usr/share/perl/5.36.0/TAP/Parser/Iterator/Process.pm", "/usr/share/perl/5.36.0/TAP/Parser/Iterator/Stream.pm", "/usr/share/perl/5.36.0/TAP/Parser/IteratorFactory.pm", "/usr/share/perl/5.36.0/TAP/Parser/Multiplexer.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Bailout.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Comment.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Plan.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Pragma.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Test.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Unknown.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/Version.pm", "/usr/share/perl/5.36.0/TAP/Parser/Result/YAML.pm", "/usr/share/perl/5.36.0/TAP/Parser/ResultFactory.pm", "/usr/share/perl/5.36.0/TAP/Parser/Scheduler.pm", "/usr/share/perl/5.36.0/TAP/Parser/Scheduler/Job.pm", "/usr/share/perl/5.36.0/TAP/Parser/Scheduler/Spinner.pm", "/usr/share/perl/5.36.0/TAP/Parser/Source.pm", "/usr/share/perl/5.36.0/TAP/Parser/SourceHandler.pm", "/usr/share/perl/5.36.0/TAP/Parser/SourceHandler/Executable.pm", "/usr/share/perl/5.36.0/TAP/Parser/SourceHandler/File.pm", "/usr/share/perl/5.36.0/TAP/Parser/SourceHandler/Handle.pm", "/usr/share/perl/5.36.0/TAP/Parser/SourceHandler/Perl.pm", "/usr/share/perl/5.36.0/TAP/Parser/SourceHandler/RawTAP.pm", "/usr/share/perl/5.36.0/TAP/Parser/YAMLish/Reader.pm", "/usr/share/perl/5.36.0/TAP/Parser/YAMLish/Writer.pm", "/usr/share/perl/5.36.0/Term/ANSIColor.pm", "/usr/share/perl/5.36.0/Term/Cap.pm", "/usr/share/perl/5.36.0/Term/Complete.pm", "/usr/share/perl/5.36.0/Term/ReadLine.pm", "/usr/share/perl/5.36.0/Test.pm", "/usr/share/perl/5.36.0/Test/Builder.pm", "/usr/share/perl/5.36.0/Test/Builder/Formatter.pm", "/usr/share/perl/5.36.0/Test/Builder/IO/Scalar.pm", "/usr/share/perl/5.36.0/Test/Builder/Module.pm", "/usr/share/perl/5.36.0/Test/Builder/Tester.pm", "/usr/share/perl/5.36.0/Test/Builder/Tester/Color.pm", "/usr/share/perl/5.36.0/Test/Builder/TodoDiag.pm", "/usr/share/perl/5.36.0/Test/Harness.pm", "/usr/share/perl/5.36.0/Test/More.pm", "/usr/share/perl/5.36.0/Test/Simple.pm", "/usr/share/perl/5.36.0/Test/Tester.pm", "/usr/share/perl/5.36.0/Test/Tester/Capture.pm", "/usr/share/perl/5.36.0/Test/Tester/CaptureRunner.pm", "/usr/share/perl/5.36.0/Test/Tester/Delegate.pm", "/usr/share/perl/5.36.0/Test/Tutorial.pod", "/usr/share/perl/5.36.0/Test/use/ok.pm", "/usr/share/perl/5.36.0/Test2.pm", "/usr/share/perl/5.36.0/Test2/API.pm", "/usr/share/perl/5.36.0/Test2/API/Breakage.pm", "/usr/share/perl/5.36.0/Test2/API/Context.pm", "/usr/share/perl/5.36.0/Test2/API/Instance.pm", "/usr/share/perl/5.36.0/Test2/API/InterceptResult.pm", "/usr/share/perl/5.36.0/Test2/API/InterceptResult/Event.pm", "/usr/share/perl/5.36.0/Test2/API/InterceptResult/Facet.pm", "/usr/share/perl/5.36.0/Test2/API/InterceptResult/Hub.pm", "/usr/share/perl/5.36.0/Test2/API/InterceptResult/Squasher.pm", "/usr/share/perl/5.36.0/Test2/API/Stack.pm", "/usr/share/perl/5.36.0/Test2/Event.pm", "/usr/share/perl/5.36.0/Test2/Event/Bail.pm", "/usr/share/perl/5.36.0/Test2/Event/Diag.pm", "/usr/share/perl/5.36.0/Test2/Event/Encoding.pm", "/usr/share/perl/5.36.0/Test2/Event/Exception.pm", "/usr/share/perl/5.36.0/Test2/Event/Fail.pm", "/usr/share/perl/5.36.0/Test2/Event/Generic.pm", "/usr/share/perl/5.36.0/Test2/Event/Note.pm", "/usr/share/perl/5.36.0/Test2/Event/Ok.pm", "/usr/share/perl/5.36.0/Test2/Event/Pass.pm", "/usr/share/perl/5.36.0/Test2/Event/Plan.pm", "/usr/share/perl/5.36.0/Test2/Event/Skip.pm", "/usr/share/perl/5.36.0/Test2/Event/Subtest.pm", "/usr/share/perl/5.36.0/Test2/Event/TAP/Version.pm", "/usr/share/perl/5.36.0/Test2/Event/V2.pm", "/usr/share/perl/5.36.0/Test2/Event/Waiting.pm", "/usr/share/perl/5.36.0/Test2/EventFacet.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/About.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Amnesty.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Assert.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Control.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Error.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Hub.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Info.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Info/Table.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Meta.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Parent.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Plan.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Render.pm", "/usr/share/perl/5.36.0/Test2/EventFacet/Trace.pm", "/usr/share/perl/5.36.0/Test2/Formatter.pm", "/usr/share/perl/5.36.0/Test2/Formatter/TAP.pm", "/usr/share/perl/5.36.0/Test2/Hub.pm", "/usr/share/perl/5.36.0/Test2/Hub/Interceptor.pm", "/usr/share/perl/5.36.0/Test2/Hub/Interceptor/Terminator.pm", "/usr/share/perl/5.36.0/Test2/Hub/Subtest.pm", "/usr/share/perl/5.36.0/Test2/IPC.pm", "/usr/share/perl/5.36.0/Test2/IPC/Driver.pm", "/usr/share/perl/5.36.0/Test2/IPC/Driver/Files.pm", "/usr/share/perl/5.36.0/Test2/Tools/Tiny.pm", "/usr/share/perl/5.36.0/Test2/Transition.pod", "/usr/share/perl/5.36.0/Test2/Util.pm", "/usr/share/perl/5.36.0/Test2/Util/ExternalMeta.pm", "/usr/share/perl/5.36.0/Test2/Util/Facets2Legacy.pm", "/usr/share/perl/5.36.0/Test2/Util/HashBase.pm", "/usr/share/perl/5.36.0/Test2/Util/Trace.pm", "/usr/share/perl/5.36.0/Text/Abbrev.pm", "/usr/share/perl/5.36.0/Text/Balanced.pm", "/usr/share/perl/5.36.0/Text/ParseWords.pm", "/usr/share/perl/5.36.0/Text/Tabs.pm", "/usr/share/perl/5.36.0/Text/Wrap.pm", "/usr/share/perl/5.36.0/Thread.pm", "/usr/share/perl/5.36.0/Thread/Queue.pm", "/usr/share/perl/5.36.0/Thread/Semaphore.pm", "/usr/share/perl/5.36.0/Tie/Array.pm", "/usr/share/perl/5.36.0/Tie/File.pm", "/usr/share/perl/5.36.0/Tie/Handle.pm", "/usr/share/perl/5.36.0/Tie/Hash.pm", "/usr/share/perl/5.36.0/Tie/Hash/NamedCapture.pm", "/usr/share/perl/5.36.0/Tie/Memoize.pm", "/usr/share/perl/5.36.0/Tie/RefHash.pm", "/usr/share/perl/5.36.0/Tie/Scalar.pm", "/usr/share/perl/5.36.0/Tie/StdHandle.pm", "/usr/share/perl/5.36.0/Tie/SubstrHash.pm", "/usr/share/perl/5.36.0/Time/Local.pm", "/usr/share/perl/5.36.0/Time/gmtime.pm", "/usr/share/perl/5.36.0/Time/localtime.pm", "/usr/share/perl/5.36.0/Time/tm.pm", "/usr/share/perl/5.36.0/UNIVERSAL.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/Big5.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/GB2312.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/JISX0208.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/Korean.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/Pinyin.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/Stroke.pm", "/usr/share/perl/5.36.0/Unicode/Collate/CJK/Zhuyin.pm", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/af.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ar.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/as.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/az.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/be.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/bn.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ca.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/cs.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/cu.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/cy.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/da.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/de_at_ph.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/de_phone.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/dsb.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ee.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/eo.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/es.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/es_trad.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/et.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/fa.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/fi.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/fi_phone.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/fil.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/fo.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/fr_ca.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/gu.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ha.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/haw.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/he.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/hi.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/hr.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/hu.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/hy.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ig.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/is.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ja.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/kk.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/kl.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/kn.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ko.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/kok.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/lkt.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ln.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/lt.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/lv.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/mk.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ml.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/mr.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/mt.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/nb.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/nn.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/nso.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/om.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/or.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/pa.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/pl.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ro.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sa.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/se.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/si.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/si_dict.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sk.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sl.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sq.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sr.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sv.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/sv_refo.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ta.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/te.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/th.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/tn.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/to.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/tr.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ug_cyrl.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/uk.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/ur.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/vi.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/vo.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/wae.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/wo.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/yo.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/zh.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/zh_big5.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/zh_gb.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/zh_pin.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/zh_strk.pl", "/usr/share/perl/5.36.0/Unicode/Collate/Locale/zh_zhu.pl", "/usr/share/perl/5.36.0/Unicode/Collate/allkeys.txt", "/usr/share/perl/5.36.0/Unicode/Collate/keys.txt", "/usr/share/perl/5.36.0/Unicode/UCD.pm", "/usr/share/perl/5.36.0/User/grent.pm", "/usr/share/perl/5.36.0/User/pwent.pm", "/usr/share/perl/5.36.0/XSLoader.pm", "/usr/share/perl/5.36.0/_charnames.pm", "/usr/share/perl/5.36.0/autodie.pm", "/usr/share/perl/5.36.0/autodie/Scope/Guard.pm", "/usr/share/perl/5.36.0/autodie/Scope/GuardStack.pm", "/usr/share/perl/5.36.0/autodie/Util.pm", "/usr/share/perl/5.36.0/autodie/exception.pm", "/usr/share/perl/5.36.0/autodie/exception/system.pm", "/usr/share/perl/5.36.0/autodie/hints.pm", "/usr/share/perl/5.36.0/autodie/skip.pm", "/usr/share/perl/5.36.0/autouse.pm", "/usr/share/perl/5.36.0/base.pm", "/usr/share/perl/5.36.0/bigfloat.pm", "/usr/share/perl/5.36.0/bigint.pm", "/usr/share/perl/5.36.0/bignum.pm", "/usr/share/perl/5.36.0/bigrat.pm", "/usr/share/perl/5.36.0/blib.pm", "/usr/share/perl/5.36.0/builtin.pm", "/usr/share/perl/5.36.0/bytes.pm", "/usr/share/perl/5.36.0/bytes_heavy.pl", "/usr/share/perl/5.36.0/charnames.pm", "/usr/share/perl/5.36.0/constant.pm", "/usr/share/perl/5.36.0/deprecate.pm", "/usr/share/perl/5.36.0/diagnostics.pm", "/usr/share/perl/5.36.0/dumpvar.pl", "/usr/share/perl/5.36.0/encoding/warnings.pm", "/usr/share/perl/5.36.0/experimental.pm", "/usr/share/perl/5.36.0/feature.pm", "/usr/share/perl/5.36.0/fields.pm", "/usr/share/perl/5.36.0/filetest.pm", "/usr/share/perl/5.36.0/if.pm", "/usr/share/perl/5.36.0/integer.pm", "/usr/share/perl/5.36.0/less.pm", "/usr/share/perl/5.36.0/locale.pm", "/usr/share/perl/5.36.0/meta_notation.pm", "/usr/share/perl/5.36.0/ok.pm", "/usr/share/perl/5.36.0/open.pm", "/usr/share/perl/5.36.0/overload.pm", "/usr/share/perl/5.36.0/overload/numbers.pm", "/usr/share/perl/5.36.0/overloading.pm", "/usr/share/perl/5.36.0/parent.pm", "/usr/share/perl/5.36.0/perl5db.pl", "/usr/share/perl/5.36.0/perlfaq.pm", "/usr/share/perl/5.36.0/pod/perldiag.pod", "/usr/share/perl/5.36.0/sigtrap.pm", "/usr/share/perl/5.36.0/sort.pm", "/usr/share/perl/5.36.0/strict.pm", "/usr/share/perl/5.36.0/subs.pm", "/usr/share/perl/5.36.0/unicore/Blocks.txt", "/usr/share/perl/5.36.0/unicore/CombiningClass.pl", "/usr/share/perl/5.36.0/unicore/Decomposition.pl", "/usr/share/perl/5.36.0/unicore/Name.pl", "/usr/share/perl/5.36.0/unicore/Name.pm", "/usr/share/perl/5.36.0/unicore/NamedSequences.txt", "/usr/share/perl/5.36.0/unicore/SpecialCasing.txt", "/usr/share/perl/5.36.0/unicore/To/Age.pl", "/usr/share/perl/5.36.0/unicore/To/Bc.pl", "/usr/share/perl/5.36.0/unicore/To/Bmg.pl", "/usr/share/perl/5.36.0/unicore/To/Bpb.pl", "/usr/share/perl/5.36.0/unicore/To/Bpt.pl", "/usr/share/perl/5.36.0/unicore/To/Cf.pl", "/usr/share/perl/5.36.0/unicore/To/Ea.pl", "/usr/share/perl/5.36.0/unicore/To/EqUIdeo.pl", "/usr/share/perl/5.36.0/unicore/To/GCB.pl", "/usr/share/perl/5.36.0/unicore/To/Gc.pl", "/usr/share/perl/5.36.0/unicore/To/Hst.pl", "/usr/share/perl/5.36.0/unicore/To/Identif2.pl", "/usr/share/perl/5.36.0/unicore/To/Identifi.pl", "/usr/share/perl/5.36.0/unicore/To/InPC.pl", "/usr/share/perl/5.36.0/unicore/To/InSC.pl", "/usr/share/perl/5.36.0/unicore/To/Isc.pl", "/usr/share/perl/5.36.0/unicore/To/Jg.pl", "/usr/share/perl/5.36.0/unicore/To/Jt.pl", "/usr/share/perl/5.36.0/unicore/To/Lb.pl", "/usr/share/perl/5.36.0/unicore/To/Lc.pl", "/usr/share/perl/5.36.0/unicore/To/NFCQC.pl", "/usr/share/perl/5.36.0/unicore/To/NFDQC.pl", "/usr/share/perl/5.36.0/unicore/To/NFKCCF.pl", "/usr/share/perl/5.36.0/unicore/To/NFKCQC.pl", "/usr/share/perl/5.36.0/unicore/To/NFKDQC.pl", "/usr/share/perl/5.36.0/unicore/To/Na1.pl", "/usr/share/perl/5.36.0/unicore/To/NameAlia.pl", "/usr/share/perl/5.36.0/unicore/To/Nt.pl", "/usr/share/perl/5.36.0/unicore/To/Nv.pl", "/usr/share/perl/5.36.0/unicore/To/PerlDeci.pl", "/usr/share/perl/5.36.0/unicore/To/SB.pl", "/usr/share/perl/5.36.0/unicore/To/Sc.pl", "/usr/share/perl/5.36.0/unicore/To/Scx.pl", "/usr/share/perl/5.36.0/unicore/To/Tc.pl", "/usr/share/perl/5.36.0/unicore/To/Uc.pl", "/usr/share/perl/5.36.0/unicore/To/Vo.pl", "/usr/share/perl/5.36.0/unicore/To/WB.pl", "/usr/share/perl/5.36.0/unicore/To/_PerlLB.pl", "/usr/share/perl/5.36.0/unicore/To/_PerlSCX.pl", "/usr/share/perl/5.36.0/unicore/UCD.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/NA.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V100.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V11.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V110.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V120.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V130.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V140.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V20.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V30.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V31.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V32.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V40.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V41.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V50.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V51.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V52.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V60.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V61.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V70.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V80.pl", "/usr/share/perl/5.36.0/unicore/lib/Age/V90.pl", "/usr/share/perl/5.36.0/unicore/lib/Alpha/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/AL.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/AN.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/B.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/BN.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/CS.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/EN.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/ES.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/ET.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/L.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/NSM.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/ON.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/R.pl", "/usr/share/perl/5.36.0/unicore/lib/Bc/WS.pl", "/usr/share/perl/5.36.0/unicore/lib/BidiC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/BidiM/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Blk/NB.pl", "/usr/share/perl/5.36.0/unicore/lib/Bpt/C.pl", "/usr/share/perl/5.36.0/unicore/lib/Bpt/N.pl", "/usr/share/perl/5.36.0/unicore/lib/Bpt/O.pl", "/usr/share/perl/5.36.0/unicore/lib/CE/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CI/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CWCF/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CWCM/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CWKCF/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CWL/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CWT/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/CWU/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Cased/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/A.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/AL.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/AR.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/ATAR.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/B.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/BR.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/DB.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/NK.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/NR.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/OV.pl", "/usr/share/perl/5.36.0/unicore/lib/Ccc/VR.pl", "/usr/share/perl/5.36.0/unicore/lib/CompEx/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/DI/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Dash/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Dep/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Dia/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Com.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Enc.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Fin.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Font.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Init.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Iso.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Med.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Nar.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Nb.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/NonCanon.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Sqr.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Sub.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Sup.pl", "/usr/share/perl/5.36.0/unicore/lib/Dt/Vert.pl", "/usr/share/perl/5.36.0/unicore/lib/EBase/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/EComp/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/EPres/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Ea/A.pl", "/usr/share/perl/5.36.0/unicore/lib/Ea/H.pl", "/usr/share/perl/5.36.0/unicore/lib/Ea/N.pl", "/usr/share/perl/5.36.0/unicore/lib/Ea/Na.pl", "/usr/share/perl/5.36.0/unicore/lib/Ea/W.pl", "/usr/share/perl/5.36.0/unicore/lib/Emoji/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Ext/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/ExtPict/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/CN.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/EX.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/LV.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/LVT.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/PP.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/SM.pl", "/usr/share/perl/5.36.0/unicore/lib/GCB/XX.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/C.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Cf.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Cn.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/L.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/LC.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Ll.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Lm.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Lo.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Lu.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/M.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Mc.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Me.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Mn.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/N.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Nd.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Nl.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/No.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/P.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Pc.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Pd.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Pe.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Pf.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Pi.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Po.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Ps.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/S.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Sc.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Sk.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Sm.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/So.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Z.pl", "/usr/share/perl/5.36.0/unicore/lib/Gc/Zs.pl", "/usr/share/perl/5.36.0/unicore/lib/GrBase/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/GrExt/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Hex/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Hst/NA.pl", "/usr/share/perl/5.36.0/unicore/lib/Hyphen/T.pl", "/usr/share/perl/5.36.0/unicore/lib/IDC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/IDS/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/IdStatus/Allowed.pl", "/usr/share/perl/5.36.0/unicore/lib/IdStatus/Restrict.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/DefaultI.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/Exclusio.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/Inclusio.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/LimitedU.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/NotChara.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/NotNFKC.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/NotXID.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/Obsolete.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/Recommen.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/Technica.pl", "/usr/share/perl/5.36.0/unicore/lib/IdType/Uncommon.pl", "/usr/share/perl/5.36.0/unicore/lib/Ideo/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/In/10_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/11_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/12_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/12_1.pl", "/usr/share/perl/5.36.0/unicore/lib/In/13_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/14_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/2_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/2_1.pl", "/usr/share/perl/5.36.0/unicore/lib/In/3_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/3_1.pl", "/usr/share/perl/5.36.0/unicore/lib/In/3_2.pl", "/usr/share/perl/5.36.0/unicore/lib/In/4_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/4_1.pl", "/usr/share/perl/5.36.0/unicore/lib/In/5_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/5_1.pl", "/usr/share/perl/5.36.0/unicore/lib/In/5_2.pl", "/usr/share/perl/5.36.0/unicore/lib/In/6_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/6_1.pl", "/usr/share/perl/5.36.0/unicore/lib/In/6_2.pl", "/usr/share/perl/5.36.0/unicore/lib/In/6_3.pl", "/usr/share/perl/5.36.0/unicore/lib/In/7_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/8_0.pl", "/usr/share/perl/5.36.0/unicore/lib/In/9_0.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/Bottom.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/BottomAn.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/Left.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/LeftAndR.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/NA.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/Overstru.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/Right.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/Top.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/TopAndBo.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/TopAndL2.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/TopAndLe.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/TopAndRi.pl", "/usr/share/perl/5.36.0/unicore/lib/InPC/VisualOr.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Avagraha.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Bindu.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Cantilla.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona2.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona3.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona4.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona5.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona6.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona7.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consona8.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Consonan.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Invisibl.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Nukta.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Number.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Other.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/PureKill.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Syllable.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/ToneMark.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Virama.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Visarga.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/Vowel.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/VowelDep.pl", "/usr/share/perl/5.36.0/unicore/lib/InSC/VowelInd.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Ain.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Alef.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Beh.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Dal.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/FarsiYeh.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Feh.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Gaf.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Hah.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/HanifiRo.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Kaf.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Lam.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/NoJoinin.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Noon.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Qaf.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Reh.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Sad.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Seen.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Tah.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Waw.pl", "/usr/share/perl/5.36.0/unicore/lib/Jg/Yeh.pl", "/usr/share/perl/5.36.0/unicore/lib/Jt/C.pl", "/usr/share/perl/5.36.0/unicore/lib/Jt/D.pl", "/usr/share/perl/5.36.0/unicore/lib/Jt/L.pl", "/usr/share/perl/5.36.0/unicore/lib/Jt/R.pl", "/usr/share/perl/5.36.0/unicore/lib/Jt/T.pl", "/usr/share/perl/5.36.0/unicore/lib/Jt/U.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/AI.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/AL.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/BA.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/BB.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/CJ.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/CL.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/CM.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/EX.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/GL.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/ID.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/IN.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/IS.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/NS.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/NU.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/OP.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/PO.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/PR.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/QU.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/SA.pl", "/usr/share/perl/5.36.0/unicore/lib/Lb/XX.pl", "/usr/share/perl/5.36.0/unicore/lib/Lower/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Math/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/NFCQC/M.pl", "/usr/share/perl/5.36.0/unicore/lib/NFCQC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/NFDQC/N.pl", "/usr/share/perl/5.36.0/unicore/lib/NFDQC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/NFKCQC/N.pl", "/usr/share/perl/5.36.0/unicore/lib/NFKCQC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/NFKDQC/N.pl", "/usr/share/perl/5.36.0/unicore/lib/NFKDQC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Nt/Di.pl", "/usr/share/perl/5.36.0/unicore/lib/Nt/None.pl", "/usr/share/perl/5.36.0/unicore/lib/Nt/Nu.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/0.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/10.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/100.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/10000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/100000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/11.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/12.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/13.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/14.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/15.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/16.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/17.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/18.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/19.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1_16.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1_2.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1_3.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1_4.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1_6.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/1_8.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/2.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/20.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/200.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/2000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/20000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/2_3.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/3.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/30.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/300.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/3000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/30000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/3_16.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/3_4.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/4.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/40.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/400.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/4000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/40000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/5.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/50.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/500.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/5000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/50000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/6.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/60.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/600.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/6000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/60000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/7.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/70.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/700.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/7000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/70000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/8.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/80.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/800.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/8000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/80000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/9.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/90.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/900.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/9000.pl", "/usr/share/perl/5.36.0/unicore/lib/Nv/90000.pl", "/usr/share/perl/5.36.0/unicore/lib/PCM/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/PatSyn/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Alnum.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Assigned.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Blank.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Graph.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/PerlWord.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/PosixPun.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Print.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/SpacePer.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Title.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/Word.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/XPosixPu.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlAny.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlCh2.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlCha.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlFol.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlIDC.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlIDS.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlIsI.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlNch.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlPat.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlPr2.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlPro.pl", "/usr/share/perl/5.36.0/unicore/lib/Perl/_PerlQuo.pl", "/usr/share/perl/5.36.0/unicore/lib/QMark/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/AT.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/CL.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/EX.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/FO.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/LE.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/LO.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/NU.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/SC.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/ST.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/Sp.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/UP.pl", "/usr/share/perl/5.36.0/unicore/lib/SB/XX.pl", "/usr/share/perl/5.36.0/unicore/lib/SD/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/STerm/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Arab.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Beng.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Cprt.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Cyrl.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Deva.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Dupl.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Geor.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Glag.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Gong.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Gonm.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Gran.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Grek.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Gujr.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Guru.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Han.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Hang.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Hira.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Kana.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Knda.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Latn.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Limb.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Linb.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Mlym.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Mong.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Mult.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Orya.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Sinh.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Syrc.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Taml.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Telu.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Zinh.pl", "/usr/share/perl/5.36.0/unicore/lib/Sc/Zyyy.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Adlm.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Arab.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Armn.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Beng.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Bhks.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Bopo.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Cakm.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Cham.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Copt.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Cprt.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Cyrl.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Deva.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Diak.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Dupl.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Ethi.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Geor.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Glag.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Gong.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Gonm.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Gran.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Grek.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Gujr.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Guru.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Han.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Hang.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Hebr.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Hira.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Hmng.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Hmnp.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Kana.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Khar.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Khmr.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Khoj.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Knda.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Kthi.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Lana.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Lao.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Latn.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Limb.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Lina.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Linb.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Mlym.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Mong.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Mult.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Mymr.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Nand.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Nko.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Orya.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Phlp.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Rohg.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Shrd.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Sind.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Sinh.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Syrc.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Tagb.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Takr.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Talu.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Taml.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Tang.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Telu.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Thaa.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Tibt.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Tirh.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Vith.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Xsux.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Yezi.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Yi.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Zinh.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Zyyy.pl", "/usr/share/perl/5.36.0/unicore/lib/Scx/Zzzz.pl", "/usr/share/perl/5.36.0/unicore/lib/Term/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/UIdeo/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Upper/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/VS/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/Vo/R.pl", "/usr/share/perl/5.36.0/unicore/lib/Vo/Tr.pl", "/usr/share/perl/5.36.0/unicore/lib/Vo/Tu.pl", "/usr/share/perl/5.36.0/unicore/lib/Vo/U.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/EX.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/Extend.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/FO.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/HL.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/KA.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/LE.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/MB.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/ML.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/MN.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/NU.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/WSegSpac.pl", "/usr/share/perl/5.36.0/unicore/lib/WB/XX.pl", "/usr/share/perl/5.36.0/unicore/lib/XIDC/Y.pl", "/usr/share/perl/5.36.0/unicore/lib/XIDS/Y.pl", "/usr/share/perl/5.36.0/unicore/uni_keywords.pl", "/usr/share/perl/5.36.0/unicore/version", "/usr/share/perl/5.36.0/utf8.pm", "/usr/share/perl/5.36.0/vars.pm", "/usr/share/perl/5.36.0/version.pm", "/usr/share/perl/5.36.0/version.pod", "/usr/share/perl/5.36.0/version/Internals.pod", "/usr/share/perl/5.36.0/version/regex.pm", "/usr/share/perl/5.36.0/vmsish.pm", "/usr/share/perl/5.36.0/warnings.pm", "/usr/share/perl/5.36.0/warnings/register.pm" ], "AnalyzedBy": "dpkg" }, { "ID": "postgresql-client@15+248+deb12u1", "Name": "postgresql-client", "Identifier": { "PURL": "pkg:deb/debian/postgresql-client@15%2B248%2Bdeb12u1?arch=all\u0026distro=debian-12.15", "UID": "37dfbacde32d3845" }, "Version": "15+248+deb12u1", "Arch": "all", "SrcName": "postgresql-common", "SrcVersion": "248+deb12u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian PostgreSQL Maintainers \u003cteam+postgresql@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "postgresql-client-15@15.18-0+deb12u1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/postgresql-client/changelog.gz", "/usr/share/doc/postgresql-client/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "postgresql-client-15@15.18-0+deb12u1", "Name": "postgresql-client-15", "Identifier": { "PURL": "pkg:deb/debian/postgresql-client-15@15.18-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "eaabe771ab728380" }, "Version": "15.18", "Release": "0+deb12u1", "Arch": "amd64", "SrcName": "postgresql-15", "SrcVersion": "15.18", "SrcRelease": "0+deb12u1", "Licenses": [ "PostgreSQL", "Custom-regex", "TCL", "Custom-pg_dump", "BSD-3-Clause", "Custom-Unicode", "double-metaphone", "GPL-1.0-only", "Artistic-2.0", "nagaysau-ishii", "BSD-2-Clause" ], "Maintainer": "Debian PostgreSQL Maintainers \u003cteam+postgresql@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "liblz4-1@1.9.4-1", "libpq5@15.18-0+deb12u1", "libreadline8@8.2-1.3", "libssl3@3.0.20-1~deb12u2", "libzstd1@1.5.4+dfsg2-5", "postgresql-client-common@248+deb12u1", "sensible-utils@0.0.17+nmu1", "zlib1g@1:1.2.13.dfsg-1" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/lib/postgresql/15/bin/clusterdb", "/usr/lib/postgresql/15/bin/createdb", "/usr/lib/postgresql/15/bin/createuser", "/usr/lib/postgresql/15/bin/dropdb", "/usr/lib/postgresql/15/bin/dropuser", "/usr/lib/postgresql/15/bin/pg_amcheck", "/usr/lib/postgresql/15/bin/pg_basebackup", "/usr/lib/postgresql/15/bin/pg_config", "/usr/lib/postgresql/15/bin/pg_dump", "/usr/lib/postgresql/15/bin/pg_dumpall", "/usr/lib/postgresql/15/bin/pg_isready", "/usr/lib/postgresql/15/bin/pg_receivewal", "/usr/lib/postgresql/15/bin/pg_recvlogical", "/usr/lib/postgresql/15/bin/pg_restore", "/usr/lib/postgresql/15/bin/pg_verifybackup", "/usr/lib/postgresql/15/bin/psql", "/usr/lib/postgresql/15/bin/reindexdb", "/usr/lib/postgresql/15/bin/vacuumdb", "/usr/lib/postgresql/15/lib/pgxs/config/install-sh", "/usr/lib/postgresql/15/lib/pgxs/config/missing", "/usr/lib/postgresql/15/lib/pgxs/src/Makefile.global", "/usr/lib/postgresql/15/lib/pgxs/src/Makefile.port", "/usr/lib/postgresql/15/lib/pgxs/src/Makefile.shlib", "/usr/lib/postgresql/15/lib/pgxs/src/makefiles/pgxs.mk", "/usr/lib/postgresql/15/lib/pgxs/src/nls-global.mk", "/usr/lib/postgresql/15/lib/pgxs/src/test/isolation/isolationtester", "/usr/lib/postgresql/15/lib/pgxs/src/test/isolation/pg_isolation_regress", "/usr/lib/postgresql/15/lib/pgxs/src/test/perl/PostgreSQL/Test/BackgroundPsql.pm", "/usr/lib/postgresql/15/lib/pgxs/src/test/perl/PostgreSQL/Test/Cluster.pm", "/usr/lib/postgresql/15/lib/pgxs/src/test/perl/PostgreSQL/Test/RecursiveCopy.pm", "/usr/lib/postgresql/15/lib/pgxs/src/test/perl/PostgreSQL/Test/SimpleTee.pm", "/usr/lib/postgresql/15/lib/pgxs/src/test/perl/PostgreSQL/Test/Utils.pm", "/usr/lib/postgresql/15/lib/pgxs/src/test/perl/PostgreSQL/Version.pm", "/usr/lib/postgresql/15/lib/pgxs/src/test/regress/pg_regress", "/usr/share/doc/postgresql-client-15/changelog.Debian.gz", "/usr/share/doc/postgresql-client-15/changelog.gz", "/usr/share/doc/postgresql-client-15/copyright", "/usr/share/lintian/overrides/postgresql-client-15", "/usr/share/locale/cs/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/cs/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/cs/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/cs/LC_MESSAGES/psql-15.mo", "/usr/share/locale/de/LC_MESSAGES/pg_amcheck-15.mo", "/usr/share/locale/de/LC_MESSAGES/pg_basebackup-15.mo", "/usr/share/locale/de/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/de/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/de/LC_MESSAGES/pg_verifybackup-15.mo", "/usr/share/locale/de/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/de/LC_MESSAGES/psql-15.mo", "/usr/share/locale/el/LC_MESSAGES/pg_amcheck-15.mo", "/usr/share/locale/el/LC_MESSAGES/pg_basebackup-15.mo", "/usr/share/locale/el/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/el/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/el/LC_MESSAGES/pg_verifybackup-15.mo", "/usr/share/locale/el/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/el/LC_MESSAGES/psql-15.mo", "/usr/share/locale/es/LC_MESSAGES/pg_amcheck-15.mo", "/usr/share/locale/es/LC_MESSAGES/pg_basebackup-15.mo", "/usr/share/locale/es/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/es/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/es/LC_MESSAGES/pg_verifybackup-15.mo", "/usr/share/locale/es/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/es/LC_MESSAGES/psql-15.mo", "/usr/share/locale/fr/LC_MESSAGES/pg_amcheck-15.mo", "/usr/share/locale/fr/LC_MESSAGES/pg_basebackup-15.mo", "/usr/share/locale/fr/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/fr/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/fr/LC_MESSAGES/pg_verifybackup-15.mo", "/usr/share/locale/fr/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/fr/LC_MESSAGES/psql-15.mo", "/usr/share/locale/he/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/it/LC_MESSAGES/pg_amcheck-15.mo", "/usr/share/locale/it/LC_MESSAGES/pg_basebackup-15.mo", "/usr/share/locale/it/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/it/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/it/LC_MESSAGES/pg_verifybackup-15.mo", "/usr/share/locale/it/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/it/LC_MESSAGES/psql-15.mo", "/usr/share/locale/ja/LC_MESSAGES/pg_amcheck-15.mo", "/usr/share/locale/ja/LC_MESSAGES/pg_basebackup-15.mo", "/usr/share/locale/ja/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/ja/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/ja/LC_MESSAGES/pg_verifybackup-15.mo", "/usr/share/locale/ja/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/ja/LC_MESSAGES/psql-15.mo", "/usr/share/locale/ka/LC_MESSAGES/pg_amcheck-15.mo", "/usr/share/locale/ka/LC_MESSAGES/pg_basebackup-15.mo", "/usr/share/locale/ka/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/ka/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/ka/LC_MESSAGES/pg_verifybackup-15.mo", "/usr/share/locale/ka/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/ka/LC_MESSAGES/psql-15.mo", "/usr/share/locale/ko/LC_MESSAGES/pg_amcheck-15.mo", "/usr/share/locale/ko/LC_MESSAGES/pg_basebackup-15.mo", "/usr/share/locale/ko/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/ko/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/ko/LC_MESSAGES/pg_verifybackup-15.mo", "/usr/share/locale/ko/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/ko/LC_MESSAGES/psql-15.mo", "/usr/share/locale/pl/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/ru/LC_MESSAGES/pg_amcheck-15.mo", "/usr/share/locale/ru/LC_MESSAGES/pg_basebackup-15.mo", "/usr/share/locale/ru/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/ru/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/ru/LC_MESSAGES/pg_verifybackup-15.mo", "/usr/share/locale/ru/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/ru/LC_MESSAGES/psql-15.mo", "/usr/share/locale/sv/LC_MESSAGES/pg_amcheck-15.mo", "/usr/share/locale/sv/LC_MESSAGES/pg_basebackup-15.mo", "/usr/share/locale/sv/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/sv/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/sv/LC_MESSAGES/pg_verifybackup-15.mo", "/usr/share/locale/sv/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/sv/LC_MESSAGES/psql-15.mo", "/usr/share/locale/tr/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/tr/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/tr/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/uk/LC_MESSAGES/pg_amcheck-15.mo", "/usr/share/locale/uk/LC_MESSAGES/pg_basebackup-15.mo", "/usr/share/locale/uk/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/uk/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/uk/LC_MESSAGES/pg_verifybackup-15.mo", "/usr/share/locale/uk/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/uk/LC_MESSAGES/psql-15.mo", "/usr/share/locale/vi/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/pg_amcheck-15.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/pg_config-15.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/pg_dump-15.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/pg_verifybackup-15.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/pgscripts-15.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/psql-15.mo", "/usr/share/postgresql/15/man/man1/clusterdb.1.gz", "/usr/share/postgresql/15/man/man1/createdb.1.gz", "/usr/share/postgresql/15/man/man1/createuser.1.gz", "/usr/share/postgresql/15/man/man1/dropdb.1.gz", "/usr/share/postgresql/15/man/man1/dropuser.1.gz", "/usr/share/postgresql/15/man/man1/pg_amcheck.1.gz", "/usr/share/postgresql/15/man/man1/pg_basebackup.1.gz", "/usr/share/postgresql/15/man/man1/pg_dump.1.gz", "/usr/share/postgresql/15/man/man1/pg_dumpall.1.gz", "/usr/share/postgresql/15/man/man1/pg_isready.1.gz", "/usr/share/postgresql/15/man/man1/pg_receivewal.1.gz", "/usr/share/postgresql/15/man/man1/pg_recvlogical.1.gz", "/usr/share/postgresql/15/man/man1/pg_restore.1.gz", "/usr/share/postgresql/15/man/man1/pg_verifybackup.1.gz", "/usr/share/postgresql/15/man/man1/psql.1.gz", "/usr/share/postgresql/15/man/man1/reindexdb.1.gz", "/usr/share/postgresql/15/man/man1/vacuumdb.1.gz", "/usr/share/postgresql/15/man/man7/ABORT.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_AGGREGATE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_COLLATION.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_CONVERSION.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_DATABASE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_DEFAULT_PRIVILEGES.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_DOMAIN.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_EVENT_TRIGGER.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_EXTENSION.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_FOREIGN_DATA_WRAPPER.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_FOREIGN_TABLE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_FUNCTION.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_GROUP.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_INDEX.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_LANGUAGE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_LARGE_OBJECT.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_MATERIALIZED_VIEW.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_OPERATOR.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_OPERATOR_CLASS.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_OPERATOR_FAMILY.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_POLICY.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_PROCEDURE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_PUBLICATION.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_ROLE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_ROUTINE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_RULE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_SCHEMA.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_SEQUENCE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_SERVER.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_STATISTICS.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_SUBSCRIPTION.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_SYSTEM.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_TABLE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_TABLESPACE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_TEXT_SEARCH_CONFIGURATION.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_TEXT_SEARCH_DICTIONARY.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_TEXT_SEARCH_PARSER.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_TEXT_SEARCH_TEMPLATE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_TRIGGER.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_TYPE.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_USER.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_USER_MAPPING.7.gz", "/usr/share/postgresql/15/man/man7/ALTER_VIEW.7.gz", "/usr/share/postgresql/15/man/man7/ANALYZE.7.gz", "/usr/share/postgresql/15/man/man7/BEGIN.7.gz", "/usr/share/postgresql/15/man/man7/CALL.7.gz", "/usr/share/postgresql/15/man/man7/CHECKPOINT.7.gz", "/usr/share/postgresql/15/man/man7/CLOSE.7.gz", "/usr/share/postgresql/15/man/man7/CLUSTER.7.gz", "/usr/share/postgresql/15/man/man7/COMMENT.7.gz", "/usr/share/postgresql/15/man/man7/COMMIT.7.gz", "/usr/share/postgresql/15/man/man7/COMMIT_PREPARED.7.gz", "/usr/share/postgresql/15/man/man7/COPY.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_ACCESS_METHOD.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_AGGREGATE.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_CAST.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_COLLATION.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_CONVERSION.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_DATABASE.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_DOMAIN.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_EVENT_TRIGGER.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_EXTENSION.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_FOREIGN_DATA_WRAPPER.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_FOREIGN_TABLE.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_FUNCTION.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_GROUP.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_INDEX.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_LANGUAGE.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_MATERIALIZED_VIEW.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_OPERATOR.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_OPERATOR_CLASS.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_OPERATOR_FAMILY.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_POLICY.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_PROCEDURE.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_PUBLICATION.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_ROLE.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_RULE.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_SCHEMA.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_SEQUENCE.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_SERVER.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_STATISTICS.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_SUBSCRIPTION.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_TABLE.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_TABLESPACE.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_TABLE_AS.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_TEXT_SEARCH_CONFIGURATION.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_TEXT_SEARCH_DICTIONARY.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_TEXT_SEARCH_PARSER.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_TEXT_SEARCH_TEMPLATE.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_TRANSFORM.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_TRIGGER.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_TYPE.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_USER.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_USER_MAPPING.7.gz", "/usr/share/postgresql/15/man/man7/CREATE_VIEW.7.gz", "/usr/share/postgresql/15/man/man7/DEALLOCATE.7.gz", "/usr/share/postgresql/15/man/man7/DECLARE.7.gz", "/usr/share/postgresql/15/man/man7/DELETE.7.gz", "/usr/share/postgresql/15/man/man7/DISCARD.7.gz", "/usr/share/postgresql/15/man/man7/DO.7.gz", "/usr/share/postgresql/15/man/man7/DROP_ACCESS_METHOD.7.gz", "/usr/share/postgresql/15/man/man7/DROP_AGGREGATE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_CAST.7.gz", "/usr/share/postgresql/15/man/man7/DROP_COLLATION.7.gz", "/usr/share/postgresql/15/man/man7/DROP_CONVERSION.7.gz", "/usr/share/postgresql/15/man/man7/DROP_DATABASE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_DOMAIN.7.gz", "/usr/share/postgresql/15/man/man7/DROP_EVENT_TRIGGER.7.gz", "/usr/share/postgresql/15/man/man7/DROP_EXTENSION.7.gz", "/usr/share/postgresql/15/man/man7/DROP_FOREIGN_DATA_WRAPPER.7.gz", "/usr/share/postgresql/15/man/man7/DROP_FOREIGN_TABLE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_FUNCTION.7.gz", "/usr/share/postgresql/15/man/man7/DROP_GROUP.7.gz", "/usr/share/postgresql/15/man/man7/DROP_INDEX.7.gz", "/usr/share/postgresql/15/man/man7/DROP_LANGUAGE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_MATERIALIZED_VIEW.7.gz", "/usr/share/postgresql/15/man/man7/DROP_OPERATOR.7.gz", "/usr/share/postgresql/15/man/man7/DROP_OPERATOR_CLASS.7.gz", "/usr/share/postgresql/15/man/man7/DROP_OPERATOR_FAMILY.7.gz", "/usr/share/postgresql/15/man/man7/DROP_OWNED.7.gz", "/usr/share/postgresql/15/man/man7/DROP_POLICY.7.gz", "/usr/share/postgresql/15/man/man7/DROP_PROCEDURE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_PUBLICATION.7.gz", "/usr/share/postgresql/15/man/man7/DROP_ROLE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_ROUTINE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_RULE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_SCHEMA.7.gz", "/usr/share/postgresql/15/man/man7/DROP_SEQUENCE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_SERVER.7.gz", "/usr/share/postgresql/15/man/man7/DROP_STATISTICS.7.gz", "/usr/share/postgresql/15/man/man7/DROP_SUBSCRIPTION.7.gz", "/usr/share/postgresql/15/man/man7/DROP_TABLE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_TABLESPACE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_TEXT_SEARCH_CONFIGURATION.7.gz", "/usr/share/postgresql/15/man/man7/DROP_TEXT_SEARCH_DICTIONARY.7.gz", "/usr/share/postgresql/15/man/man7/DROP_TEXT_SEARCH_PARSER.7.gz", "/usr/share/postgresql/15/man/man7/DROP_TEXT_SEARCH_TEMPLATE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_TRANSFORM.7.gz", "/usr/share/postgresql/15/man/man7/DROP_TRIGGER.7.gz", "/usr/share/postgresql/15/man/man7/DROP_TYPE.7.gz", "/usr/share/postgresql/15/man/man7/DROP_USER.7.gz", "/usr/share/postgresql/15/man/man7/DROP_USER_MAPPING.7.gz", "/usr/share/postgresql/15/man/man7/DROP_VIEW.7.gz", "/usr/share/postgresql/15/man/man7/END.7.gz", "/usr/share/postgresql/15/man/man7/EXECUTE.7.gz", "/usr/share/postgresql/15/man/man7/EXPLAIN.7.gz", "/usr/share/postgresql/15/man/man7/FETCH.7.gz", "/usr/share/postgresql/15/man/man7/GRANT.7.gz", "/usr/share/postgresql/15/man/man7/IMPORT_FOREIGN_SCHEMA.7.gz", "/usr/share/postgresql/15/man/man7/INSERT.7.gz", "/usr/share/postgresql/15/man/man7/LISTEN.7.gz", "/usr/share/postgresql/15/man/man7/LOAD.7.gz", "/usr/share/postgresql/15/man/man7/LOCK.7.gz", "/usr/share/postgresql/15/man/man7/MERGE.7.gz", "/usr/share/postgresql/15/man/man7/MOVE.7.gz", "/usr/share/postgresql/15/man/man7/NOTIFY.7.gz", "/usr/share/postgresql/15/man/man7/PREPARE.7.gz", "/usr/share/postgresql/15/man/man7/PREPARE_TRANSACTION.7.gz", "/usr/share/postgresql/15/man/man7/REASSIGN_OWNED.7.gz", "/usr/share/postgresql/15/man/man7/REFRESH_MATERIALIZED_VIEW.7.gz", "/usr/share/postgresql/15/man/man7/REINDEX.7.gz", "/usr/share/postgresql/15/man/man7/RELEASE_SAVEPOINT.7.gz", "/usr/share/postgresql/15/man/man7/RESET.7.gz", "/usr/share/postgresql/15/man/man7/REVOKE.7.gz", "/usr/share/postgresql/15/man/man7/ROLLBACK.7.gz", "/usr/share/postgresql/15/man/man7/ROLLBACK_PREPARED.7.gz", "/usr/share/postgresql/15/man/man7/ROLLBACK_TO_SAVEPOINT.7.gz", "/usr/share/postgresql/15/man/man7/SAVEPOINT.7.gz", "/usr/share/postgresql/15/man/man7/SECURITY_LABEL.7.gz", "/usr/share/postgresql/15/man/man7/SELECT.7.gz", "/usr/share/postgresql/15/man/man7/SELECT_INTO.7.gz", "/usr/share/postgresql/15/man/man7/SET.7.gz", "/usr/share/postgresql/15/man/man7/SET_CONSTRAINTS.7.gz", "/usr/share/postgresql/15/man/man7/SET_ROLE.7.gz", "/usr/share/postgresql/15/man/man7/SET_SESSION_AUTHORIZATION.7.gz", "/usr/share/postgresql/15/man/man7/SET_TRANSACTION.7.gz", "/usr/share/postgresql/15/man/man7/SHOW.7.gz", "/usr/share/postgresql/15/man/man7/START_TRANSACTION.7.gz", "/usr/share/postgresql/15/man/man7/TABLE.7.gz", "/usr/share/postgresql/15/man/man7/TRUNCATE.7.gz", "/usr/share/postgresql/15/man/man7/UNLISTEN.7.gz", "/usr/share/postgresql/15/man/man7/UPDATE.7.gz", "/usr/share/postgresql/15/man/man7/VACUUM.7.gz", "/usr/share/postgresql/15/man/man7/VALUES.7.gz", "/usr/share/postgresql/15/man/man7/WITH.7.gz", "/usr/share/postgresql/15/psqlrc.sample" ], "AnalyzedBy": "dpkg" }, { "ID": "postgresql-client-common@248+deb12u1", "Name": "postgresql-client-common", "Identifier": { "PURL": "pkg:deb/debian/postgresql-client-common@248%2Bdeb12u1?arch=all\u0026distro=debian-12.15", "UID": "eefb2ae5c32cabcc" }, "Version": "248+deb12u1", "Arch": "all", "SrcName": "postgresql-common", "SrcVersion": "248+deb12u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Debian PostgreSQL Maintainers \u003cteam+postgresql@tracker.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "netbase@6.4" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/postgresql-client-common/changelog.gz", "/usr/share/doc/postgresql-client-common/copyright", "/usr/share/lintian/overrides/postgresql-client-common", "/usr/share/man/man1/pg_wrapper.1.gz", "/usr/share/man/man5/postgresqlrc.5.gz", "/usr/share/man/man5/user_clusters.5.gz", "/usr/share/perl5/PgCommon.pm", "/usr/share/postgresql-common/maintscripts-functions", "/usr/share/postgresql-common/pg_wrapper", "/usr/share/postgresql-common/supported-versions" ], "AnalyzedBy": "dpkg" }, { "ID": "readline-common@8.2-1.3", "Name": "readline-common", "Identifier": { "PURL": "pkg:deb/debian/readline-common@8.2-1.3?arch=all\u0026distro=debian-12.15", "UID": "2d485297f60269dc" }, "Version": "8.2", "Release": "1.3", "Arch": "all", "SrcName": "readline", "SrcVersion": "8.2", "SrcRelease": "1.3", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-or-later", "ISC-no-attribution" ], "Maintainer": "Matthias Klose \u003cdoko@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "dpkg@1.21.23" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/readline-common/changelog.Debian.gz", "/usr/share/doc/readline-common/changelog.gz", "/usr/share/doc/readline-common/copyright", "/usr/share/doc/readline-common/inputrc.arrows", "/usr/share/info/rluserman.info.gz", "/usr/share/lintian/overrides/readline-common", "/usr/share/man/man3/history.3readline.gz", "/usr/share/man/man3/readline.3readline.gz", "/usr/share/readline/inputrc" ], "AnalyzedBy": "dpkg" }, { "ID": "sed@4.9-1+deb12u1", "Name": "sed", "Identifier": { "PURL": "pkg:deb/debian/sed@4.9-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "8308743a0f93fa9f" }, "Version": "4.9", "Release": "1+deb12u1", "Arch": "amd64", "SrcName": "sed", "SrcVersion": "4.9", "SrcRelease": "1+deb12u1", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "X11", "GFDL-1.3-no-invariants-or-later", "GFDL-1.3-only", "ISC", "BSD-4-Clause-UC", "BSL-1", "pcre" ], "Maintainer": "Clint Adams \u003cclint@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/bin/sed", "/usr/share/doc/sed/AUTHORS", "/usr/share/doc/sed/BUGS.gz", "/usr/share/doc/sed/NEWS.gz", "/usr/share/doc/sed/README", "/usr/share/doc/sed/THANKS.gz", "/usr/share/doc/sed/changelog.Debian.gz", "/usr/share/doc/sed/changelog.gz", "/usr/share/doc/sed/copyright", "/usr/share/doc/sed/examples/dc.sed", "/usr/share/doc/sed/sedfaq.txt.gz", "/usr/share/info/sed.info.gz", "/usr/share/locale/af/LC_MESSAGES/sed.mo", "/usr/share/locale/ast/LC_MESSAGES/sed.mo", "/usr/share/locale/bg/LC_MESSAGES/sed.mo", "/usr/share/locale/ca/LC_MESSAGES/sed.mo", "/usr/share/locale/cs/LC_MESSAGES/sed.mo", "/usr/share/locale/da/LC_MESSAGES/sed.mo", "/usr/share/locale/de/LC_MESSAGES/sed.mo", "/usr/share/locale/el/LC_MESSAGES/sed.mo", "/usr/share/locale/eo/LC_MESSAGES/sed.mo", "/usr/share/locale/es/LC_MESSAGES/sed.mo", "/usr/share/locale/et/LC_MESSAGES/sed.mo", "/usr/share/locale/eu/LC_MESSAGES/sed.mo", "/usr/share/locale/fi/LC_MESSAGES/sed.mo", "/usr/share/locale/fr/LC_MESSAGES/sed.mo", "/usr/share/locale/ga/LC_MESSAGES/sed.mo", "/usr/share/locale/gl/LC_MESSAGES/sed.mo", "/usr/share/locale/he/LC_MESSAGES/sed.mo", "/usr/share/locale/hr/LC_MESSAGES/sed.mo", "/usr/share/locale/hu/LC_MESSAGES/sed.mo", "/usr/share/locale/id/LC_MESSAGES/sed.mo", "/usr/share/locale/it/LC_MESSAGES/sed.mo", "/usr/share/locale/ja/LC_MESSAGES/sed.mo", "/usr/share/locale/ka/LC_MESSAGES/sed.mo", "/usr/share/locale/ko/LC_MESSAGES/sed.mo", "/usr/share/locale/nb/LC_MESSAGES/sed.mo", "/usr/share/locale/nl/LC_MESSAGES/sed.mo", "/usr/share/locale/pl/LC_MESSAGES/sed.mo", "/usr/share/locale/pt/LC_MESSAGES/sed.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/sed.mo", "/usr/share/locale/ro/LC_MESSAGES/sed.mo", "/usr/share/locale/ru/LC_MESSAGES/sed.mo", "/usr/share/locale/sk/LC_MESSAGES/sed.mo", "/usr/share/locale/sl/LC_MESSAGES/sed.mo", "/usr/share/locale/sr/LC_MESSAGES/sed.mo", "/usr/share/locale/sv/LC_MESSAGES/sed.mo", "/usr/share/locale/tr/LC_MESSAGES/sed.mo", "/usr/share/locale/uk/LC_MESSAGES/sed.mo", "/usr/share/locale/vi/LC_MESSAGES/sed.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/sed.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/sed.mo", "/usr/share/man/man1/sed.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "sensible-utils@0.0.17+nmu1", "Name": "sensible-utils", "Identifier": { "PURL": "pkg:deb/debian/sensible-utils@0.0.17%2Bnmu1?arch=all\u0026distro=debian-12.15", "UID": "1ae4f77e261d4f68" }, "Version": "0.0.17+nmu1", "Arch": "all", "SrcName": "sensible-utils", "SrcVersion": "0.0.17+nmu1", "Licenses": [ "GPL-2.0-or-later", "All-permissive", "configure", "installsh", "GPL-2.0-only" ], "Maintainer": "Anibal Monsalve Salazar \u003canibal@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/bin/select-editor", "/usr/bin/sensible-browser", "/usr/bin/sensible-editor", "/usr/bin/sensible-pager", "/usr/lib/mime/packages/sensible-utils", "/usr/share/doc/sensible-utils/changelog.gz", "/usr/share/doc/sensible-utils/copyright", "/usr/share/man/de/man1/select-editor.1.gz", "/usr/share/man/de/man1/sensible-browser.1.gz", "/usr/share/man/de/man1/sensible-editor.1.gz", "/usr/share/man/de/man1/sensible-pager.1.gz", "/usr/share/man/fr/man1/select-editor.1.gz", "/usr/share/man/fr/man1/sensible-browser.1.gz", "/usr/share/man/fr/man1/sensible-editor.1.gz", "/usr/share/man/fr/man1/sensible-pager.1.gz", "/usr/share/man/man1/select-editor.1.gz", "/usr/share/man/man1/sensible-browser.1.gz", "/usr/share/man/man1/sensible-editor.1.gz", "/usr/share/man/man1/sensible-pager.1.gz", "/usr/share/man/pt/man1/select-editor.1.gz", "/usr/share/man/pt/man1/sensible-browser.1.gz", "/usr/share/man/pt/man1/sensible-editor.1.gz", "/usr/share/man/pt/man1/sensible-pager.1.gz", "/usr/share/sensible-utils/bin/gettext" ], "AnalyzedBy": "dpkg" }, { "ID": "shared-mime-info@2.2-1", "Name": "shared-mime-info", "Identifier": { "PURL": "pkg:deb/debian/shared-mime-info@2.2-1?arch=amd64\u0026distro=debian-12.15", "UID": "ef5141a1788c8076" }, "Version": "2.2", "Release": "1", "Arch": "amd64", "SrcName": "shared-mime-info", "SrcVersion": "2.2", "SrcRelease": "1", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian freedesktop.org maintainers \u003cpkg-freedesktop-maintainers@lists.alioth.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libglib2.0-0@2.74.6-2+deb12u9", "libxml2@2.9.14+dfsg-1.3~deb12u6" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/bin/update-mime-database", "/usr/share/doc-base/shared-mime-info.shared-mime-info", "/usr/share/doc/shared-mime-info/NEWS.gz", "/usr/share/doc/shared-mime-info/README.md", "/usr/share/doc/shared-mime-info/changelog.Debian.gz", "/usr/share/doc/shared-mime-info/copyright", "/usr/share/doc/shared-mime-info/shared-mime-info-spec.html/b518.html", "/usr/share/doc/shared-mime-info/shared-mime-info-spec.html/index.html", "/usr/share/doc/shared-mime-info/shared-mime-info-spec.html/x34.html", "/usr/share/doc/shared-mime-info/shared-mime-info-spec.html/x497.html", "/usr/share/doc/shared-mime-info/shared-mime-info-spec.pdf", "/usr/share/doc/shared-mime-info/shared-mime-info-spec.xml.gz", "/usr/share/gettext/its/shared-mime-info.its", "/usr/share/gettext/its/shared-mime-info.loc", "/usr/share/locale/af/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ar/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/as/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ast/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/az/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/be/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/be@latin/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/bg/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/bn_IN/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ca/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ca@valencia/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/cs/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/cy/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/da/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/de/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/el/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/en_GB/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/eo/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/es/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/et/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/eu/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/fa/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/fi/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/fo/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/fr/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/fur/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ga/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/gl/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/gu/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/he/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/hi/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/hr/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/hu/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ia/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/id/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/it/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ja/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ka/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/kk/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/kn/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ko/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ky/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/lt/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/lv/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ml/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/mr/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ms/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/nb/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/nl/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/nn/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/oc/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/or/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/pa/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/pl/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/pt/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ro/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ru/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/rw/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/sk/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/sl/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/sq/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/sr/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/sr@latin/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/sv/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/ta/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/te/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/th/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/tr/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/uk/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/vi/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/wa/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/zh_HK/LC_MESSAGES/shared-mime-info.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/shared-mime-info.mo", "/usr/share/man/man1/update-mime-database.1.gz", "/usr/share/mime/packages/freedesktop.org.xml", "/usr/share/pkgconfig/shared-mime-info.pc" ], "AnalyzedBy": "dpkg" }, { "ID": "sysvinit-utils@3.06-4", "Name": "sysvinit-utils", "Identifier": { "PURL": "pkg:deb/debian/sysvinit-utils@3.06-4?arch=amd64\u0026distro=debian-12.15", "UID": "490ed47f91a0290b" }, "Version": "3.06", "Release": "4", "Arch": "amd64", "SrcName": "sysvinit", "SrcVersion": "3.06", "SrcRelease": "4", "Licenses": [ "GPL-2.0-or-later", "GPL-3.0-only", "GPL-2.0-only" ], "Maintainer": "Debian sysvinit maintainers \u003cdebian-init-diversity@chiark.greenend.org.uk\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/init/init-d-script", "/lib/init/vars.sh", "/lib/lsb/init-functions", "/lib/lsb/init-functions.d/00-verbose", "/sbin/fstab-decode", "/sbin/killall5", "/usr/share/doc/sysvinit-utils/changelog.Debian.gz", "/usr/share/doc/sysvinit-utils/copyright", "/usr/share/man/man5/init-d-script.5.gz", "/usr/share/man/man8/fstab-decode.8.gz", "/usr/share/man/man8/killall5.8.gz", "/usr/share/man/man8/pidof.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "tar@1.34+dfsg-1.2+deb12u1", "Name": "tar", "Identifier": { "PURL": "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "1d42a4168a18e3b2" }, "Version": "1.34+dfsg", "Release": "1.2+deb12u1", "Arch": "amd64", "SrcName": "tar", "SrcVersion": "1.34+dfsg", "SrcRelease": "1.2+deb12u1", "Licenses": [ "GPL-3.0-or-later", "GPL-3.0-only", "GPL-3+ with Bison exception", "LGPL-3.0-or-later", "LGPL-3.0-only", "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Janos Lenart \u003cocsi@debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/bin/tar", "/usr/lib/mime/packages/tar", "/usr/sbin/rmt-tar", "/usr/sbin/tarcat", "/usr/share/doc/tar/AUTHORS", "/usr/share/doc/tar/NEWS.gz", "/usr/share/doc/tar/README.Debian", "/usr/share/doc/tar/THANKS.gz", "/usr/share/doc/tar/changelog.1.gz", "/usr/share/doc/tar/changelog.Debian.gz", "/usr/share/doc/tar/changelog.gz", "/usr/share/doc/tar/copyright", "/usr/share/locale/bg/LC_MESSAGES/tar.mo", "/usr/share/locale/ca/LC_MESSAGES/tar.mo", "/usr/share/locale/cs/LC_MESSAGES/tar.mo", "/usr/share/locale/da/LC_MESSAGES/tar.mo", "/usr/share/locale/de/LC_MESSAGES/tar.mo", "/usr/share/locale/el/LC_MESSAGES/tar.mo", "/usr/share/locale/eo/LC_MESSAGES/tar.mo", "/usr/share/locale/es/LC_MESSAGES/tar.mo", "/usr/share/locale/et/LC_MESSAGES/tar.mo", "/usr/share/locale/eu/LC_MESSAGES/tar.mo", "/usr/share/locale/fi/LC_MESSAGES/tar.mo", "/usr/share/locale/fr/LC_MESSAGES/tar.mo", "/usr/share/locale/ga/LC_MESSAGES/tar.mo", "/usr/share/locale/gl/LC_MESSAGES/tar.mo", "/usr/share/locale/hr/LC_MESSAGES/tar.mo", "/usr/share/locale/hu/LC_MESSAGES/tar.mo", "/usr/share/locale/id/LC_MESSAGES/tar.mo", "/usr/share/locale/it/LC_MESSAGES/tar.mo", "/usr/share/locale/ja/LC_MESSAGES/tar.mo", "/usr/share/locale/ko/LC_MESSAGES/tar.mo", "/usr/share/locale/ky/LC_MESSAGES/tar.mo", "/usr/share/locale/ms/LC_MESSAGES/tar.mo", "/usr/share/locale/nb/LC_MESSAGES/tar.mo", "/usr/share/locale/nl/LC_MESSAGES/tar.mo", "/usr/share/locale/pl/LC_MESSAGES/tar.mo", "/usr/share/locale/pt/LC_MESSAGES/tar.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/tar.mo", "/usr/share/locale/ro/LC_MESSAGES/tar.mo", "/usr/share/locale/ru/LC_MESSAGES/tar.mo", "/usr/share/locale/sk/LC_MESSAGES/tar.mo", "/usr/share/locale/sl/LC_MESSAGES/tar.mo", "/usr/share/locale/sr/LC_MESSAGES/tar.mo", "/usr/share/locale/sv/LC_MESSAGES/tar.mo", "/usr/share/locale/tr/LC_MESSAGES/tar.mo", "/usr/share/locale/uk/LC_MESSAGES/tar.mo", "/usr/share/locale/vi/LC_MESSAGES/tar.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/tar.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/tar.mo", "/usr/share/man/man1/tar.1.gz", "/usr/share/man/man1/tarcat.1.gz", "/usr/share/man/man8/rmt-tar.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "tini@0.19.0-1+b3", "Name": "tini", "Identifier": { "PURL": "pkg:deb/debian/tini@0.19.0-1%2Bb3?arch=amd64\u0026distro=debian-12.15", "UID": "e5d6cbf696e58c59" }, "Version": "0.19.0", "Release": "1+b3", "Arch": "amd64", "SrcName": "tini", "SrcVersion": "0.19.0", "SrcRelease": "1", "Licenses": [ "MIT" ], "Maintainer": "ChangZhuo Chen (陳昌倬) \u003cczchen@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/bin/tini", "/usr/bin/tini-static", "/usr/share/doc/tini/changelog.Debian.amd64.gz", "/usr/share/doc/tini/changelog.Debian.gz", "/usr/share/doc/tini/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "tzdata@2026b-0+deb12u1", "Name": "tzdata", "Identifier": { "PURL": "pkg:deb/debian/tzdata@2026b-0%2Bdeb12u1?arch=all\u0026distro=debian-12.15", "UID": "9c044d6d00a3a61d" }, "Version": "2026b", "Release": "0+deb12u1", "Arch": "all", "SrcName": "tzdata", "SrcVersion": "2026b", "SrcRelease": "0+deb12u1", "Licenses": [ "public-domain" ], "Maintainer": "GNU Libc Maintainers \u003cdebian-glibc@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "debconf@1.5.82" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/share/doc/tzdata/README.Debian", "/usr/share/doc/tzdata/changelog.Debian.gz", "/usr/share/doc/tzdata/changelog.gz", "/usr/share/doc/tzdata/copyright", "/usr/share/lintian/overrides/tzdata", "/usr/share/zoneinfo/Africa/Abidjan", "/usr/share/zoneinfo/Africa/Accra", "/usr/share/zoneinfo/Africa/Addis_Ababa", "/usr/share/zoneinfo/Africa/Algiers", "/usr/share/zoneinfo/Africa/Asmara", "/usr/share/zoneinfo/Africa/Bamako", "/usr/share/zoneinfo/Africa/Bangui", "/usr/share/zoneinfo/Africa/Banjul", "/usr/share/zoneinfo/Africa/Bissau", "/usr/share/zoneinfo/Africa/Blantyre", "/usr/share/zoneinfo/Africa/Brazzaville", "/usr/share/zoneinfo/Africa/Bujumbura", "/usr/share/zoneinfo/Africa/Cairo", "/usr/share/zoneinfo/Africa/Casablanca", "/usr/share/zoneinfo/Africa/Ceuta", "/usr/share/zoneinfo/Africa/Conakry", "/usr/share/zoneinfo/Africa/Dakar", "/usr/share/zoneinfo/Africa/Dar_es_Salaam", "/usr/share/zoneinfo/Africa/Djibouti", "/usr/share/zoneinfo/Africa/Douala", "/usr/share/zoneinfo/Africa/El_Aaiun", "/usr/share/zoneinfo/Africa/Freetown", "/usr/share/zoneinfo/Africa/Gaborone", "/usr/share/zoneinfo/Africa/Harare", "/usr/share/zoneinfo/Africa/Johannesburg", "/usr/share/zoneinfo/Africa/Juba", "/usr/share/zoneinfo/Africa/Kampala", "/usr/share/zoneinfo/Africa/Khartoum", "/usr/share/zoneinfo/Africa/Kigali", "/usr/share/zoneinfo/Africa/Kinshasa", "/usr/share/zoneinfo/Africa/Lagos", "/usr/share/zoneinfo/Africa/Libreville", "/usr/share/zoneinfo/Africa/Lome", "/usr/share/zoneinfo/Africa/Luanda", "/usr/share/zoneinfo/Africa/Lubumbashi", "/usr/share/zoneinfo/Africa/Lusaka", "/usr/share/zoneinfo/Africa/Malabo", "/usr/share/zoneinfo/Africa/Maputo", "/usr/share/zoneinfo/Africa/Maseru", "/usr/share/zoneinfo/Africa/Mbabane", "/usr/share/zoneinfo/Africa/Mogadishu", "/usr/share/zoneinfo/Africa/Monrovia", "/usr/share/zoneinfo/Africa/Nairobi", "/usr/share/zoneinfo/Africa/Ndjamena", "/usr/share/zoneinfo/Africa/Niamey", "/usr/share/zoneinfo/Africa/Nouakchott", "/usr/share/zoneinfo/Africa/Ouagadougou", "/usr/share/zoneinfo/Africa/Porto-Novo", "/usr/share/zoneinfo/Africa/Sao_Tome", "/usr/share/zoneinfo/Africa/Tripoli", "/usr/share/zoneinfo/Africa/Tunis", "/usr/share/zoneinfo/Africa/Windhoek", "/usr/share/zoneinfo/America/Adak", "/usr/share/zoneinfo/America/Anchorage", "/usr/share/zoneinfo/America/Anguilla", "/usr/share/zoneinfo/America/Antigua", "/usr/share/zoneinfo/America/Araguaina", "/usr/share/zoneinfo/America/Argentina/Buenos_Aires", "/usr/share/zoneinfo/America/Argentina/Catamarca", "/usr/share/zoneinfo/America/Argentina/Cordoba", "/usr/share/zoneinfo/America/Argentina/Jujuy", "/usr/share/zoneinfo/America/Argentina/La_Rioja", "/usr/share/zoneinfo/America/Argentina/Mendoza", "/usr/share/zoneinfo/America/Argentina/Rio_Gallegos", "/usr/share/zoneinfo/America/Argentina/Salta", "/usr/share/zoneinfo/America/Argentina/San_Juan", "/usr/share/zoneinfo/America/Argentina/San_Luis", "/usr/share/zoneinfo/America/Argentina/Tucuman", "/usr/share/zoneinfo/America/Argentina/Ushuaia", "/usr/share/zoneinfo/America/Aruba", "/usr/share/zoneinfo/America/Asuncion", "/usr/share/zoneinfo/America/Atikokan", "/usr/share/zoneinfo/America/Bahia", "/usr/share/zoneinfo/America/Bahia_Banderas", "/usr/share/zoneinfo/America/Barbados", "/usr/share/zoneinfo/America/Belem", "/usr/share/zoneinfo/America/Belize", "/usr/share/zoneinfo/America/Blanc-Sablon", "/usr/share/zoneinfo/America/Boa_Vista", "/usr/share/zoneinfo/America/Bogota", "/usr/share/zoneinfo/America/Boise", "/usr/share/zoneinfo/America/Cambridge_Bay", "/usr/share/zoneinfo/America/Campo_Grande", "/usr/share/zoneinfo/America/Cancun", "/usr/share/zoneinfo/America/Caracas", "/usr/share/zoneinfo/America/Cayenne", "/usr/share/zoneinfo/America/Cayman", "/usr/share/zoneinfo/America/Chicago", "/usr/share/zoneinfo/America/Chihuahua", "/usr/share/zoneinfo/America/Ciudad_Juarez", "/usr/share/zoneinfo/America/Costa_Rica", "/usr/share/zoneinfo/America/Coyhaique", "/usr/share/zoneinfo/America/Creston", "/usr/share/zoneinfo/America/Cuiaba", "/usr/share/zoneinfo/America/Curacao", "/usr/share/zoneinfo/America/Danmarkshavn", "/usr/share/zoneinfo/America/Dawson", "/usr/share/zoneinfo/America/Dawson_Creek", "/usr/share/zoneinfo/America/Denver", "/usr/share/zoneinfo/America/Detroit", "/usr/share/zoneinfo/America/Dominica", "/usr/share/zoneinfo/America/Edmonton", "/usr/share/zoneinfo/America/Eirunepe", "/usr/share/zoneinfo/America/El_Salvador", "/usr/share/zoneinfo/America/Fort_Nelson", "/usr/share/zoneinfo/America/Fortaleza", "/usr/share/zoneinfo/America/Glace_Bay", "/usr/share/zoneinfo/America/Goose_Bay", "/usr/share/zoneinfo/America/Grand_Turk", "/usr/share/zoneinfo/America/Grenada", "/usr/share/zoneinfo/America/Guadeloupe", "/usr/share/zoneinfo/America/Guatemala", "/usr/share/zoneinfo/America/Guayaquil", "/usr/share/zoneinfo/America/Guyana", "/usr/share/zoneinfo/America/Halifax", "/usr/share/zoneinfo/America/Havana", "/usr/share/zoneinfo/America/Hermosillo", "/usr/share/zoneinfo/America/Indiana/Indianapolis", "/usr/share/zoneinfo/America/Indiana/Knox", "/usr/share/zoneinfo/America/Indiana/Marengo", "/usr/share/zoneinfo/America/Indiana/Petersburg", "/usr/share/zoneinfo/America/Indiana/Tell_City", "/usr/share/zoneinfo/America/Indiana/Vevay", "/usr/share/zoneinfo/America/Indiana/Vincennes", "/usr/share/zoneinfo/America/Indiana/Winamac", "/usr/share/zoneinfo/America/Inuvik", "/usr/share/zoneinfo/America/Iqaluit", "/usr/share/zoneinfo/America/Jamaica", "/usr/share/zoneinfo/America/Juneau", "/usr/share/zoneinfo/America/Kentucky/Louisville", "/usr/share/zoneinfo/America/Kentucky/Monticello", "/usr/share/zoneinfo/America/La_Paz", "/usr/share/zoneinfo/America/Lima", "/usr/share/zoneinfo/America/Los_Angeles", "/usr/share/zoneinfo/America/Maceio", "/usr/share/zoneinfo/America/Managua", "/usr/share/zoneinfo/America/Manaus", "/usr/share/zoneinfo/America/Martinique", "/usr/share/zoneinfo/America/Matamoros", "/usr/share/zoneinfo/America/Mazatlan", "/usr/share/zoneinfo/America/Menominee", "/usr/share/zoneinfo/America/Merida", "/usr/share/zoneinfo/America/Metlakatla", "/usr/share/zoneinfo/America/Mexico_City", "/usr/share/zoneinfo/America/Miquelon", "/usr/share/zoneinfo/America/Moncton", "/usr/share/zoneinfo/America/Monterrey", "/usr/share/zoneinfo/America/Montevideo", "/usr/share/zoneinfo/America/Montserrat", "/usr/share/zoneinfo/America/Nassau", "/usr/share/zoneinfo/America/New_York", "/usr/share/zoneinfo/America/Nome", "/usr/share/zoneinfo/America/Noronha", "/usr/share/zoneinfo/America/North_Dakota/Beulah", "/usr/share/zoneinfo/America/North_Dakota/Center", "/usr/share/zoneinfo/America/North_Dakota/New_Salem", "/usr/share/zoneinfo/America/Nuuk", "/usr/share/zoneinfo/America/Ojinaga", "/usr/share/zoneinfo/America/Panama", "/usr/share/zoneinfo/America/Paramaribo", "/usr/share/zoneinfo/America/Phoenix", "/usr/share/zoneinfo/America/Port-au-Prince", "/usr/share/zoneinfo/America/Port_of_Spain", "/usr/share/zoneinfo/America/Porto_Velho", "/usr/share/zoneinfo/America/Puerto_Rico", "/usr/share/zoneinfo/America/Punta_Arenas", "/usr/share/zoneinfo/America/Rankin_Inlet", "/usr/share/zoneinfo/America/Recife", "/usr/share/zoneinfo/America/Regina", "/usr/share/zoneinfo/America/Resolute", "/usr/share/zoneinfo/America/Rio_Branco", "/usr/share/zoneinfo/America/Santarem", "/usr/share/zoneinfo/America/Santiago", "/usr/share/zoneinfo/America/Santo_Domingo", "/usr/share/zoneinfo/America/Sao_Paulo", "/usr/share/zoneinfo/America/Scoresbysund", "/usr/share/zoneinfo/America/Sitka", "/usr/share/zoneinfo/America/St_Johns", "/usr/share/zoneinfo/America/St_Kitts", "/usr/share/zoneinfo/America/St_Lucia", "/usr/share/zoneinfo/America/St_Thomas", "/usr/share/zoneinfo/America/St_Vincent", "/usr/share/zoneinfo/America/Swift_Current", "/usr/share/zoneinfo/America/Tegucigalpa", "/usr/share/zoneinfo/America/Thule", "/usr/share/zoneinfo/America/Tijuana", "/usr/share/zoneinfo/America/Toronto", "/usr/share/zoneinfo/America/Tortola", "/usr/share/zoneinfo/America/Vancouver", "/usr/share/zoneinfo/America/Whitehorse", "/usr/share/zoneinfo/America/Winnipeg", "/usr/share/zoneinfo/America/Yakutat", "/usr/share/zoneinfo/Antarctica/Casey", "/usr/share/zoneinfo/Antarctica/Davis", "/usr/share/zoneinfo/Antarctica/DumontDUrville", "/usr/share/zoneinfo/Antarctica/Macquarie", "/usr/share/zoneinfo/Antarctica/Mawson", "/usr/share/zoneinfo/Antarctica/McMurdo", "/usr/share/zoneinfo/Antarctica/Palmer", "/usr/share/zoneinfo/Antarctica/Rothera", "/usr/share/zoneinfo/Antarctica/Syowa", "/usr/share/zoneinfo/Antarctica/Troll", "/usr/share/zoneinfo/Antarctica/Vostok", "/usr/share/zoneinfo/Asia/Aden", "/usr/share/zoneinfo/Asia/Almaty", "/usr/share/zoneinfo/Asia/Amman", "/usr/share/zoneinfo/Asia/Anadyr", "/usr/share/zoneinfo/Asia/Aqtau", "/usr/share/zoneinfo/Asia/Aqtobe", "/usr/share/zoneinfo/Asia/Ashgabat", "/usr/share/zoneinfo/Asia/Atyrau", "/usr/share/zoneinfo/Asia/Baghdad", "/usr/share/zoneinfo/Asia/Bahrain", "/usr/share/zoneinfo/Asia/Baku", "/usr/share/zoneinfo/Asia/Bangkok", "/usr/share/zoneinfo/Asia/Barnaul", "/usr/share/zoneinfo/Asia/Beirut", "/usr/share/zoneinfo/Asia/Bishkek", "/usr/share/zoneinfo/Asia/Brunei", "/usr/share/zoneinfo/Asia/Chita", "/usr/share/zoneinfo/Asia/Colombo", "/usr/share/zoneinfo/Asia/Damascus", "/usr/share/zoneinfo/Asia/Dhaka", "/usr/share/zoneinfo/Asia/Dili", "/usr/share/zoneinfo/Asia/Dubai", "/usr/share/zoneinfo/Asia/Dushanbe", "/usr/share/zoneinfo/Asia/Famagusta", "/usr/share/zoneinfo/Asia/Gaza", "/usr/share/zoneinfo/Asia/Hebron", "/usr/share/zoneinfo/Asia/Ho_Chi_Minh", "/usr/share/zoneinfo/Asia/Hong_Kong", "/usr/share/zoneinfo/Asia/Hovd", "/usr/share/zoneinfo/Asia/Irkutsk", "/usr/share/zoneinfo/Asia/Jakarta", "/usr/share/zoneinfo/Asia/Jayapura", "/usr/share/zoneinfo/Asia/Jerusalem", "/usr/share/zoneinfo/Asia/Kabul", "/usr/share/zoneinfo/Asia/Kamchatka", "/usr/share/zoneinfo/Asia/Karachi", "/usr/share/zoneinfo/Asia/Kathmandu", "/usr/share/zoneinfo/Asia/Khandyga", "/usr/share/zoneinfo/Asia/Kolkata", "/usr/share/zoneinfo/Asia/Krasnoyarsk", "/usr/share/zoneinfo/Asia/Kuala_Lumpur", "/usr/share/zoneinfo/Asia/Kuching", "/usr/share/zoneinfo/Asia/Kuwait", "/usr/share/zoneinfo/Asia/Macau", "/usr/share/zoneinfo/Asia/Magadan", "/usr/share/zoneinfo/Asia/Makassar", "/usr/share/zoneinfo/Asia/Manila", "/usr/share/zoneinfo/Asia/Muscat", "/usr/share/zoneinfo/Asia/Nicosia", "/usr/share/zoneinfo/Asia/Novokuznetsk", "/usr/share/zoneinfo/Asia/Novosibirsk", "/usr/share/zoneinfo/Asia/Omsk", "/usr/share/zoneinfo/Asia/Oral", "/usr/share/zoneinfo/Asia/Phnom_Penh", "/usr/share/zoneinfo/Asia/Pontianak", "/usr/share/zoneinfo/Asia/Pyongyang", "/usr/share/zoneinfo/Asia/Qatar", "/usr/share/zoneinfo/Asia/Qostanay", "/usr/share/zoneinfo/Asia/Qyzylorda", "/usr/share/zoneinfo/Asia/Riyadh", "/usr/share/zoneinfo/Asia/Sakhalin", "/usr/share/zoneinfo/Asia/Samarkand", "/usr/share/zoneinfo/Asia/Seoul", "/usr/share/zoneinfo/Asia/Shanghai", "/usr/share/zoneinfo/Asia/Singapore", "/usr/share/zoneinfo/Asia/Srednekolymsk", "/usr/share/zoneinfo/Asia/Taipei", "/usr/share/zoneinfo/Asia/Tashkent", "/usr/share/zoneinfo/Asia/Tbilisi", "/usr/share/zoneinfo/Asia/Tehran", "/usr/share/zoneinfo/Asia/Thimphu", "/usr/share/zoneinfo/Asia/Tokyo", "/usr/share/zoneinfo/Asia/Tomsk", "/usr/share/zoneinfo/Asia/Ulaanbaatar", "/usr/share/zoneinfo/Asia/Urumqi", "/usr/share/zoneinfo/Asia/Ust-Nera", "/usr/share/zoneinfo/Asia/Vientiane", "/usr/share/zoneinfo/Asia/Vladivostok", "/usr/share/zoneinfo/Asia/Yakutsk", "/usr/share/zoneinfo/Asia/Yangon", "/usr/share/zoneinfo/Asia/Yekaterinburg", "/usr/share/zoneinfo/Asia/Yerevan", "/usr/share/zoneinfo/Atlantic/Azores", "/usr/share/zoneinfo/Atlantic/Bermuda", "/usr/share/zoneinfo/Atlantic/Canary", "/usr/share/zoneinfo/Atlantic/Cape_Verde", "/usr/share/zoneinfo/Atlantic/Faroe", "/usr/share/zoneinfo/Atlantic/Madeira", "/usr/share/zoneinfo/Atlantic/Reykjavik", "/usr/share/zoneinfo/Atlantic/South_Georgia", "/usr/share/zoneinfo/Atlantic/St_Helena", "/usr/share/zoneinfo/Atlantic/Stanley", "/usr/share/zoneinfo/Australia/Adelaide", "/usr/share/zoneinfo/Australia/Brisbane", "/usr/share/zoneinfo/Australia/Broken_Hill", "/usr/share/zoneinfo/Australia/Darwin", "/usr/share/zoneinfo/Australia/Eucla", "/usr/share/zoneinfo/Australia/Hobart", "/usr/share/zoneinfo/Australia/Lindeman", "/usr/share/zoneinfo/Australia/Lord_Howe", "/usr/share/zoneinfo/Australia/Melbourne", "/usr/share/zoneinfo/Australia/Perth", "/usr/share/zoneinfo/Australia/Sydney", "/usr/share/zoneinfo/CET", "/usr/share/zoneinfo/CST6CDT", "/usr/share/zoneinfo/EET", "/usr/share/zoneinfo/EST", "/usr/share/zoneinfo/EST5EDT", "/usr/share/zoneinfo/Etc/GMT", "/usr/share/zoneinfo/Etc/GMT+1", "/usr/share/zoneinfo/Etc/GMT+10", "/usr/share/zoneinfo/Etc/GMT+11", "/usr/share/zoneinfo/Etc/GMT+12", "/usr/share/zoneinfo/Etc/GMT+2", "/usr/share/zoneinfo/Etc/GMT+3", "/usr/share/zoneinfo/Etc/GMT+4", "/usr/share/zoneinfo/Etc/GMT+5", "/usr/share/zoneinfo/Etc/GMT+6", "/usr/share/zoneinfo/Etc/GMT+7", "/usr/share/zoneinfo/Etc/GMT+8", "/usr/share/zoneinfo/Etc/GMT+9", "/usr/share/zoneinfo/Etc/GMT-1", "/usr/share/zoneinfo/Etc/GMT-10", "/usr/share/zoneinfo/Etc/GMT-11", "/usr/share/zoneinfo/Etc/GMT-12", "/usr/share/zoneinfo/Etc/GMT-13", "/usr/share/zoneinfo/Etc/GMT-14", "/usr/share/zoneinfo/Etc/GMT-2", "/usr/share/zoneinfo/Etc/GMT-3", "/usr/share/zoneinfo/Etc/GMT-4", "/usr/share/zoneinfo/Etc/GMT-5", "/usr/share/zoneinfo/Etc/GMT-6", "/usr/share/zoneinfo/Etc/GMT-7", "/usr/share/zoneinfo/Etc/GMT-8", "/usr/share/zoneinfo/Etc/GMT-9", "/usr/share/zoneinfo/Etc/UTC", "/usr/share/zoneinfo/Europe/Amsterdam", "/usr/share/zoneinfo/Europe/Andorra", "/usr/share/zoneinfo/Europe/Astrakhan", "/usr/share/zoneinfo/Europe/Athens", "/usr/share/zoneinfo/Europe/Belgrade", "/usr/share/zoneinfo/Europe/Berlin", "/usr/share/zoneinfo/Europe/Brussels", "/usr/share/zoneinfo/Europe/Bucharest", "/usr/share/zoneinfo/Europe/Budapest", "/usr/share/zoneinfo/Europe/Chisinau", "/usr/share/zoneinfo/Europe/Copenhagen", "/usr/share/zoneinfo/Europe/Dublin", "/usr/share/zoneinfo/Europe/Gibraltar", "/usr/share/zoneinfo/Europe/Guernsey", "/usr/share/zoneinfo/Europe/Helsinki", "/usr/share/zoneinfo/Europe/Isle_of_Man", "/usr/share/zoneinfo/Europe/Istanbul", "/usr/share/zoneinfo/Europe/Jersey", "/usr/share/zoneinfo/Europe/Kaliningrad", "/usr/share/zoneinfo/Europe/Kirov", "/usr/share/zoneinfo/Europe/Kyiv", "/usr/share/zoneinfo/Europe/Lisbon", "/usr/share/zoneinfo/Europe/Ljubljana", "/usr/share/zoneinfo/Europe/London", "/usr/share/zoneinfo/Europe/Luxembourg", "/usr/share/zoneinfo/Europe/Madrid", "/usr/share/zoneinfo/Europe/Malta", "/usr/share/zoneinfo/Europe/Minsk", "/usr/share/zoneinfo/Europe/Monaco", "/usr/share/zoneinfo/Europe/Moscow", "/usr/share/zoneinfo/Europe/Oslo", "/usr/share/zoneinfo/Europe/Paris", "/usr/share/zoneinfo/Europe/Prague", "/usr/share/zoneinfo/Europe/Riga", "/usr/share/zoneinfo/Europe/Rome", "/usr/share/zoneinfo/Europe/Samara", "/usr/share/zoneinfo/Europe/Sarajevo", "/usr/share/zoneinfo/Europe/Saratov", "/usr/share/zoneinfo/Europe/Simferopol", "/usr/share/zoneinfo/Europe/Skopje", "/usr/share/zoneinfo/Europe/Sofia", "/usr/share/zoneinfo/Europe/Stockholm", "/usr/share/zoneinfo/Europe/Tallinn", "/usr/share/zoneinfo/Europe/Tirane", "/usr/share/zoneinfo/Europe/Ulyanovsk", "/usr/share/zoneinfo/Europe/Vaduz", "/usr/share/zoneinfo/Europe/Vienna", "/usr/share/zoneinfo/Europe/Vilnius", "/usr/share/zoneinfo/Europe/Volgograd", "/usr/share/zoneinfo/Europe/Warsaw", "/usr/share/zoneinfo/Europe/Zagreb", "/usr/share/zoneinfo/Europe/Zurich", "/usr/share/zoneinfo/Factory", "/usr/share/zoneinfo/HST", "/usr/share/zoneinfo/Indian/Antananarivo", "/usr/share/zoneinfo/Indian/Chagos", "/usr/share/zoneinfo/Indian/Christmas", "/usr/share/zoneinfo/Indian/Cocos", "/usr/share/zoneinfo/Indian/Comoro", "/usr/share/zoneinfo/Indian/Kerguelen", "/usr/share/zoneinfo/Indian/Mahe", "/usr/share/zoneinfo/Indian/Maldives", "/usr/share/zoneinfo/Indian/Mauritius", "/usr/share/zoneinfo/Indian/Mayotte", "/usr/share/zoneinfo/Indian/Reunion", "/usr/share/zoneinfo/MET", "/usr/share/zoneinfo/MST", "/usr/share/zoneinfo/MST7MDT", "/usr/share/zoneinfo/PST8PDT", "/usr/share/zoneinfo/Pacific/Apia", "/usr/share/zoneinfo/Pacific/Auckland", "/usr/share/zoneinfo/Pacific/Bougainville", "/usr/share/zoneinfo/Pacific/Chatham", "/usr/share/zoneinfo/Pacific/Chuuk", "/usr/share/zoneinfo/Pacific/Easter", "/usr/share/zoneinfo/Pacific/Efate", "/usr/share/zoneinfo/Pacific/Fakaofo", "/usr/share/zoneinfo/Pacific/Fiji", "/usr/share/zoneinfo/Pacific/Funafuti", "/usr/share/zoneinfo/Pacific/Galapagos", "/usr/share/zoneinfo/Pacific/Gambier", "/usr/share/zoneinfo/Pacific/Guadalcanal", "/usr/share/zoneinfo/Pacific/Guam", "/usr/share/zoneinfo/Pacific/Honolulu", "/usr/share/zoneinfo/Pacific/Kanton", "/usr/share/zoneinfo/Pacific/Kiritimati", "/usr/share/zoneinfo/Pacific/Kosrae", "/usr/share/zoneinfo/Pacific/Kwajalein", "/usr/share/zoneinfo/Pacific/Majuro", "/usr/share/zoneinfo/Pacific/Marquesas", "/usr/share/zoneinfo/Pacific/Midway", "/usr/share/zoneinfo/Pacific/Nauru", "/usr/share/zoneinfo/Pacific/Niue", "/usr/share/zoneinfo/Pacific/Norfolk", "/usr/share/zoneinfo/Pacific/Noumea", "/usr/share/zoneinfo/Pacific/Pago_Pago", "/usr/share/zoneinfo/Pacific/Palau", "/usr/share/zoneinfo/Pacific/Pitcairn", "/usr/share/zoneinfo/Pacific/Pohnpei", "/usr/share/zoneinfo/Pacific/Port_Moresby", "/usr/share/zoneinfo/Pacific/Rarotonga", "/usr/share/zoneinfo/Pacific/Saipan", "/usr/share/zoneinfo/Pacific/Tahiti", "/usr/share/zoneinfo/Pacific/Tarawa", "/usr/share/zoneinfo/Pacific/Tongatapu", "/usr/share/zoneinfo/Pacific/Wake", "/usr/share/zoneinfo/Pacific/Wallis", "/usr/share/zoneinfo/WET", "/usr/share/zoneinfo/iso3166.tab", "/usr/share/zoneinfo/leap-seconds.list", "/usr/share/zoneinfo/leapseconds", "/usr/share/zoneinfo/right/Africa/Abidjan", "/usr/share/zoneinfo/right/Africa/Accra", "/usr/share/zoneinfo/right/Africa/Addis_Ababa", "/usr/share/zoneinfo/right/Africa/Algiers", "/usr/share/zoneinfo/right/Africa/Asmara", "/usr/share/zoneinfo/right/Africa/Bamako", "/usr/share/zoneinfo/right/Africa/Bangui", "/usr/share/zoneinfo/right/Africa/Banjul", "/usr/share/zoneinfo/right/Africa/Bissau", "/usr/share/zoneinfo/right/Africa/Blantyre", "/usr/share/zoneinfo/right/Africa/Brazzaville", "/usr/share/zoneinfo/right/Africa/Bujumbura", "/usr/share/zoneinfo/right/Africa/Cairo", "/usr/share/zoneinfo/right/Africa/Casablanca", "/usr/share/zoneinfo/right/Africa/Ceuta", "/usr/share/zoneinfo/right/Africa/Conakry", "/usr/share/zoneinfo/right/Africa/Dakar", "/usr/share/zoneinfo/right/Africa/Dar_es_Salaam", "/usr/share/zoneinfo/right/Africa/Djibouti", "/usr/share/zoneinfo/right/Africa/Douala", "/usr/share/zoneinfo/right/Africa/El_Aaiun", "/usr/share/zoneinfo/right/Africa/Freetown", "/usr/share/zoneinfo/right/Africa/Gaborone", "/usr/share/zoneinfo/right/Africa/Harare", "/usr/share/zoneinfo/right/Africa/Johannesburg", "/usr/share/zoneinfo/right/Africa/Juba", "/usr/share/zoneinfo/right/Africa/Kampala", "/usr/share/zoneinfo/right/Africa/Khartoum", "/usr/share/zoneinfo/right/Africa/Kigali", "/usr/share/zoneinfo/right/Africa/Kinshasa", "/usr/share/zoneinfo/right/Africa/Lagos", "/usr/share/zoneinfo/right/Africa/Libreville", "/usr/share/zoneinfo/right/Africa/Lome", "/usr/share/zoneinfo/right/Africa/Luanda", "/usr/share/zoneinfo/right/Africa/Lubumbashi", "/usr/share/zoneinfo/right/Africa/Lusaka", "/usr/share/zoneinfo/right/Africa/Malabo", "/usr/share/zoneinfo/right/Africa/Maputo", "/usr/share/zoneinfo/right/Africa/Maseru", "/usr/share/zoneinfo/right/Africa/Mbabane", "/usr/share/zoneinfo/right/Africa/Mogadishu", "/usr/share/zoneinfo/right/Africa/Monrovia", "/usr/share/zoneinfo/right/Africa/Nairobi", "/usr/share/zoneinfo/right/Africa/Ndjamena", "/usr/share/zoneinfo/right/Africa/Niamey", "/usr/share/zoneinfo/right/Africa/Nouakchott", "/usr/share/zoneinfo/right/Africa/Ouagadougou", "/usr/share/zoneinfo/right/Africa/Porto-Novo", "/usr/share/zoneinfo/right/Africa/Sao_Tome", "/usr/share/zoneinfo/right/Africa/Tripoli", "/usr/share/zoneinfo/right/Africa/Tunis", "/usr/share/zoneinfo/right/Africa/Windhoek", "/usr/share/zoneinfo/right/America/Adak", "/usr/share/zoneinfo/right/America/Anchorage", "/usr/share/zoneinfo/right/America/Anguilla", "/usr/share/zoneinfo/right/America/Antigua", "/usr/share/zoneinfo/right/America/Araguaina", "/usr/share/zoneinfo/right/America/Argentina/Buenos_Aires", "/usr/share/zoneinfo/right/America/Argentina/Catamarca", "/usr/share/zoneinfo/right/America/Argentina/Cordoba", "/usr/share/zoneinfo/right/America/Argentina/Jujuy", "/usr/share/zoneinfo/right/America/Argentina/La_Rioja", "/usr/share/zoneinfo/right/America/Argentina/Mendoza", "/usr/share/zoneinfo/right/America/Argentina/Rio_Gallegos", "/usr/share/zoneinfo/right/America/Argentina/Salta", "/usr/share/zoneinfo/right/America/Argentina/San_Juan", "/usr/share/zoneinfo/right/America/Argentina/San_Luis", "/usr/share/zoneinfo/right/America/Argentina/Tucuman", "/usr/share/zoneinfo/right/America/Argentina/Ushuaia", "/usr/share/zoneinfo/right/America/Aruba", "/usr/share/zoneinfo/right/America/Asuncion", "/usr/share/zoneinfo/right/America/Atikokan", "/usr/share/zoneinfo/right/America/Bahia", "/usr/share/zoneinfo/right/America/Bahia_Banderas", "/usr/share/zoneinfo/right/America/Barbados", "/usr/share/zoneinfo/right/America/Belem", "/usr/share/zoneinfo/right/America/Belize", "/usr/share/zoneinfo/right/America/Blanc-Sablon", "/usr/share/zoneinfo/right/America/Boa_Vista", "/usr/share/zoneinfo/right/America/Bogota", "/usr/share/zoneinfo/right/America/Boise", "/usr/share/zoneinfo/right/America/Cambridge_Bay", "/usr/share/zoneinfo/right/America/Campo_Grande", "/usr/share/zoneinfo/right/America/Cancun", "/usr/share/zoneinfo/right/America/Caracas", "/usr/share/zoneinfo/right/America/Cayenne", "/usr/share/zoneinfo/right/America/Cayman", "/usr/share/zoneinfo/right/America/Chicago", "/usr/share/zoneinfo/right/America/Chihuahua", "/usr/share/zoneinfo/right/America/Ciudad_Juarez", "/usr/share/zoneinfo/right/America/Costa_Rica", "/usr/share/zoneinfo/right/America/Coyhaique", "/usr/share/zoneinfo/right/America/Creston", "/usr/share/zoneinfo/right/America/Cuiaba", "/usr/share/zoneinfo/right/America/Curacao", "/usr/share/zoneinfo/right/America/Danmarkshavn", "/usr/share/zoneinfo/right/America/Dawson", "/usr/share/zoneinfo/right/America/Dawson_Creek", "/usr/share/zoneinfo/right/America/Denver", "/usr/share/zoneinfo/right/America/Detroit", "/usr/share/zoneinfo/right/America/Dominica", "/usr/share/zoneinfo/right/America/Edmonton", "/usr/share/zoneinfo/right/America/Eirunepe", "/usr/share/zoneinfo/right/America/El_Salvador", "/usr/share/zoneinfo/right/America/Fort_Nelson", "/usr/share/zoneinfo/right/America/Fortaleza", "/usr/share/zoneinfo/right/America/Glace_Bay", "/usr/share/zoneinfo/right/America/Goose_Bay", "/usr/share/zoneinfo/right/America/Grand_Turk", "/usr/share/zoneinfo/right/America/Grenada", "/usr/share/zoneinfo/right/America/Guadeloupe", "/usr/share/zoneinfo/right/America/Guatemala", "/usr/share/zoneinfo/right/America/Guayaquil", "/usr/share/zoneinfo/right/America/Guyana", "/usr/share/zoneinfo/right/America/Halifax", "/usr/share/zoneinfo/right/America/Havana", "/usr/share/zoneinfo/right/America/Hermosillo", "/usr/share/zoneinfo/right/America/Indiana/Indianapolis", "/usr/share/zoneinfo/right/America/Indiana/Knox", "/usr/share/zoneinfo/right/America/Indiana/Marengo", "/usr/share/zoneinfo/right/America/Indiana/Petersburg", "/usr/share/zoneinfo/right/America/Indiana/Tell_City", "/usr/share/zoneinfo/right/America/Indiana/Vevay", "/usr/share/zoneinfo/right/America/Indiana/Vincennes", "/usr/share/zoneinfo/right/America/Indiana/Winamac", "/usr/share/zoneinfo/right/America/Inuvik", "/usr/share/zoneinfo/right/America/Iqaluit", "/usr/share/zoneinfo/right/America/Jamaica", "/usr/share/zoneinfo/right/America/Juneau", "/usr/share/zoneinfo/right/America/Kentucky/Louisville", "/usr/share/zoneinfo/right/America/Kentucky/Monticello", "/usr/share/zoneinfo/right/America/La_Paz", "/usr/share/zoneinfo/right/America/Lima", "/usr/share/zoneinfo/right/America/Los_Angeles", "/usr/share/zoneinfo/right/America/Maceio", "/usr/share/zoneinfo/right/America/Managua", "/usr/share/zoneinfo/right/America/Manaus", "/usr/share/zoneinfo/right/America/Martinique", "/usr/share/zoneinfo/right/America/Matamoros", "/usr/share/zoneinfo/right/America/Mazatlan", "/usr/share/zoneinfo/right/America/Menominee", "/usr/share/zoneinfo/right/America/Merida", "/usr/share/zoneinfo/right/America/Metlakatla", "/usr/share/zoneinfo/right/America/Mexico_City", "/usr/share/zoneinfo/right/America/Miquelon", "/usr/share/zoneinfo/right/America/Moncton", "/usr/share/zoneinfo/right/America/Monterrey", "/usr/share/zoneinfo/right/America/Montevideo", "/usr/share/zoneinfo/right/America/Montserrat", "/usr/share/zoneinfo/right/America/Nassau", "/usr/share/zoneinfo/right/America/New_York", "/usr/share/zoneinfo/right/America/Nome", "/usr/share/zoneinfo/right/America/Noronha", "/usr/share/zoneinfo/right/America/North_Dakota/Beulah", "/usr/share/zoneinfo/right/America/North_Dakota/Center", "/usr/share/zoneinfo/right/America/North_Dakota/New_Salem", "/usr/share/zoneinfo/right/America/Nuuk", "/usr/share/zoneinfo/right/America/Ojinaga", "/usr/share/zoneinfo/right/America/Panama", "/usr/share/zoneinfo/right/America/Paramaribo", "/usr/share/zoneinfo/right/America/Phoenix", "/usr/share/zoneinfo/right/America/Port-au-Prince", "/usr/share/zoneinfo/right/America/Port_of_Spain", "/usr/share/zoneinfo/right/America/Porto_Velho", "/usr/share/zoneinfo/right/America/Puerto_Rico", "/usr/share/zoneinfo/right/America/Punta_Arenas", "/usr/share/zoneinfo/right/America/Rankin_Inlet", "/usr/share/zoneinfo/right/America/Recife", "/usr/share/zoneinfo/right/America/Regina", "/usr/share/zoneinfo/right/America/Resolute", "/usr/share/zoneinfo/right/America/Rio_Branco", "/usr/share/zoneinfo/right/America/Santarem", "/usr/share/zoneinfo/right/America/Santiago", "/usr/share/zoneinfo/right/America/Santo_Domingo", "/usr/share/zoneinfo/right/America/Sao_Paulo", "/usr/share/zoneinfo/right/America/Scoresbysund", "/usr/share/zoneinfo/right/America/Sitka", "/usr/share/zoneinfo/right/America/St_Johns", "/usr/share/zoneinfo/right/America/St_Kitts", "/usr/share/zoneinfo/right/America/St_Lucia", "/usr/share/zoneinfo/right/America/St_Thomas", "/usr/share/zoneinfo/right/America/St_Vincent", "/usr/share/zoneinfo/right/America/Swift_Current", "/usr/share/zoneinfo/right/America/Tegucigalpa", "/usr/share/zoneinfo/right/America/Thule", "/usr/share/zoneinfo/right/America/Tijuana", "/usr/share/zoneinfo/right/America/Toronto", "/usr/share/zoneinfo/right/America/Tortola", "/usr/share/zoneinfo/right/America/Vancouver", "/usr/share/zoneinfo/right/America/Whitehorse", "/usr/share/zoneinfo/right/America/Winnipeg", "/usr/share/zoneinfo/right/America/Yakutat", "/usr/share/zoneinfo/right/Antarctica/Casey", "/usr/share/zoneinfo/right/Antarctica/Davis", "/usr/share/zoneinfo/right/Antarctica/DumontDUrville", "/usr/share/zoneinfo/right/Antarctica/Macquarie", "/usr/share/zoneinfo/right/Antarctica/Mawson", "/usr/share/zoneinfo/right/Antarctica/McMurdo", "/usr/share/zoneinfo/right/Antarctica/Palmer", "/usr/share/zoneinfo/right/Antarctica/Rothera", "/usr/share/zoneinfo/right/Antarctica/Syowa", "/usr/share/zoneinfo/right/Antarctica/Troll", "/usr/share/zoneinfo/right/Antarctica/Vostok", "/usr/share/zoneinfo/right/Asia/Aden", "/usr/share/zoneinfo/right/Asia/Almaty", "/usr/share/zoneinfo/right/Asia/Amman", "/usr/share/zoneinfo/right/Asia/Anadyr", "/usr/share/zoneinfo/right/Asia/Aqtau", "/usr/share/zoneinfo/right/Asia/Aqtobe", "/usr/share/zoneinfo/right/Asia/Ashgabat", "/usr/share/zoneinfo/right/Asia/Atyrau", "/usr/share/zoneinfo/right/Asia/Baghdad", "/usr/share/zoneinfo/right/Asia/Bahrain", "/usr/share/zoneinfo/right/Asia/Baku", "/usr/share/zoneinfo/right/Asia/Bangkok", "/usr/share/zoneinfo/right/Asia/Barnaul", "/usr/share/zoneinfo/right/Asia/Beirut", "/usr/share/zoneinfo/right/Asia/Bishkek", "/usr/share/zoneinfo/right/Asia/Brunei", "/usr/share/zoneinfo/right/Asia/Chita", "/usr/share/zoneinfo/right/Asia/Colombo", "/usr/share/zoneinfo/right/Asia/Damascus", "/usr/share/zoneinfo/right/Asia/Dhaka", "/usr/share/zoneinfo/right/Asia/Dili", "/usr/share/zoneinfo/right/Asia/Dubai", "/usr/share/zoneinfo/right/Asia/Dushanbe", "/usr/share/zoneinfo/right/Asia/Famagusta", "/usr/share/zoneinfo/right/Asia/Gaza", "/usr/share/zoneinfo/right/Asia/Hebron", "/usr/share/zoneinfo/right/Asia/Ho_Chi_Minh", "/usr/share/zoneinfo/right/Asia/Hong_Kong", "/usr/share/zoneinfo/right/Asia/Hovd", "/usr/share/zoneinfo/right/Asia/Irkutsk", "/usr/share/zoneinfo/right/Asia/Jakarta", "/usr/share/zoneinfo/right/Asia/Jayapura", "/usr/share/zoneinfo/right/Asia/Jerusalem", "/usr/share/zoneinfo/right/Asia/Kabul", "/usr/share/zoneinfo/right/Asia/Kamchatka", "/usr/share/zoneinfo/right/Asia/Karachi", "/usr/share/zoneinfo/right/Asia/Kathmandu", "/usr/share/zoneinfo/right/Asia/Khandyga", "/usr/share/zoneinfo/right/Asia/Kolkata", "/usr/share/zoneinfo/right/Asia/Krasnoyarsk", "/usr/share/zoneinfo/right/Asia/Kuala_Lumpur", "/usr/share/zoneinfo/right/Asia/Kuching", "/usr/share/zoneinfo/right/Asia/Kuwait", "/usr/share/zoneinfo/right/Asia/Macau", "/usr/share/zoneinfo/right/Asia/Magadan", "/usr/share/zoneinfo/right/Asia/Makassar", "/usr/share/zoneinfo/right/Asia/Manila", "/usr/share/zoneinfo/right/Asia/Muscat", "/usr/share/zoneinfo/right/Asia/Nicosia", "/usr/share/zoneinfo/right/Asia/Novokuznetsk", "/usr/share/zoneinfo/right/Asia/Novosibirsk", "/usr/share/zoneinfo/right/Asia/Omsk", "/usr/share/zoneinfo/right/Asia/Oral", "/usr/share/zoneinfo/right/Asia/Phnom_Penh", "/usr/share/zoneinfo/right/Asia/Pontianak", "/usr/share/zoneinfo/right/Asia/Pyongyang", "/usr/share/zoneinfo/right/Asia/Qatar", "/usr/share/zoneinfo/right/Asia/Qostanay", "/usr/share/zoneinfo/right/Asia/Qyzylorda", "/usr/share/zoneinfo/right/Asia/Riyadh", "/usr/share/zoneinfo/right/Asia/Sakhalin", "/usr/share/zoneinfo/right/Asia/Samarkand", "/usr/share/zoneinfo/right/Asia/Seoul", "/usr/share/zoneinfo/right/Asia/Shanghai", "/usr/share/zoneinfo/right/Asia/Singapore", "/usr/share/zoneinfo/right/Asia/Srednekolymsk", "/usr/share/zoneinfo/right/Asia/Taipei", "/usr/share/zoneinfo/right/Asia/Tashkent", "/usr/share/zoneinfo/right/Asia/Tbilisi", "/usr/share/zoneinfo/right/Asia/Tehran", "/usr/share/zoneinfo/right/Asia/Thimphu", "/usr/share/zoneinfo/right/Asia/Tokyo", "/usr/share/zoneinfo/right/Asia/Tomsk", "/usr/share/zoneinfo/right/Asia/Ulaanbaatar", "/usr/share/zoneinfo/right/Asia/Urumqi", "/usr/share/zoneinfo/right/Asia/Ust-Nera", "/usr/share/zoneinfo/right/Asia/Vientiane", "/usr/share/zoneinfo/right/Asia/Vladivostok", "/usr/share/zoneinfo/right/Asia/Yakutsk", "/usr/share/zoneinfo/right/Asia/Yangon", "/usr/share/zoneinfo/right/Asia/Yekaterinburg", "/usr/share/zoneinfo/right/Asia/Yerevan", "/usr/share/zoneinfo/right/Atlantic/Azores", "/usr/share/zoneinfo/right/Atlantic/Bermuda", "/usr/share/zoneinfo/right/Atlantic/Canary", "/usr/share/zoneinfo/right/Atlantic/Cape_Verde", "/usr/share/zoneinfo/right/Atlantic/Faroe", "/usr/share/zoneinfo/right/Atlantic/Madeira", "/usr/share/zoneinfo/right/Atlantic/Reykjavik", "/usr/share/zoneinfo/right/Atlantic/South_Georgia", "/usr/share/zoneinfo/right/Atlantic/St_Helena", "/usr/share/zoneinfo/right/Atlantic/Stanley", "/usr/share/zoneinfo/right/Australia/Adelaide", "/usr/share/zoneinfo/right/Australia/Brisbane", "/usr/share/zoneinfo/right/Australia/Broken_Hill", "/usr/share/zoneinfo/right/Australia/Darwin", "/usr/share/zoneinfo/right/Australia/Eucla", "/usr/share/zoneinfo/right/Australia/Hobart", "/usr/share/zoneinfo/right/Australia/Lindeman", "/usr/share/zoneinfo/right/Australia/Lord_Howe", "/usr/share/zoneinfo/right/Australia/Melbourne", "/usr/share/zoneinfo/right/Australia/Perth", "/usr/share/zoneinfo/right/Australia/Sydney", "/usr/share/zoneinfo/right/CET", "/usr/share/zoneinfo/right/CST6CDT", "/usr/share/zoneinfo/right/EET", "/usr/share/zoneinfo/right/EST", "/usr/share/zoneinfo/right/EST5EDT", "/usr/share/zoneinfo/right/Etc/GMT", "/usr/share/zoneinfo/right/Etc/GMT+1", "/usr/share/zoneinfo/right/Etc/GMT+10", "/usr/share/zoneinfo/right/Etc/GMT+11", "/usr/share/zoneinfo/right/Etc/GMT+12", "/usr/share/zoneinfo/right/Etc/GMT+2", "/usr/share/zoneinfo/right/Etc/GMT+3", "/usr/share/zoneinfo/right/Etc/GMT+4", "/usr/share/zoneinfo/right/Etc/GMT+5", "/usr/share/zoneinfo/right/Etc/GMT+6", "/usr/share/zoneinfo/right/Etc/GMT+7", "/usr/share/zoneinfo/right/Etc/GMT+8", "/usr/share/zoneinfo/right/Etc/GMT+9", "/usr/share/zoneinfo/right/Etc/GMT-1", "/usr/share/zoneinfo/right/Etc/GMT-10", "/usr/share/zoneinfo/right/Etc/GMT-11", "/usr/share/zoneinfo/right/Etc/GMT-12", "/usr/share/zoneinfo/right/Etc/GMT-13", "/usr/share/zoneinfo/right/Etc/GMT-14", "/usr/share/zoneinfo/right/Etc/GMT-2", "/usr/share/zoneinfo/right/Etc/GMT-3", "/usr/share/zoneinfo/right/Etc/GMT-4", "/usr/share/zoneinfo/right/Etc/GMT-5", "/usr/share/zoneinfo/right/Etc/GMT-6", "/usr/share/zoneinfo/right/Etc/GMT-7", "/usr/share/zoneinfo/right/Etc/GMT-8", "/usr/share/zoneinfo/right/Etc/GMT-9", "/usr/share/zoneinfo/right/Etc/UTC", "/usr/share/zoneinfo/right/Europe/Amsterdam", "/usr/share/zoneinfo/right/Europe/Andorra", "/usr/share/zoneinfo/right/Europe/Astrakhan", "/usr/share/zoneinfo/right/Europe/Athens", "/usr/share/zoneinfo/right/Europe/Belgrade", "/usr/share/zoneinfo/right/Europe/Berlin", "/usr/share/zoneinfo/right/Europe/Brussels", "/usr/share/zoneinfo/right/Europe/Bucharest", "/usr/share/zoneinfo/right/Europe/Budapest", "/usr/share/zoneinfo/right/Europe/Chisinau", "/usr/share/zoneinfo/right/Europe/Copenhagen", "/usr/share/zoneinfo/right/Europe/Dublin", "/usr/share/zoneinfo/right/Europe/Gibraltar", "/usr/share/zoneinfo/right/Europe/Guernsey", "/usr/share/zoneinfo/right/Europe/Helsinki", "/usr/share/zoneinfo/right/Europe/Isle_of_Man", "/usr/share/zoneinfo/right/Europe/Istanbul", "/usr/share/zoneinfo/right/Europe/Jersey", "/usr/share/zoneinfo/right/Europe/Kaliningrad", "/usr/share/zoneinfo/right/Europe/Kirov", "/usr/share/zoneinfo/right/Europe/Kyiv", "/usr/share/zoneinfo/right/Europe/Lisbon", "/usr/share/zoneinfo/right/Europe/Ljubljana", "/usr/share/zoneinfo/right/Europe/London", "/usr/share/zoneinfo/right/Europe/Luxembourg", "/usr/share/zoneinfo/right/Europe/Madrid", "/usr/share/zoneinfo/right/Europe/Malta", "/usr/share/zoneinfo/right/Europe/Minsk", "/usr/share/zoneinfo/right/Europe/Monaco", "/usr/share/zoneinfo/right/Europe/Moscow", "/usr/share/zoneinfo/right/Europe/Oslo", "/usr/share/zoneinfo/right/Europe/Paris", "/usr/share/zoneinfo/right/Europe/Prague", "/usr/share/zoneinfo/right/Europe/Riga", "/usr/share/zoneinfo/right/Europe/Rome", "/usr/share/zoneinfo/right/Europe/Samara", "/usr/share/zoneinfo/right/Europe/Sarajevo", "/usr/share/zoneinfo/right/Europe/Saratov", "/usr/share/zoneinfo/right/Europe/Simferopol", "/usr/share/zoneinfo/right/Europe/Skopje", "/usr/share/zoneinfo/right/Europe/Sofia", "/usr/share/zoneinfo/right/Europe/Stockholm", "/usr/share/zoneinfo/right/Europe/Tallinn", "/usr/share/zoneinfo/right/Europe/Tirane", "/usr/share/zoneinfo/right/Europe/Ulyanovsk", "/usr/share/zoneinfo/right/Europe/Vaduz", "/usr/share/zoneinfo/right/Europe/Vienna", "/usr/share/zoneinfo/right/Europe/Vilnius", "/usr/share/zoneinfo/right/Europe/Volgograd", "/usr/share/zoneinfo/right/Europe/Warsaw", "/usr/share/zoneinfo/right/Europe/Zagreb", "/usr/share/zoneinfo/right/Europe/Zurich", "/usr/share/zoneinfo/right/Factory", "/usr/share/zoneinfo/right/HST", "/usr/share/zoneinfo/right/Indian/Antananarivo", "/usr/share/zoneinfo/right/Indian/Chagos", "/usr/share/zoneinfo/right/Indian/Christmas", "/usr/share/zoneinfo/right/Indian/Cocos", "/usr/share/zoneinfo/right/Indian/Comoro", "/usr/share/zoneinfo/right/Indian/Kerguelen", "/usr/share/zoneinfo/right/Indian/Mahe", "/usr/share/zoneinfo/right/Indian/Maldives", "/usr/share/zoneinfo/right/Indian/Mauritius", "/usr/share/zoneinfo/right/Indian/Mayotte", "/usr/share/zoneinfo/right/Indian/Reunion", "/usr/share/zoneinfo/right/MET", "/usr/share/zoneinfo/right/MST", "/usr/share/zoneinfo/right/MST7MDT", "/usr/share/zoneinfo/right/PST8PDT", "/usr/share/zoneinfo/right/Pacific/Apia", "/usr/share/zoneinfo/right/Pacific/Auckland", "/usr/share/zoneinfo/right/Pacific/Bougainville", "/usr/share/zoneinfo/right/Pacific/Chatham", "/usr/share/zoneinfo/right/Pacific/Chuuk", "/usr/share/zoneinfo/right/Pacific/Easter", "/usr/share/zoneinfo/right/Pacific/Efate", "/usr/share/zoneinfo/right/Pacific/Fakaofo", "/usr/share/zoneinfo/right/Pacific/Fiji", "/usr/share/zoneinfo/right/Pacific/Funafuti", "/usr/share/zoneinfo/right/Pacific/Galapagos", "/usr/share/zoneinfo/right/Pacific/Gambier", "/usr/share/zoneinfo/right/Pacific/Guadalcanal", "/usr/share/zoneinfo/right/Pacific/Guam", "/usr/share/zoneinfo/right/Pacific/Honolulu", "/usr/share/zoneinfo/right/Pacific/Kanton", "/usr/share/zoneinfo/right/Pacific/Kiritimati", "/usr/share/zoneinfo/right/Pacific/Kosrae", "/usr/share/zoneinfo/right/Pacific/Kwajalein", "/usr/share/zoneinfo/right/Pacific/Majuro", "/usr/share/zoneinfo/right/Pacific/Marquesas", "/usr/share/zoneinfo/right/Pacific/Midway", "/usr/share/zoneinfo/right/Pacific/Nauru", "/usr/share/zoneinfo/right/Pacific/Niue", "/usr/share/zoneinfo/right/Pacific/Norfolk", "/usr/share/zoneinfo/right/Pacific/Noumea", "/usr/share/zoneinfo/right/Pacific/Pago_Pago", "/usr/share/zoneinfo/right/Pacific/Palau", "/usr/share/zoneinfo/right/Pacific/Pitcairn", "/usr/share/zoneinfo/right/Pacific/Pohnpei", "/usr/share/zoneinfo/right/Pacific/Port_Moresby", "/usr/share/zoneinfo/right/Pacific/Rarotonga", "/usr/share/zoneinfo/right/Pacific/Saipan", "/usr/share/zoneinfo/right/Pacific/Tahiti", "/usr/share/zoneinfo/right/Pacific/Tarawa", "/usr/share/zoneinfo/right/Pacific/Tongatapu", "/usr/share/zoneinfo/right/Pacific/Wake", "/usr/share/zoneinfo/right/Pacific/Wallis", "/usr/share/zoneinfo/right/WET", "/usr/share/zoneinfo/tzdata.zi", "/usr/share/zoneinfo/zone.tab", "/usr/share/zoneinfo/zone1970.tab" ], "AnalyzedBy": "dpkg" }, { "ID": "usr-is-merged@37~deb12u1", "Name": "usr-is-merged", "Identifier": { "PURL": "pkg:deb/debian/usr-is-merged@37~deb12u1?arch=all\u0026distro=debian-12.15", "UID": "e8bc76467481d3cd" }, "Version": "37~deb12u1", "Arch": "all", "SrcName": "usrmerge", "SrcVersion": "37~deb12u1", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only" ], "Maintainer": "Marco d'Itri \u003cmd@linux.it\u003e", "Repository": { "Class": "official" }, "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/usr/share/doc/usr-is-merged/changelog.gz", "/usr/share/doc/usr-is-merged/copyright" ], "AnalyzedBy": "dpkg" }, { "ID": "util-linux@2.38.1-5+deb12u3", "Name": "util-linux", "Identifier": { "PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "c50a1829816b9d94" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "util-linux-extra@2.38.1-5+deb12u3" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/bin/dmesg", "/bin/findmnt", "/bin/lsblk", "/bin/more", "/bin/mountpoint", "/bin/su", "/bin/wdctl", "/lib/systemd/system/fstrim.service", "/lib/systemd/system/fstrim.timer", "/sbin/agetty", "/sbin/blkdiscard", "/sbin/blkid", "/sbin/blkzone", "/sbin/blockdev", "/sbin/chcpu", "/sbin/ctrlaltdel", "/sbin/findfs", "/sbin/fsck", "/sbin/fsck.cramfs", "/sbin/fsck.minix", "/sbin/fsfreeze", "/sbin/fstrim", "/sbin/isosize", "/sbin/mkfs", "/sbin/mkfs.bfs", "/sbin/mkfs.cramfs", "/sbin/mkfs.minix", "/sbin/mkswap", "/sbin/pivot_root", "/sbin/runuser", "/sbin/sulogin", "/sbin/swaplabel", "/sbin/switch_root", "/sbin/wipefs", "/sbin/zramctl", "/usr/bin/addpart", "/usr/bin/choom", "/usr/bin/chrt", "/usr/bin/delpart", "/usr/bin/fallocate", "/usr/bin/flock", "/usr/bin/getopt", "/usr/bin/hardlink", "/usr/bin/ionice", "/usr/bin/ipcmk", "/usr/bin/ipcrm", "/usr/bin/ipcs", "/usr/bin/last", "/usr/bin/lscpu", "/usr/bin/lsipc", "/usr/bin/lslocks", "/usr/bin/lslogins", "/usr/bin/lsmem", "/usr/bin/lsns", "/usr/bin/mcookie", "/usr/bin/mesg", "/usr/bin/namei", "/usr/bin/nsenter", "/usr/bin/partx", "/usr/bin/prlimit", "/usr/bin/rename.ul", "/usr/bin/resizepart", "/usr/bin/rev", "/usr/bin/setarch", "/usr/bin/setpriv", "/usr/bin/setsid", "/usr/bin/setterm", "/usr/bin/taskset", "/usr/bin/uclampset", "/usr/bin/unshare", "/usr/bin/utmpdump", "/usr/bin/whereis", "/usr/lib/mime/packages/util-linux", "/usr/sbin/chmem", "/usr/sbin/ldattach", "/usr/sbin/readprofile", "/usr/sbin/rtcwake", "/usr/share/bash-completion/completions/addpart", "/usr/share/bash-completion/completions/blkdiscard", "/usr/share/bash-completion/completions/blkid", "/usr/share/bash-completion/completions/blkzone", "/usr/share/bash-completion/completions/blockdev", "/usr/share/bash-completion/completions/chcpu", "/usr/share/bash-completion/completions/chmem", "/usr/share/bash-completion/completions/chrt", "/usr/share/bash-completion/completions/ctrlaltdel", "/usr/share/bash-completion/completions/delpart", "/usr/share/bash-completion/completions/dmesg", "/usr/share/bash-completion/completions/fallocate", "/usr/share/bash-completion/completions/findfs", "/usr/share/bash-completion/completions/findmnt", "/usr/share/bash-completion/completions/flock", "/usr/share/bash-completion/completions/fsck", "/usr/share/bash-completion/completions/fsck.cramfs", "/usr/share/bash-completion/completions/fsck.minix", "/usr/share/bash-completion/completions/fsfreeze", "/usr/share/bash-completion/completions/fstrim", "/usr/share/bash-completion/completions/getopt", "/usr/share/bash-completion/completions/hardlink", "/usr/share/bash-completion/completions/ionice", "/usr/share/bash-completion/completions/ipcmk", "/usr/share/bash-completion/completions/ipcrm", "/usr/share/bash-completion/completions/ipcs", "/usr/share/bash-completion/completions/isosize", "/usr/share/bash-completion/completions/last", "/usr/share/bash-completion/completions/ldattach", "/usr/share/bash-completion/completions/lsblk", "/usr/share/bash-completion/completions/lscpu", "/usr/share/bash-completion/completions/lsipc", "/usr/share/bash-completion/completions/lslocks", "/usr/share/bash-completion/completions/lslogins", "/usr/share/bash-completion/completions/lsmem", "/usr/share/bash-completion/completions/lsns", "/usr/share/bash-completion/completions/mcookie", "/usr/share/bash-completion/completions/mesg", "/usr/share/bash-completion/completions/mkfs", "/usr/share/bash-completion/completions/mkfs.bfs", "/usr/share/bash-completion/completions/mkfs.cramfs", "/usr/share/bash-completion/completions/mkfs.minix", "/usr/share/bash-completion/completions/mkswap", "/usr/share/bash-completion/completions/more", "/usr/share/bash-completion/completions/mountpoint", "/usr/share/bash-completion/completions/namei", "/usr/share/bash-completion/completions/nsenter", "/usr/share/bash-completion/completions/partx", "/usr/share/bash-completion/completions/pivot_root", "/usr/share/bash-completion/completions/prlimit", "/usr/share/bash-completion/completions/readprofile", "/usr/share/bash-completion/completions/resizepart", "/usr/share/bash-completion/completions/rev", "/usr/share/bash-completion/completions/rtcwake", "/usr/share/bash-completion/completions/setarch", "/usr/share/bash-completion/completions/setpriv", "/usr/share/bash-completion/completions/setsid", "/usr/share/bash-completion/completions/setterm", "/usr/share/bash-completion/completions/su", "/usr/share/bash-completion/completions/swaplabel", "/usr/share/bash-completion/completions/taskset", "/usr/share/bash-completion/completions/uclampset", "/usr/share/bash-completion/completions/unshare", "/usr/share/bash-completion/completions/utmpdump", "/usr/share/bash-completion/completions/wdctl", "/usr/share/bash-completion/completions/whereis", "/usr/share/bash-completion/completions/wipefs", "/usr/share/bash-completion/completions/zramctl", "/usr/share/doc/util-linux/00-about-docs.txt", "/usr/share/doc/util-linux/AUTHORS.gz", "/usr/share/doc/util-linux/PAM-configuration.txt", "/usr/share/doc/util-linux/README.Debian", "/usr/share/doc/util-linux/blkid.txt", "/usr/share/doc/util-linux/cal.txt", "/usr/share/doc/util-linux/changelog.Debian.gz", "/usr/share/doc/util-linux/changelog.gz", "/usr/share/doc/util-linux/col.txt", "/usr/share/doc/util-linux/copyright", "/usr/share/doc/util-linux/deprecated.txt", "/usr/share/doc/util-linux/examples/getopt-example.bash", "/usr/share/doc/util-linux/examples/getopt-example.tcsh", "/usr/share/doc/util-linux/getopt.txt", "/usr/share/doc/util-linux/getopt_changelog.txt", "/usr/share/doc/util-linux/howto-build-sys.txt", "/usr/share/doc/util-linux/howto-compilation.txt", "/usr/share/doc/util-linux/howto-contribute.txt.gz", "/usr/share/doc/util-linux/howto-debug.txt", "/usr/share/doc/util-linux/howto-man-page.txt", "/usr/share/doc/util-linux/howto-pull-request.txt.gz", "/usr/share/doc/util-linux/howto-tests.txt", "/usr/share/doc/util-linux/howto-usage-function.txt.gz", "/usr/share/doc/util-linux/hwclock.txt", "/usr/share/doc/util-linux/modems-with-agetty.txt", "/usr/share/doc/util-linux/mount.txt", "/usr/share/doc/util-linux/parse-date.txt.gz", "/usr/share/doc/util-linux/pg.txt", "/usr/share/doc/util-linux/poeigl.txt.gz", "/usr/share/doc/util-linux/release-schedule.txt", "/usr/share/doc/util-linux/releases/v2.13-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.14-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.15-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.16-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.17-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.18-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.19-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.20-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.21-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.22-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.23-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.24-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.25-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.26-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.27-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.28-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.29-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.30-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.31-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.32-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.33-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.34-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.35-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.36-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.37-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.38-ReleaseNotes.gz", "/usr/share/doc/util-linux/releases/v2.38.1-ReleaseNotes.gz", "/usr/share/lintian/overrides/util-linux", "/usr/share/man/man1/choom.1.gz", "/usr/share/man/man1/chrt.1.gz", "/usr/share/man/man1/dmesg.1.gz", "/usr/share/man/man1/fallocate.1.gz", "/usr/share/man/man1/flock.1.gz", "/usr/share/man/man1/getopt.1.gz", "/usr/share/man/man1/hardlink.1.gz", "/usr/share/man/man1/ionice.1.gz", "/usr/share/man/man1/ipcmk.1.gz", "/usr/share/man/man1/ipcrm.1.gz", "/usr/share/man/man1/ipcs.1.gz", "/usr/share/man/man1/last.1.gz", "/usr/share/man/man1/lscpu.1.gz", "/usr/share/man/man1/lsipc.1.gz", "/usr/share/man/man1/lslogins.1.gz", "/usr/share/man/man1/lsmem.1.gz", "/usr/share/man/man1/mcookie.1.gz", "/usr/share/man/man1/mesg.1.gz", "/usr/share/man/man1/more.1.gz", "/usr/share/man/man1/mountpoint.1.gz", "/usr/share/man/man1/namei.1.gz", "/usr/share/man/man1/nsenter.1.gz", "/usr/share/man/man1/prlimit.1.gz", "/usr/share/man/man1/rename.ul.1.gz", "/usr/share/man/man1/rev.1.gz", "/usr/share/man/man1/runuser.1.gz", "/usr/share/man/man1/setpriv.1.gz", "/usr/share/man/man1/setsid.1.gz", "/usr/share/man/man1/setterm.1.gz", "/usr/share/man/man1/su.1.gz", "/usr/share/man/man1/taskset.1.gz", "/usr/share/man/man1/uclampset.1.gz", "/usr/share/man/man1/unshare.1.gz", "/usr/share/man/man1/utmpdump.1.gz", "/usr/share/man/man1/whereis.1.gz", "/usr/share/man/man5/adjtime_config.5.gz", "/usr/share/man/man5/terminal-colors.d.5.gz", "/usr/share/man/man8/addpart.8.gz", "/usr/share/man/man8/agetty.8.gz", "/usr/share/man/man8/blkdiscard.8.gz", "/usr/share/man/man8/blkid.8.gz", "/usr/share/man/man8/blkzone.8.gz", "/usr/share/man/man8/blockdev.8.gz", "/usr/share/man/man8/chcpu.8.gz", "/usr/share/man/man8/chmem.8.gz", "/usr/share/man/man8/ctrlaltdel.8.gz", "/usr/share/man/man8/delpart.8.gz", "/usr/share/man/man8/findfs.8.gz", "/usr/share/man/man8/findmnt.8.gz", "/usr/share/man/man8/fsck.8.gz", "/usr/share/man/man8/fsck.cramfs.8.gz", "/usr/share/man/man8/fsck.minix.8.gz", "/usr/share/man/man8/fsfreeze.8.gz", "/usr/share/man/man8/fstrim.8.gz", "/usr/share/man/man8/isosize.8.gz", "/usr/share/man/man8/ldattach.8.gz", "/usr/share/man/man8/lsblk.8.gz", "/usr/share/man/man8/lslocks.8.gz", "/usr/share/man/man8/lsns.8.gz", "/usr/share/man/man8/mkfs.8.gz", "/usr/share/man/man8/mkfs.bfs.8.gz", "/usr/share/man/man8/mkfs.cramfs.8.gz", "/usr/share/man/man8/mkfs.minix.8.gz", "/usr/share/man/man8/mkswap.8.gz", "/usr/share/man/man8/partx.8.gz", "/usr/share/man/man8/pivot_root.8.gz", "/usr/share/man/man8/readprofile.8.gz", "/usr/share/man/man8/resizepart.8.gz", "/usr/share/man/man8/rtcwake.8.gz", "/usr/share/man/man8/setarch.8.gz", "/usr/share/man/man8/sulogin.8.gz", "/usr/share/man/man8/swaplabel.8.gz", "/usr/share/man/man8/switch_root.8.gz", "/usr/share/man/man8/wdctl.8.gz", "/usr/share/man/man8/wipefs.8.gz", "/usr/share/man/man8/zramctl.8.gz", "/usr/share/util-linux/logcheck/ignore.d.server/util-linux" ], "AnalyzedBy": "dpkg" }, { "ID": "util-linux-extra@2.38.1-5+deb12u3", "Name": "util-linux-extra", "Identifier": { "PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ec22fa64ac4832d8" }, "Version": "2.38.1", "Release": "5+deb12u3", "Arch": "amd64", "SrcName": "util-linux", "SrcVersion": "2.38.1", "SrcRelease": "5+deb12u3", "Licenses": [ "GPL-2.0-or-later", "GPL-2.0-only", "GPL-3.0-or-later", "public-domain", "BSD-4-Clause", "MIT", "BSD-3-Clause", "BSLA", "LGPL-2.0-or-later", "LGPL-2.1-or-later", "LGPL-3.0-or-later", "GPL-3.0-only", "LGPL-2.0-only", "LGPL-2.1-only", "LGPL-3.0-only" ], "Maintainer": "util-linux packagers \u003cutil-linux@packages.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libaudit1@1:3.0.9-1", "libc6@2.36-9+deb12u14", "libsmartcols1@2.38.1-5+deb12u3" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/sbin/hwclock", "/usr/bin/fincore", "/usr/bin/lsfd", "/usr/bin/lsirq", "/usr/lib/udev/hwclock-set", "/usr/lib/udev/rules.d/85-hwclock.rules", "/usr/share/bash-completion/completions/fincore", "/usr/share/bash-completion/completions/hwclock", "/usr/share/bash-completion/completions/lsirq", "/usr/share/doc/util-linux-extra/changelog.Debian.gz", "/usr/share/doc/util-linux-extra/changelog.gz", "/usr/share/doc/util-linux-extra/copyright", "/usr/share/man/man1/fincore.1.gz", "/usr/share/man/man1/lsfd.1.gz", "/usr/share/man/man1/lsirq.1.gz", "/usr/share/man/man5/hwclock.5.gz", "/usr/share/man/man8/hwclock.8.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "vainfo@2.12.0+ds1-1", "Name": "vainfo", "Identifier": { "PURL": "pkg:deb/debian/vainfo@2.12.0%2Bds1-1?arch=amd64\u0026distro=debian-12.15", "UID": "811150457e66bcc0" }, "Version": "2.12.0+ds1", "Release": "1", "Arch": "amd64", "SrcName": "libva-utils", "SrcVersion": "2.12.0+ds1", "SrcRelease": "1", "Licenses": [ "MIT", "BSD-3-Clause" ], "Maintainer": "Debian Multimedia Maintainers \u003cdebian-multimedia@lists.debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14", "libva-drm2@2.17.0-1", "libva-wayland2@2.17.0-1", "libva-x11-2@2.17.0-1", "libva2@2.17.0-1", "libwayland-client0@1.21.0-1", "libx11-6@2:1.8.4-2+deb12u2" ], "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/bin/vainfo", "/usr/share/doc/vainfo/changelog.Debian.gz", "/usr/share/doc/vainfo/changelog.gz", "/usr/share/doc/vainfo/copyright", "/usr/share/man/man1/vainfo.1.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "x11-common@1:7.7+23", "Name": "x11-common", "Identifier": { "PURL": "pkg:deb/debian/x11-common@7.7%2B23?arch=all\u0026distro=debian-12.15\u0026epoch=1", "UID": "6567e98249a19cc9" }, "Version": "7.7+23", "Epoch": 1, "Arch": "all", "SrcName": "xorg", "SrcVersion": "7.7+23", "SrcEpoch": 1, "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/doc/x11-common/NEWS.Debian.gz", "/usr/share/doc/x11-common/changelog.Debian.old.gz", "/usr/share/doc/x11-common/changelog.gz", "/usr/share/doc/x11-common/copyright", "/usr/share/lintian/overrides/x11-common", "/usr/share/man/man5/Xsession.5.gz", "/usr/share/man/man5/Xsession.options.5.gz", "/usr/share/man/man5/Xsession.options.d.5.gz" ], "AnalyzedBy": "dpkg" }, { "ID": "xkb-data@2.35.1-1", "Name": "xkb-data", "Identifier": { "PURL": "pkg:deb/debian/xkb-data@2.35.1-1?arch=all\u0026distro=debian-12.15", "UID": "994407e7161159ea" }, "Version": "2.35.1", "Release": "1", "Arch": "all", "SrcName": "xkeyboard-config", "SrcVersion": "2.35.1", "SrcRelease": "1", "Maintainer": "Debian X Strike Force \u003cdebian-x@lists.debian.org\u003e", "Repository": { "Class": "official" }, "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "InstalledFiles": [ "/usr/share/X11/xkb/compat/README", "/usr/share/X11/xkb/compat/accessx", "/usr/share/X11/xkb/compat/basic", "/usr/share/X11/xkb/compat/caps", "/usr/share/X11/xkb/compat/complete", "/usr/share/X11/xkb/compat/iso9995", "/usr/share/X11/xkb/compat/japan", "/usr/share/X11/xkb/compat/ledcaps", "/usr/share/X11/xkb/compat/ledcompose", "/usr/share/X11/xkb/compat/lednum", "/usr/share/X11/xkb/compat/ledscroll", "/usr/share/X11/xkb/compat/level5", "/usr/share/X11/xkb/compat/misc", "/usr/share/X11/xkb/compat/mousekeys", "/usr/share/X11/xkb/compat/olpc", "/usr/share/X11/xkb/compat/pc", "/usr/share/X11/xkb/compat/pc98", "/usr/share/X11/xkb/compat/xfree86", "/usr/share/X11/xkb/compat/xtest", "/usr/share/X11/xkb/geometry/README", "/usr/share/X11/xkb/geometry/amiga", "/usr/share/X11/xkb/geometry/ataritt", "/usr/share/X11/xkb/geometry/chicony", "/usr/share/X11/xkb/geometry/dell", "/usr/share/X11/xkb/geometry/digital_vndr/lk", "/usr/share/X11/xkb/geometry/digital_vndr/pc", "/usr/share/X11/xkb/geometry/digital_vndr/unix", "/usr/share/X11/xkb/geometry/everex", "/usr/share/X11/xkb/geometry/fujitsu", "/usr/share/X11/xkb/geometry/hhk", "/usr/share/X11/xkb/geometry/hp", "/usr/share/X11/xkb/geometry/keytronic", "/usr/share/X11/xkb/geometry/kinesis", "/usr/share/X11/xkb/geometry/macintosh", "/usr/share/X11/xkb/geometry/microsoft", "/usr/share/X11/xkb/geometry/nec", "/usr/share/X11/xkb/geometry/nokia", "/usr/share/X11/xkb/geometry/northgate", "/usr/share/X11/xkb/geometry/pc", "/usr/share/X11/xkb/geometry/sanwa", "/usr/share/X11/xkb/geometry/sgi_vndr/O2", "/usr/share/X11/xkb/geometry/sgi_vndr/indigo", "/usr/share/X11/xkb/geometry/sgi_vndr/indy", "/usr/share/X11/xkb/geometry/sony", "/usr/share/X11/xkb/geometry/steelseries", "/usr/share/X11/xkb/geometry/sun", "/usr/share/X11/xkb/geometry/teck", "/usr/share/X11/xkb/geometry/thinkpad", "/usr/share/X11/xkb/geometry/typematrix", "/usr/share/X11/xkb/geometry/winbook", "/usr/share/X11/xkb/keycodes/README", "/usr/share/X11/xkb/keycodes/aliases", "/usr/share/X11/xkb/keycodes/amiga", "/usr/share/X11/xkb/keycodes/ataritt", "/usr/share/X11/xkb/keycodes/digital_vndr/lk", "/usr/share/X11/xkb/keycodes/digital_vndr/pc", "/usr/share/X11/xkb/keycodes/empty", "/usr/share/X11/xkb/keycodes/evdev", "/usr/share/X11/xkb/keycodes/fujitsu", "/usr/share/X11/xkb/keycodes/hp", "/usr/share/X11/xkb/keycodes/ibm", "/usr/share/X11/xkb/keycodes/jolla", "/usr/share/X11/xkb/keycodes/macintosh", "/usr/share/X11/xkb/keycodes/olpc", "/usr/share/X11/xkb/keycodes/sgi_vndr/indigo", "/usr/share/X11/xkb/keycodes/sgi_vndr/indy", "/usr/share/X11/xkb/keycodes/sgi_vndr/iris", "/usr/share/X11/xkb/keycodes/sony", "/usr/share/X11/xkb/keycodes/sun", "/usr/share/X11/xkb/keycodes/xfree86", "/usr/share/X11/xkb/keycodes/xfree98", "/usr/share/X11/xkb/rules/README", "/usr/share/X11/xkb/rules/base", "/usr/share/X11/xkb/rules/base.extras.xml", "/usr/share/X11/xkb/rules/base.lst", "/usr/share/X11/xkb/rules/base.xml", "/usr/share/X11/xkb/rules/evdev", "/usr/share/X11/xkb/rules/evdev.extras.xml", "/usr/share/X11/xkb/rules/evdev.lst", "/usr/share/X11/xkb/rules/evdev.xml", "/usr/share/X11/xkb/rules/xfree98", "/usr/share/X11/xkb/rules/xkb.dtd", "/usr/share/X11/xkb/symbols/af", "/usr/share/X11/xkb/symbols/al", "/usr/share/X11/xkb/symbols/altwin", "/usr/share/X11/xkb/symbols/am", "/usr/share/X11/xkb/symbols/apl", "/usr/share/X11/xkb/symbols/ara", "/usr/share/X11/xkb/symbols/at", "/usr/share/X11/xkb/symbols/au", "/usr/share/X11/xkb/symbols/az", "/usr/share/X11/xkb/symbols/ba", "/usr/share/X11/xkb/symbols/bd", "/usr/share/X11/xkb/symbols/be", "/usr/share/X11/xkb/symbols/bg", "/usr/share/X11/xkb/symbols/br", "/usr/share/X11/xkb/symbols/brai", "/usr/share/X11/xkb/symbols/bt", "/usr/share/X11/xkb/symbols/bw", "/usr/share/X11/xkb/symbols/by", "/usr/share/X11/xkb/symbols/ca", "/usr/share/X11/xkb/symbols/capslock", "/usr/share/X11/xkb/symbols/cd", "/usr/share/X11/xkb/symbols/ch", "/usr/share/X11/xkb/symbols/cm", "/usr/share/X11/xkb/symbols/cn", "/usr/share/X11/xkb/symbols/compose", "/usr/share/X11/xkb/symbols/ctrl", "/usr/share/X11/xkb/symbols/cz", "/usr/share/X11/xkb/symbols/de", "/usr/share/X11/xkb/symbols/digital_vndr/lk", "/usr/share/X11/xkb/symbols/digital_vndr/pc", "/usr/share/X11/xkb/symbols/digital_vndr/us", "/usr/share/X11/xkb/symbols/digital_vndr/vt", "/usr/share/X11/xkb/symbols/dk", "/usr/share/X11/xkb/symbols/dz", "/usr/share/X11/xkb/symbols/ee", "/usr/share/X11/xkb/symbols/eg", "/usr/share/X11/xkb/symbols/empty", "/usr/share/X11/xkb/symbols/epo", "/usr/share/X11/xkb/symbols/es", "/usr/share/X11/xkb/symbols/et", "/usr/share/X11/xkb/symbols/eu", "/usr/share/X11/xkb/symbols/eurosign", "/usr/share/X11/xkb/symbols/fi", "/usr/share/X11/xkb/symbols/fo", "/usr/share/X11/xkb/symbols/fr", "/usr/share/X11/xkb/symbols/fujitsu_vndr/jp", "/usr/share/X11/xkb/symbols/fujitsu_vndr/us", "/usr/share/X11/xkb/symbols/gb", "/usr/share/X11/xkb/symbols/ge", "/usr/share/X11/xkb/symbols/gh", "/usr/share/X11/xkb/symbols/gn", "/usr/share/X11/xkb/symbols/gr", "/usr/share/X11/xkb/symbols/group", "/usr/share/X11/xkb/symbols/hp_vndr/us", "/usr/share/X11/xkb/symbols/hr", "/usr/share/X11/xkb/symbols/hu", "/usr/share/X11/xkb/symbols/id", "/usr/share/X11/xkb/symbols/ie", "/usr/share/X11/xkb/symbols/il", "/usr/share/X11/xkb/symbols/in", "/usr/share/X11/xkb/symbols/inet", "/usr/share/X11/xkb/symbols/iq", "/usr/share/X11/xkb/symbols/ir", "/usr/share/X11/xkb/symbols/is", "/usr/share/X11/xkb/symbols/it", "/usr/share/X11/xkb/symbols/jolla_vndr/sbj", "/usr/share/X11/xkb/symbols/jp", "/usr/share/X11/xkb/symbols/jv", "/usr/share/X11/xkb/symbols/ke", "/usr/share/X11/xkb/symbols/keypad", "/usr/share/X11/xkb/symbols/kg", "/usr/share/X11/xkb/symbols/kh", "/usr/share/X11/xkb/symbols/kpdl", "/usr/share/X11/xkb/symbols/kr", "/usr/share/X11/xkb/symbols/kz", "/usr/share/X11/xkb/symbols/la", "/usr/share/X11/xkb/symbols/latam", "/usr/share/X11/xkb/symbols/latin", "/usr/share/X11/xkb/symbols/level2", "/usr/share/X11/xkb/symbols/level3", "/usr/share/X11/xkb/symbols/level5", "/usr/share/X11/xkb/symbols/lk", "/usr/share/X11/xkb/symbols/lt", "/usr/share/X11/xkb/symbols/lv", "/usr/share/X11/xkb/symbols/ma", "/usr/share/X11/xkb/symbols/macintosh_vndr/apple", "/usr/share/X11/xkb/symbols/macintosh_vndr/ch", "/usr/share/X11/xkb/symbols/macintosh_vndr/de", "/usr/share/X11/xkb/symbols/macintosh_vndr/dk", "/usr/share/X11/xkb/symbols/macintosh_vndr/fi", "/usr/share/X11/xkb/symbols/macintosh_vndr/fr", "/usr/share/X11/xkb/symbols/macintosh_vndr/gb", "/usr/share/X11/xkb/symbols/macintosh_vndr/is", "/usr/share/X11/xkb/symbols/macintosh_vndr/it", "/usr/share/X11/xkb/symbols/macintosh_vndr/jp", "/usr/share/X11/xkb/symbols/macintosh_vndr/latam", "/usr/share/X11/xkb/symbols/macintosh_vndr/nl", "/usr/share/X11/xkb/symbols/macintosh_vndr/no", "/usr/share/X11/xkb/symbols/macintosh_vndr/pt", "/usr/share/X11/xkb/symbols/macintosh_vndr/se", "/usr/share/X11/xkb/symbols/macintosh_vndr/us", "/usr/share/X11/xkb/symbols/mao", "/usr/share/X11/xkb/symbols/md", "/usr/share/X11/xkb/symbols/me", "/usr/share/X11/xkb/symbols/mk", "/usr/share/X11/xkb/symbols/ml", "/usr/share/X11/xkb/symbols/mm", "/usr/share/X11/xkb/symbols/mn", "/usr/share/X11/xkb/symbols/mt", "/usr/share/X11/xkb/symbols/mv", "/usr/share/X11/xkb/symbols/my", "/usr/share/X11/xkb/symbols/nbsp", "/usr/share/X11/xkb/symbols/nec_vndr/jp", "/usr/share/X11/xkb/symbols/ng", "/usr/share/X11/xkb/symbols/nl", "/usr/share/X11/xkb/symbols/no", "/usr/share/X11/xkb/symbols/nokia_vndr/rx-44", "/usr/share/X11/xkb/symbols/nokia_vndr/rx-51", "/usr/share/X11/xkb/symbols/nokia_vndr/su-8w", "/usr/share/X11/xkb/symbols/np", "/usr/share/X11/xkb/symbols/olpc", "/usr/share/X11/xkb/symbols/parens", "/usr/share/X11/xkb/symbols/pc", "/usr/share/X11/xkb/symbols/ph", "/usr/share/X11/xkb/symbols/pk", "/usr/share/X11/xkb/symbols/pl", "/usr/share/X11/xkb/symbols/pt", "/usr/share/X11/xkb/symbols/ro", "/usr/share/X11/xkb/symbols/rs", "/usr/share/X11/xkb/symbols/ru", "/usr/share/X11/xkb/symbols/rupeesign", "/usr/share/X11/xkb/symbols/se", "/usr/share/X11/xkb/symbols/sgi_vndr/jp", "/usr/share/X11/xkb/symbols/sharp_vndr/sl-c3x00", "/usr/share/X11/xkb/symbols/sharp_vndr/ws003sh", "/usr/share/X11/xkb/symbols/sharp_vndr/ws007sh", "/usr/share/X11/xkb/symbols/sharp_vndr/ws011sh", "/usr/share/X11/xkb/symbols/sharp_vndr/ws020sh", "/usr/share/X11/xkb/symbols/shift", "/usr/share/X11/xkb/symbols/si", "/usr/share/X11/xkb/symbols/sk", "/usr/share/X11/xkb/symbols/sn", "/usr/share/X11/xkb/symbols/sony_vndr/us", "/usr/share/X11/xkb/symbols/srvr_ctrl", "/usr/share/X11/xkb/symbols/sun_vndr/ara", "/usr/share/X11/xkb/symbols/sun_vndr/be", "/usr/share/X11/xkb/symbols/sun_vndr/br", "/usr/share/X11/xkb/symbols/sun_vndr/ca", "/usr/share/X11/xkb/symbols/sun_vndr/ch", "/usr/share/X11/xkb/symbols/sun_vndr/cz", "/usr/share/X11/xkb/symbols/sun_vndr/de", "/usr/share/X11/xkb/symbols/sun_vndr/dk", "/usr/share/X11/xkb/symbols/sun_vndr/ee", "/usr/share/X11/xkb/symbols/sun_vndr/es", "/usr/share/X11/xkb/symbols/sun_vndr/fi", "/usr/share/X11/xkb/symbols/sun_vndr/fr", "/usr/share/X11/xkb/symbols/sun_vndr/gb", "/usr/share/X11/xkb/symbols/sun_vndr/gr", "/usr/share/X11/xkb/symbols/sun_vndr/it", "/usr/share/X11/xkb/symbols/sun_vndr/jp", "/usr/share/X11/xkb/symbols/sun_vndr/kr", "/usr/share/X11/xkb/symbols/sun_vndr/lt", "/usr/share/X11/xkb/symbols/sun_vndr/lv", "/usr/share/X11/xkb/symbols/sun_vndr/nl", "/usr/share/X11/xkb/symbols/sun_vndr/no", "/usr/share/X11/xkb/symbols/sun_vndr/pl", "/usr/share/X11/xkb/symbols/sun_vndr/pt", "/usr/share/X11/xkb/symbols/sun_vndr/ro", "/usr/share/X11/xkb/symbols/sun_vndr/ru", "/usr/share/X11/xkb/symbols/sun_vndr/se", "/usr/share/X11/xkb/symbols/sun_vndr/sk", "/usr/share/X11/xkb/symbols/sun_vndr/solaris", "/usr/share/X11/xkb/symbols/sun_vndr/tr", "/usr/share/X11/xkb/symbols/sun_vndr/tw", "/usr/share/X11/xkb/symbols/sun_vndr/ua", "/usr/share/X11/xkb/symbols/sun_vndr/us", "/usr/share/X11/xkb/symbols/sy", "/usr/share/X11/xkb/symbols/terminate", "/usr/share/X11/xkb/symbols/tg", "/usr/share/X11/xkb/symbols/th", "/usr/share/X11/xkb/symbols/tj", "/usr/share/X11/xkb/symbols/tm", "/usr/share/X11/xkb/symbols/tr", "/usr/share/X11/xkb/symbols/trans", "/usr/share/X11/xkb/symbols/tw", "/usr/share/X11/xkb/symbols/typo", "/usr/share/X11/xkb/symbols/tz", "/usr/share/X11/xkb/symbols/ua", "/usr/share/X11/xkb/symbols/us", "/usr/share/X11/xkb/symbols/uz", "/usr/share/X11/xkb/symbols/vn", "/usr/share/X11/xkb/symbols/xfree68_vndr/amiga", "/usr/share/X11/xkb/symbols/xfree68_vndr/ataritt", "/usr/share/X11/xkb/symbols/za", "/usr/share/X11/xkb/types/README", "/usr/share/X11/xkb/types/basic", "/usr/share/X11/xkb/types/cancel", "/usr/share/X11/xkb/types/caps", "/usr/share/X11/xkb/types/complete", "/usr/share/X11/xkb/types/default", "/usr/share/X11/xkb/types/extra", "/usr/share/X11/xkb/types/iso9995", "/usr/share/X11/xkb/types/level5", "/usr/share/X11/xkb/types/mousekeys", "/usr/share/X11/xkb/types/nokia", "/usr/share/X11/xkb/types/numpad", "/usr/share/X11/xkb/types/pc", "/usr/share/doc/xkb-data/NEWS.Debian.gz", "/usr/share/doc/xkb-data/README.Debian", "/usr/share/doc/xkb-data/changelog.Debian.gz", "/usr/share/doc/xkb-data/changelog.gz", "/usr/share/doc/xkb-data/copyright", "/usr/share/locale/af/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ar/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/az/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/bg/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ca/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/crh/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/cs/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/da/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/de/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/el/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/en_GB/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/eo/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/es/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/fi/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/fr/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/fur/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/gl/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/he/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/hr/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/hu/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/id/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/it/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ja/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ka/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ko/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ky/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/lt/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/nb/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/nl/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/pl/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/pt/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/pt_BR/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ro/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/ru/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/rw/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sk/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sl/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sq/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sr/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/sv/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/tr/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/uk/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/vi/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/zh_CN/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/locale/zh_TW/LC_MESSAGES/xkeyboard-config.mo", "/usr/share/man/man7/xkeyboard-config.7.gz", "/usr/share/pkgconfig/xkeyboard-config.pc" ], "AnalyzedBy": "dpkg" }, { "ID": "zlib1g@1:1.2.13.dfsg-1", "Name": "zlib1g", "Identifier": { "PURL": "pkg:deb/debian/zlib1g@1.2.13.dfsg-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "c3a50d0cd388a7b8" }, "Version": "1.2.13.dfsg", "Release": "1", "Epoch": 1, "Arch": "amd64", "SrcName": "zlib", "SrcVersion": "1.2.13.dfsg", "SrcRelease": "1", "SrcEpoch": 1, "Licenses": [ "Zlib" ], "Maintainer": "Mark Brown \u003cbroonie@debian.org\u003e", "Repository": { "Class": "official" }, "DependsOn": [ "libc6@2.36-9+deb12u14" ], "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "InstalledFiles": [ "/lib/x86_64-linux-gnu/libz.so.1.2.13", "/usr/share/doc/zlib1g/changelog.Debian.gz", "/usr/share/doc/zlib1g/changelog.gz", "/usr/share/doc/zlib1g/copyright" ], "AnalyzedBy": "dpkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2011-3374", "PkgID": "apt@2.6.1", "PkgName": "apt", "PkgIdentifier": { "PURL": "pkg:deb/debian/apt@2.6.1?arch=amd64\u0026distro=debian-12.15", "UID": "48017cded9d6e9b5" }, "InstalledVersion": "2.6.1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-3374", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4a6305b3f4a0b91bc4738d37f4494fac7f87101e0c7c8fe5f3e1f9c6bd12bd0c", "Title": "It was found that apt-key in apt, all versions, do not correctly valid ...", "Description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.", "Severity": "LOW", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "debian": 1, "nvd": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V2Score": 4.3, "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/cve-2011-3374", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480", "https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html", "https://seclists.org/fulldisclosure/2011/Sep/221", "https://security-tracker.debian.org/tracker/CVE-2011-3374", "https://snyk.io/vuln/SNYK-LINUX-APT-116518", "https://ubuntu.com/security/CVE-2011-3374" ], "PublishedDate": "2019-11-26T00:15:11.03Z", "LastModifiedDate": "2024-11-21T01:30:22.61Z" }, { "VulnerabilityID": "TEMP-0841856-B18BAF", "PkgID": "bash@5.2.15-2+b13", "PkgName": "bash", "PkgIdentifier": { "PURL": "pkg:deb/debian/bash@5.2.15-2%2Bb13?arch=amd64\u0026distro=debian-12.15", "UID": "571283fff037d17a" }, "InstalledVersion": "5.2.15-2+b13", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0841856-B18BAF", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d556b56bdd202faba974fed2830b21831b9e43f1fb6285c6147e3ee199dd1e93", "Title": "[Privilege escalation possible to other user than root]", "Severity": "LOW", "VendorSeverity": { "debian": 1 } }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "bsdutils@1:2.38.1-5+deb12u3", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "af5a434542493ff" }, "InstalledVersion": "1:2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f89c41e8ca29761ab6c9692077b60a9fd2b31af01394e007df86fd2d632dd474", "Title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "Description": "Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:\nCVE-2026-53615:\n\tInteger Overflow or Wraparound in libblkid/src/partitions/dos.c\n", "Severity": "HIGH", "VendorSeverity": { "amazon": 3 } }, { "VulnerabilityID": "CVE-2026-13595", "PkgID": "bsdutils@1:2.38.1-5+deb12u3", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "af5a434542493ff" }, "InstalledVersion": "1:2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13595", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:84befcd6bd9e6c974c5446fc091741c70fb914f23e8fc4e99b76d31c376223cc", "Title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "Description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26573", "https://access.redhat.com/security/cve/CVE-2026-13595", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c", "https://nvd.nist.gov/vuln/detail/CVE-2026-13595", "https://www.cve.org/CVERecord?id=CVE-2026-13595" ], "PublishedDate": "2026-06-29T09:16:28.303Z", "LastModifiedDate": "2026-07-08T03:37:21.637Z" }, { "VulnerabilityID": "CVE-2026-27456", "PkgID": "bsdutils@1:2.38.1-5+deb12u3", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "af5a434542493ff" }, "InstalledVersion": "1:2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:59cbd19e8a49b868725ff3500522a960c43f383dbdd019fdd83c2025b55966c9", "Title": "util-linux: TOCTOU in the mount program when setting up loop devices", "Description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "Severity": "MEDIUM", "CweIDs": [ "CWE-59", "CWE-269", "CWE-367" ], "VendorSeverity": { "azure": 2, "bottlerocket": 2, "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://access.redhat.com/security/cve/CVE-2026-27456", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-jgcxwcxt3sxd.toml", "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g", "https://nvd.nist.gov/vuln/detail/CVE-2026-27456", "https://www.cve.org/CVERecord?id=CVE-2026-27456" ], "PublishedDate": "2026-04-03T22:16:25.4Z", "LastModifiedDate": "2026-07-24T22:10:00.14Z" }, { "VulnerabilityID": "CVE-2026-3184", "PkgID": "bsdutils@1:2.38.1-5+deb12u3", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "af5a434542493ff" }, "InstalledVersion": "1:2.38.1-5+deb12u3", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-3184", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d0e2b6a487bcf39298f2613ade3cee43fbcc258aad89ef0f991b55b5380424cf", "Title": "util-linux: util-linux: Access control bypass due to improper hostname canonicalization", "Description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "Severity": "MEDIUM", "CweIDs": [ "CWE-289" ], "VendorSeverity": { "azure": 1, "nvd": 2, "photon": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2026-3184", "https://bugzilla.redhat.com/show_bug.cgi?id=2442570", "https://nvd.nist.gov/vuln/detail/CVE-2026-3184", "https://www.cve.org/CVERecord?id=CVE-2026-3184" ], "PublishedDate": "2026-04-03T19:17:23.377Z", "LastModifiedDate": "2026-07-21T19:10:00.107Z" }, { "VulnerabilityID": "CVE-2022-0563", "PkgID": "bsdutils@1:2.38.1-5+deb12u3", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "af5a434542493ff" }, "InstalledVersion": "1:2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b91adf2222308cf104662b25dd5e0bd7d56021c35d692b88798c89fe610765fc", "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", "Severity": "LOW", "CweIDs": [ "CWE-209" ], "VendorSeverity": { "amazon": 2, "bottlerocket": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 }, "nvd": { "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V2Score": 1.9, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0563", "https://access.redhat.com/security/cve/CVE-2022-0563", "https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-mv4q-wq4c-5xmg", "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", "https://security.gentoo.org/glsa/202401-08", "https://security.netapp.com/advisory/ntap-20220331-0002/", "https://www.cve.org/CVERecord?id=CVE-2022-0563" ], "PublishedDate": "2022-02-21T19:15:08.393Z", "LastModifiedDate": "2026-06-17T04:20:51.053Z" }, { "VulnerabilityID": "CVE-2025-14104", "PkgID": "bsdutils@1:2.38.1-5+deb12u3", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "af5a434542493ff" }, "InstalledVersion": "1:2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-14104", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a12457243701641f96759e75b8669ea8ec9288518ea5d001756a4b85ec204e25", "Title": "util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames", "Description": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1696", "https://access.redhat.com/errata/RHSA-2026:1852", "https://access.redhat.com/errata/RHSA-2026:1913", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2737", "https://access.redhat.com/errata/RHSA-2026:2800", "https://access.redhat.com/errata/RHSA-2026:3406", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2025-14104", "https://bugzilla.redhat.com/2419369", "https://bugzilla.redhat.com/show_bug.cgi?id=2419369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14104", "https://errata.almalinux.org/9/ALSA-2026-1913.html", "https://errata.rockylinux.org/RLSA-2026:1913", "https://linux.oracle.com/cve/CVE-2025-14104.html", "https://linux.oracle.com/errata/ELSA-2026-1913.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-14104", "https://www.cve.org/CVERecord?id=CVE-2025-14104" ], "PublishedDate": "2025-12-05T17:16:03.117Z", "LastModifiedDate": "2026-06-30T00:16:53.04Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "bsdutils@1:2.38.1-5+deb12u3", "PkgName": "bsdutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/bsdutils@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "af5a434542493ff" }, "InstalledVersion": "1:2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bb551850354ac70d16786f64d368b2f215829529792d9052b691c47ce52f0ef6", "Title": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2016-2781", "PkgID": "coreutils@9.1-1", "PkgName": "coreutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12.15", "UID": "4dcfd69f3b62ab36" }, "InstalledVersion": "9.1-1", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-2781", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:acc057d4c52a407d126454878fd794acfab70264596a43e20a80f78a40091034", "Title": "coreutils: Non-privileged session can escape to the parent session in chroot", "Description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.", "Severity": "LOW", "CweIDs": [ "CWE-20" ], "VendorSeverity": { "azure": 2, "cbl-mariner": 2, "debian": 1, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "V2Score": 2.1, "V3Score": 6.5 }, "redhat": { "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C", "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "V2Score": 6.2, "V3Score": 8.6 } }, "References": [ "http://www.openwall.com/lists/oss-security/2016/02/28/2", "http://www.openwall.com/lists/oss-security/2016/02/28/3", "https://access.redhat.com/security/cve/CVE-2016-2781", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2016-2781", "https://www.cve.org/CVERecord?id=CVE-2016-2781" ], "PublishedDate": "2017-02-07T15:59:00.333Z", "LastModifiedDate": "2026-06-17T00:44:23.16Z" }, { "VulnerabilityID": "CVE-2017-18018", "PkgID": "coreutils@9.1-1", "PkgName": "coreutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12.15", "UID": "4dcfd69f3b62ab36" }, "InstalledVersion": "9.1-1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-18018", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3f12e323efac8e70d04e93fa291191048dd71fb5927a992aae6adacb55e41fa7", "Title": "coreutils: race condition vulnerability in chown and chgrp", "Description": "In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.", "Severity": "LOW", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "V2Score": 1.9, "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "V3Score": 4.2 } }, "References": [ "http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html", "https://access.redhat.com/security/cve/CVE-2017-18018", "https://nvd.nist.gov/vuln/detail/CVE-2017-18018", "https://www.cve.org/CVERecord?id=CVE-2017-18018" ], "PublishedDate": "2018-01-04T04:29:00.19Z", "LastModifiedDate": "2026-06-17T01:12:02.94Z" }, { "VulnerabilityID": "CVE-2025-5278", "PkgID": "coreutils@9.1-1", "PkgName": "coreutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12.15", "UID": "4dcfd69f3b62ab36" }, "InstalledVersion": "9.1-1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-5278", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:88ef7a498c48c2e808ef7371c6c1722f59d5a34fb3889bfbb58c6182aee03a4a", "Title": "coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification", "Description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.", "Severity": "LOW", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "alma": 2, "amazon": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "V3Score": 4.4 } }, "References": [ "http://www.openwall.com/lists/oss-security/2025/05/27/2", "http://www.openwall.com/lists/oss-security/2025/05/29/1", "http://www.openwall.com/lists/oss-security/2025/05/29/2", "https://access.redhat.com/errata/RHSA-2026:28911", "https://access.redhat.com/errata/RHSA-2026:33124", "https://access.redhat.com/errata/RHSA-2026:33313", "https://access.redhat.com/errata/RHSA-2026:33612", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44481", "https://access.redhat.com/errata/RHSA-2026:46836", "https://access.redhat.com/security/cve/CVE-2025-5278", "https://bugzilla.redhat.com/2368764", "https://bugzilla.redhat.com/show_bug.cgi?id=2368764", "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633", "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5278", "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507", "https://errata.almalinux.org/9/ALSA-2026-28911.html", "https://errata.rockylinux.org/RLSA-2026:28911", "https://linux.oracle.com/cve/CVE-2025-5278.html", "https://linux.oracle.com/errata/ELSA-2026-33124.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-5278", "https://security-tracker.debian.org/tracker/CVE-2025-5278", "https://www.cve.org/CVERecord?id=CVE-2025-5278" ], "PublishedDate": "2025-05-27T21:15:23.197Z", "LastModifiedDate": "2026-07-27T18:16:50.13Z" }, { "VulnerabilityID": "CVE-2026-56391", "PkgID": "coreutils@9.1-1", "PkgName": "coreutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12.15", "UID": "4dcfd69f3b62ab36" }, "InstalledVersion": "9.1-1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56391", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ac1423f3c98dbbcfff3944fd6ac68b0a5f3c8dec550c49574d1ee72768efad9b", "Title": "coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input", "Description": "GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "debian": 1, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56391", "https://cert.pl/en/posts/2026/07/CVE-2026-56391", "https://git.savannah.gnu.org/cgit/coreutils.git/", "https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371", "https://nvd.nist.gov/vuln/detail/CVE-2026-56391", "https://www.cve.org/CVERecord?id=CVE-2026-56391" ], "PublishedDate": "2026-07-24T09:16:25.003Z", "LastModifiedDate": "2026-07-24T13:18:27.743Z" }, { "VulnerabilityID": "CVE-2026-56392", "PkgID": "coreutils@9.1-1", "PkgName": "coreutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12.15", "UID": "4dcfd69f3b62ab36" }, "InstalledVersion": "9.1-1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56392", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:94031c4b3c6653529321b948455cfe71e92ea3a1e954b211aa188061ad7f4241", "Title": "coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values", "Description": "GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d", "Severity": "LOW", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "debian": 1, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "V3Score": 4.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56392", "https://cert.pl/en/posts/2026/07/CVE-2026-56391", "https://git.savannah.gnu.org/cgit/coreutils.git/", "https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d", "https://nvd.nist.gov/vuln/detail/CVE-2026-56392", "https://www.cve.org/CVERecord?id=CVE-2026-56392" ], "PublishedDate": "2026-07-24T09:16:25.147Z", "LastModifiedDate": "2026-07-24T13:18:27.907Z" }, { "VulnerabilityID": "CVE-2026-53910", "PkgID": "diffutils@1:3.8-4", "PkgName": "diffutils", "PkgIdentifier": { "PURL": "pkg:deb/debian/diffutils@3.8-4?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "88676a587026548b" }, "InstalledVersion": "1:3.8-4", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53910", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9caebaef85656d6c69f830c953810b72aa019a0f9baf1321a332085306e75133", "Title": "diff3tool from GNU diffutilsis vulnerable to a heap\\u2011based buffer ...", "Description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds.\nWhen processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing. \nAn attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.\n\n\nThis issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815 \n\nNOTE:\nThe project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "Severity": "LOW", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "debian": 1 }, "References": [ "https://cert.pl/en/posts/2026/07/CVE-2026-53910", "https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50", "https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815", "https://git.savannah.gnu.org/cgit/diffutils.git/" ], "PublishedDate": "2026-07-22T14:17:21.03Z", "LastModifiedDate": "2026-07-27T12:16:45.25Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e4bdfc4fd6800882bcb474b817057d953ae62619f057e6428980a0033eb0b068", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-07-23T12:18:30.933Z" }, { "VulnerabilityID": "CVE-2026-64831", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64831", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2f759a286cbf31c4b2fd466ef735f57c656cdab47b1121949e13ae9989b0c943", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted HEVC/H.265 bitstream", "Description": "FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64831", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665", "https://nvd.nist.gov/vuln/detail/CVE-2026-64831", "https://www.cve.org/CVERecord?id=CVE-2026-64831", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder" ], "PublishedDate": "2026-07-22T17:16:58.697Z", "LastModifiedDate": "2026-07-23T14:17:40.63Z" }, { "VulnerabilityID": "CVE-2026-8461", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:024a08f8930945e24d249e4c47bdf66ca133391be60ee1313df09318c71fd6c7", "Title": "ffmpeg: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder", "Description": "An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-8461", "https://bugzilla.redhat.com/show_bug.cgi?id=2490308", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159", "https://github.com/advisories/GHSA-qff7-4q6c-m8h6", "https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/", "https://nvd.nist.gov/vuln/detail/CVE-2026-8461", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json", "https://www.cve.org/CVERecord?id=CVE-2026-8461" ], "PublishedDate": "2026-06-18T14:17:36.66Z", "LastModifiedDate": "2026-07-23T12:18:51.763Z" }, { "VulnerabilityID": "CVE-2023-49528", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-49528", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a645767e1e2792662c7b3712e5ff4207778f805f12e628f013f8f776ba01c8bc", "Title": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, al ...", "Description": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component.", "Severity": "MEDIUM", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "ubuntu": 2 }, "References": [ "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://trac.ffmpeg.org/ticket/10691", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2023-49528" ], "PublishedDate": "2024-04-12T06:15:06.32Z", "LastModifiedDate": "2026-06-17T06:36:05.573Z" }, { "VulnerabilityID": "CVE-2023-6601", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6601", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:375f94f9d349be59833cbd9ba9ffb2043370cb830303cf9d97c2c599da409179", "Title": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows by ...", "Description": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-99", "CWE-94" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://bugzilla.redhat.com/show_bug.cgi?id=2253172", "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html", "https://www.cve.org/CVERecord?id=CVE-2023-6601" ], "PublishedDate": "2025-01-06T17:15:14.217Z", "LastModifiedDate": "2026-06-17T06:51:04.107Z" }, { "VulnerabilityID": "CVE-2024-31578", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-31578", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9194efb93e6210eafdfd8ffad563a729c6959675561e4012ece59f8e79c57af5", "Title": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free ...", "Description": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "julia": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179", "https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7", "https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2024-31578" ], "PublishedDate": "2024-04-17T14:15:08.563Z", "LastModifiedDate": "2026-06-17T07:28:36.03Z" }, { "VulnerabilityID": "CVE-2024-35369", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-35369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:01a1e87558338345ce6b13d86c5a2b047c11383407c2a46a6f7108f9446a2be6", "Title": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c m ...", "Description": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8", "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423", "https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c" ], "PublishedDate": "2024-11-29T17:15:07.707Z", "LastModifiedDate": "2026-06-17T07:34:49.86Z" }, { "VulnerabilityID": "CVE-2025-10256", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-10256", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cf349cd9b2ea5f387fc28c020d7031caae51c57d2e0b212d83d8b71fac3b9dcd", "Title": "ffmpeg: NULL pointer dereference in Firequalizer filter (libavfilter/af_firequalizer.c)", "Description": "A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-10256", "https://bugzilla.redhat.com/show_bug.cgi?id=2394495", "https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931", "https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a", "https://nvd.nist.gov/vuln/detail/CVE-2025-10256", "https://ubuntu.com/security/notices/USN-7830-1", "https://www.cve.org/CVERecord?id=CVE-2025-10256" ], "PublishedDate": "2026-02-18T21:16:20.183Z", "LastModifiedDate": "2026-06-17T08:28:00.503Z" }, { "VulnerabilityID": "CVE-2025-22921", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:46113bd4eb2e7b1c2f11ae7b42c030d4a4dec006642e7866ee82fedfa9eeb883", "Title": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a seg ...", "Description": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html", "https://trac.ffmpeg.org/ticket/11393", "https://ubuntu.com/security/notices/USN-7538-1", "https://www.cve.org/CVERecord?id=CVE-2025-22921" ], "PublishedDate": "2025-02-18T22:15:18.04Z", "LastModifiedDate": "2026-06-17T08:50:59.503Z" }, { "VulnerabilityID": "CVE-2026-6385", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6385", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d913af56cfb98644205ba4884cdb77ea4c7527663ab6993b2d895dc72711ed4f", "Title": "ffmpeg: FFmpeg: Denial of Service and potential arbitrary code execution via signed integer overflow in DVD subtitle parser", "Description": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-6385", "https://bugzilla.redhat.com/show_bug.cgi?id=2458764", "https://nvd.nist.gov/vuln/detail/CVE-2026-6385", "https://www.cve.org/CVERecord?id=CVE-2026-6385" ], "PublishedDate": "2026-04-15T20:16:44.23Z", "LastModifiedDate": "2026-06-17T11:00:45.583Z" }, { "VulnerabilityID": "CVE-2026-65703", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65703", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0097c2522b1934d2463e19b6c85172a54787592802cadfbbb4d984b40142303d", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via crafted AVI file in TDSC video decoder", "Description": "FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65703", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773", "https://nvd.nist.gov/vuln/detail/CVE-2026-65703", "https://www.cve.org/CVERecord?id=CVE-2026-65703", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder" ], "PublishedDate": "2026-07-23T20:17:21.803Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65704", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65704", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6bd24e9b175d85c38faf4c71ec25bbdb526019ee544726f8a8a732842c235c3e", "Title": "ffmpeg: FFmpeg: Heap corruption via crafted ffconcat file can lead to arbitrary code execution", "Description": "FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.", "Severity": "MEDIUM", "CweIDs": [ "CWE-191", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65704", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767", "https://nvd.nist.gov/vuln/detail/CVE-2026-65704", "https://www.cve.org/CVERecord?id=CVE-2026-65704", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder" ], "PublishedDate": "2026-07-23T20:17:21.973Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65705", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65705", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6d21aae8309cd95531640e2604e176d9eebe7bc9af4451ebc11c1e41db6249f6", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via out-of-bounds write in vf_floodfill video filter", "Description": "FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65705", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780", "https://nvd.nist.gov/vuln/detail/CVE-2026-65705", "https://www.cve.org/CVERecord?id=CVE-2026-65705", "https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame" ], "PublishedDate": "2026-07-23T20:17:22.12Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65706", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65706", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9ba5fd87b94fddcd181d66e26d64e6ba8723d99248169c0de59ec07a02c175db", "Title": "FFmpeg: FFmpeg: Arbitrary Code Execution via Crafted Video Frame", "Description": "FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65706", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779", "https://nvd.nist.gov/vuln/detail/CVE-2026-65706", "https://www.cve.org/CVERecord?id=CVE-2026-65706", "https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing" ], "PublishedDate": "2026-07-23T20:17:22.257Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-30999", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-30999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d767db3a1ef920dbd6b261eb4b90a12adea75483f00c937a2890b305e92a2b12", "Title": "FFmpeg: FFmpeg: Denial of Service via heap buffer overflow in av_bprint_finalize()", "Description": "A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.", "Severity": "LOW", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "debian": 1, "julia": 3, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-30999", "https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6", "https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html", "https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c", "https://nvd.nist.gov/vuln/detail/CVE-2026-30999", "https://www.cve.org/CVERecord?id=CVE-2026-30999", "https://www.ffmpeg.org/download.html" ], "PublishedDate": "2026-04-13T15:17:32.827Z", "LastModifiedDate": "2026-06-17T10:33:17.66Z" }, { "VulnerabilityID": "CVE-2024-36615", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-36615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d21bdabd7c9266d21817e9433fb5dbe3e638779b4f84cddff2afdd58f6922a3c", "Title": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Thi ...", "Description": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-362" ], "References": [ "https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb", "https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738", "https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61" ], "PublishedDate": "2024-11-29T19:15:07.703Z", "LastModifiedDate": "2026-06-17T07:37:01.797Z" }, { "VulnerabilityID": "CVE-2026-13858", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13858", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5c6e848adce659ab57131ba9d00b1325fa5cf5b753bb31133a8f06d39fe6d831", "Title": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 a ...", "Description": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html", "https://issues.chromium.org/issues/507090179" ], "PublishedDate": "2026-06-30T23:17:00.22Z", "LastModifiedDate": "2026-07-01T15:36:19.657Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ffea657f983abee0fe8007c29bfeac638293669eaa204ff216a7f76645116db5", "Title": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vuln ...", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:602d648ef63bc6122fbaa846ae883b918b8a305ec776394490d5a6eaaf96fdc6", "Title": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-415" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f002ad8aabba6757ded6b010f56c5060c22a96fe172308dc08d709206d8b2381", "Title": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vuln ...", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0a14c7e1e2d2349ed1221153f1e6d07687790b70c54471162eef7f8647069def", "Title": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerabi ...", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-835" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-07-23T16:17:49.397Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:44ac7bb5764a009ed0081feac4811e0c4cff8107cfd44cf0147728f473a06295", "Title": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory acce ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-07-23T14:17:41.17Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3c09f40ffb091b9ecc05d08612167cf04bff80d6e88b0974a7a86aad907566a0", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66037", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66037", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d85ad0294af76cf96cb8e45bd78ac9daaa43fe9bad5dd8a1aef17687d37b6c2f", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolle ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-770" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627", "https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu" ], "PublishedDate": "2026-07-24T20:18:20.573Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66038", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66038", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:facffbc37a4b578579ce9b2ea26e9588285f48cf87e74949a8c1f58eaed15955", "Title": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information ...", "Description": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-908" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626", "https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c" ], "PublishedDate": "2026-07-24T20:18:20.727Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c292793bf444dfa3d57e6e3530a80f4adae05b29b99076b8ecee245695deced3", "Title": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integ ...", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122", "CWE-190" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:da53bfc14ec50f952ae778bb163c4f46199021c2f94d1700cb817bf71a43afc4", "Title": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "ffmpeg@7:5.1.9-0+deb12u1", "PkgName": "ffmpeg", "PkgIdentifier": { "PURL": "pkg:deb/debian/ffmpeg@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "3d207fc84071887a" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0fad67bbd7de3055e69569eb82ec16b96ccb39e902b23e057827dd985b49303a", "Title": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out ...", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2022-27943", "PkgID": "gcc-12-base@12.2.0-14+deb12u1", "PkgName": "gcc-12-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "4cdf3a9f4926a4" }, "InstalledVersion": "12.2.0-14+deb12u1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-27943", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:af4e1a1b4eac641a916e4cf7b651e2f1252c03df31408d47e5a923389530bbba", "Title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "Description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", "Severity": "LOW", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "amazon": 1, "debian": 1, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2022-27943", "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead", "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/", "https://nvd.nist.gov/vuln/detail/CVE-2022-27943", "https://sourceware.org/bugzilla/show_bug.cgi?id=28995", "https://www.cve.org/CVERecord?id=CVE-2022-27943" ], "PublishedDate": "2022-03-26T13:15:07.9Z", "LastModifiedDate": "2026-06-17T04:37:46.95Z" }, { "VulnerabilityID": "CVE-2025-30258", "PkgID": "gpgv@2.2.40-1.1+deb12u2", "PkgName": "gpgv", "PkgIdentifier": { "PURL": "pkg:deb/debian/gpgv@2.2.40-1.1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "64286f6c7d0c92ee" }, "InstalledVersion": "2.2.40-1.1+deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-30258", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:686db1a0d236e52f8db01346748938c1c685a4f4a377609df5770be694aef4ca", "Title": "gnupg: verification DoS due to a malicious subkey in the keyring", "Description": "In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"", "Severity": "MEDIUM", "CweIDs": [ "CWE-754" ], "VendorSeverity": { "amazon": 1, "azure": 1, "julia": 2, "nvd": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L", "V3Score": 2.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-30258", "https://dev.gnupg.org/T7527", "https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158", "https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-30258", "https://ubuntu.com/security/notices/USN-7412-1", "https://ubuntu.com/security/notices/USN-7412-3", "https://www.cve.org/CVERecord?id=CVE-2025-30258" ], "PublishedDate": "2025-03-19T20:15:20.14Z", "LastModifiedDate": "2026-06-17T09:08:24.79Z" }, { "VulnerabilityID": "CVE-2025-68972", "PkgID": "gpgv@2.2.40-1.1+deb12u2", "PkgName": "gpgv", "PkgIdentifier": { "PURL": "pkg:deb/debian/gpgv@2.2.40-1.1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "64286f6c7d0c92ee" }, "InstalledVersion": "2.2.40-1.1+deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-68972", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bb75623e217b3d12caee52855fd28619a186947eb4325fa25835a9da6c6b87c1", "Title": "gnupg: GnuPG: Signature bypass via form feed character in signed messages", "Description": "In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.", "Severity": "MEDIUM", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "azure": 2, "julia": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 4.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-68972", "https://github.com/advisories/GHSA-w789-3q45-984r", "https://gpg.fail/formfeed", "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i", "https://news.ycombinator.com/item?id=46404339", "https://nvd.nist.gov/vuln/detail/CVE-2025-68972", "https://www.cve.org/CVERecord?id=CVE-2025-68972" ], "PublishedDate": "2025-12-27T23:15:40.9Z", "LastModifiedDate": "2026-06-17T09:59:55.373Z" }, { "VulnerabilityID": "CVE-2022-3219", "PkgID": "gpgv@2.2.40-1.1+deb12u2", "PkgName": "gpgv", "PkgIdentifier": { "PURL": "pkg:deb/debian/gpgv@2.2.40-1.1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "64286f6c7d0c92ee" }, "InstalledVersion": "2.2.40-1.1+deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-3219", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f88be8947eb6e96d579278e6e0ca2232f6c1980adde62d3e56f06c7402a08301", "Title": "gnupg: denial of service issue (resource consumption) using compressed packets", "Description": "GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.", "Severity": "LOW", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "debian": 1, "nvd": 1, "redhat": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2022-3219", "https://bugzilla.redhat.com/show_bug.cgi?id=2127010", "https://dev.gnupg.org/D556", "https://dev.gnupg.org/T5993", "https://marc.info/?l=oss-security\u0026m=165696590211434\u0026w=4", "https://nvd.nist.gov/vuln/detail/CVE-2022-3219", "https://security.netapp.com/advisory/ntap-20230324-0001/", "https://www.cve.org/CVERecord?id=CVE-2022-3219" ], "PublishedDate": "2023-02-23T20:15:12.393Z", "LastModifiedDate": "2026-06-17T04:59:05.937Z" }, { "VulnerabilityID": "CVE-2026-57062", "PkgID": "gpgv@2.2.40-1.1+deb12u2", "PkgName": "gpgv", "PkgIdentifier": { "PURL": "pkg:deb/debian/gpgv@2.2.40-1.1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "64286f6c7d0c92ee" }, "InstalledVersion": "2.2.40-1.1+deb12u2", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57062", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cac8f848a4f9ba47a82883d71f8990558bdccc0560a77c006d11288fa9548830", "Title": "GnuPG: Incorrect cryptographic message parsing", "Description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "Severity": "LOW", "CweIDs": [ "CWE-1284" ], "VendorSeverity": { "amazon": 1, "azure": 1, "photon": 1, "redhat": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 2.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-57062", "https://blog.calif.io/p/how-to-format-a-ciphertext", "https://nvd.nist.gov/vuln/detail/CVE-2026-57062", "https://www.cve.org/CVERecord?id=CVE-2026-57062", "https://www.gnupg.org/download/" ], "PublishedDate": "2026-06-23T18:18:10.973Z", "LastModifiedDate": "2026-06-25T20:16:05.473Z" }, { "VulnerabilityID": "CVE-2026-41992", "PkgID": "gzip@1.12-1", "PkgName": "gzip", "PkgIdentifier": { "PURL": "pkg:deb/debian/gzip@1.12-1?arch=amd64\u0026distro=debian-12.15", "UID": "e6df36a0bee4727c" }, "InstalledVersion": "1.12-1", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41992", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b22def8d7dbebe4ad87f0055182bfb3bbb0b6727dbb76d755824e8287c00dac6", "Title": "GNU gzip contains a global buffer overflow vulnerability in the LZH de ...", "Description": "GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "azure": 2, "nvd": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://cert.pl/en/posts/2026/04/CVE-2026-41991/", "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681", "https://nvd.nist.gov/vuln/detail/CVE-2026-41992", "https://ubuntu.com/security/notices/USN-8512-1", "https://www.cve.org/CVERecord?id=CVE-2026-41992", "https://www.gnu.org/software/gzip/" ], "PublishedDate": "2026-06-29T12:16:29.94Z", "LastModifiedDate": "2026-07-01T14:02:20.173Z" }, { "VulnerabilityID": "CVE-2026-41991", "PkgID": "gzip@1.12-1", "PkgName": "gzip", "PkgIdentifier": { "PURL": "pkg:deb/debian/gzip@1.12-1?arch=amd64\u0026distro=debian-12.15", "UID": "e6df36a0bee4727c" }, "InstalledVersion": "1.12-1", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41991", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:11b8da0fd9ef78b338339f84f12787cb5a5f3babb284b82ce0ede56f8c8c1f3f", "Title": "gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility", "Description": "GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269", "Severity": "MEDIUM", "CweIDs": [ "CWE-377" ], "VendorSeverity": { "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H", "V3Score": 6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-41991", "https://cert.pl/en/posts/2026/04/CVE-2026-41991/", "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269", "https://nvd.nist.gov/vuln/detail/CVE-2026-41991", "https://ubuntu.com/security/notices/USN-8512-1", "https://www.cve.org/CVERecord?id=CVE-2026-41991", "https://www.gnu.org/software/gzip/" ], "PublishedDate": "2026-06-29T12:16:29.77Z", "LastModifiedDate": "2026-07-01T14:02:24.45Z" }, { "VulnerabilityID": "CVE-2026-54369", "PkgID": "libacl1@2.3.1-3", "PkgName": "libacl1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libacl1@2.3.1-3?arch=amd64\u0026distro=debian-12.15", "UID": "7231f68d66ac38b5" }, "InstalledVersion": "2.3.1-3", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a1808ffea789e6b5ea0a7a1b2583015deed46faed63e014e092147d170c25b7f", "Title": "acl: Symlink traversal privilege escalation via libacl functions", "Description": "acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34351", "https://access.redhat.com/errata/RHSA-2026:42736", "https://access.redhat.com/errata/RHSA-2026:42739", "https://access.redhat.com/errata/RHSA-2026:43420", "https://access.redhat.com/errata/RHSA-2026:44481", "https://access.redhat.com/security/cve/CVE-2026-54369", "https://bugzilla.redhat.com/2490277", "https://bugzilla.redhat.com/2490279", "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "https://bugzilla.redhat.com/show_bug.cgi?id=2490279", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54370", "https://errata.almalinux.org/9/ALSA-2026-42736.html", "https://errata.rockylinux.org/RLSA-2026:42736", "https://linux.oracle.com/cve/CVE-2026-54369.html", "https://linux.oracle.com/errata/ELSA-2026-43420.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54369", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "https://www.cve.org/CVERecord?id=CVE-2026-54369", "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" ], "PublishedDate": "2026-06-29T14:16:57.487Z", "LastModifiedDate": "2026-07-24T13:18:27.353Z" }, { "VulnerabilityID": "CVE-2026-54370", "PkgID": "libacl1@2.3.1-3", "PkgName": "libacl1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libacl1@2.3.1-3?arch=amd64\u0026distro=debian-12.15", "UID": "7231f68d66ac38b5" }, "InstalledVersion": "2.3.1-3", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54370", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cee81da97fc1b8af3d440c2e1163d8aaf6295712d24d9e57b830c44f84674f6e", "Title": "acl: TOCTOU Symlink Traversal via getfacl/setfacl", "Description": "acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.", "Severity": "MEDIUM", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42736", "https://access.redhat.com/security/cve/CVE-2026-54370", "https://bugzilla.redhat.com/2490277", "https://bugzilla.redhat.com/2490279", "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "https://bugzilla.redhat.com/show_bug.cgi?id=2490279", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54370", "https://errata.almalinux.org/9/ALSA-2026-42736.html", "https://errata.rockylinux.org/RLSA-2026:42736", "https://linux.oracle.com/cve/CVE-2026-54370.html", "https://linux.oracle.com/errata/ELSA-2026-43420.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54370", "https://www.cve.org/CVERecord?id=CVE-2026-54370", "https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl" ], "PublishedDate": "2026-06-29T14:16:57.67Z", "LastModifiedDate": "2026-06-29T19:22:57.46Z" }, { "VulnerabilityID": "CVE-2023-6879", "PkgID": "libaom3@3.6.0-1+deb12u2", "PkgName": "libaom3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libaom3@3.6.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "8cffe3264c58c158" }, "InstalledVersion": "3.6.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6879", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:36ddf88bb59e621d4691d5f37c80955aa51d2d0527d7b10d6fb68e5fffad67f6", "Title": "aom: heap-buffer-overflow on frame size change", "Description": "Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().", "Severity": "CRITICAL", "CweIDs": [ "CWE-20", "CWE-787" ], "VendorSeverity": { "nvd": 4, "redhat": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-6879", "https://aomedia.googlesource.com/aom/+/refs/tags/v3.7.1", "https://crbug.com/aomedia/3491", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/", "https://nvd.nist.gov/vuln/detail/CVE-2023-6879", "https://www.cve.org/CVERecord?id=CVE-2023-6879" ], "PublishedDate": "2023-12-27T23:15:07.53Z", "LastModifiedDate": "2026-06-23T18:17:38.583Z" }, { "VulnerabilityID": "CVE-2023-39616", "PkgID": "libaom3@3.6.0-1+deb12u2", "PkgName": "libaom3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libaom3@3.6.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "8cffe3264c58c158" }, "InstalledVersion": "3.6.0-1+deb12u2", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-39616", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6f554dca1b35a3dae50ca59745dc21d943569c04b9dae93e6c5078aac432421f", "Title": "AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read mem ...", "Description": "AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.", "Severity": "HIGH", "CweIDs": [ "CWE-119" ], "VendorSeverity": { "nvd": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://bugs.chromium.org/p/aomedia/issues/detail?id=3372#c3" ], "PublishedDate": "2023-08-29T17:15:12.633Z", "LastModifiedDate": "2026-06-17T06:12:37.533Z" }, { "VulnerabilityID": "CVE-2026-56208", "PkgID": "libaom3@3.6.0-1+deb12u2", "PkgName": "libaom3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libaom3@3.6.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "8cffe3264c58c158" }, "InstalledVersion": "3.6.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56208", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4948ede6983d5c28dfe8c5062afb643e82e2d1229228748ca85947175ceb5b1a", "Title": "libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode", "Description": "A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "amazon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30814", "https://access.redhat.com/errata/RHSA-2026:42875", "https://access.redhat.com/security/cve/CVE-2026-56208", "https://aomedia.googlesource.com/aom/+/243f8ae84b", "https://bugzilla.redhat.com/show_bug.cgi?id=2490799", "https://issues.chromium.org/issues/504317456", "https://nvd.nist.gov/vuln/detail/CVE-2026-56208", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56208.json", "https://www.cve.org/CVERecord?id=CVE-2026-56208" ], "PublishedDate": "2026-06-19T17:16:30.297Z", "LastModifiedDate": "2026-07-22T12:18:14.55Z" }, { "VulnerabilityID": "CVE-2026-56209", "PkgID": "libaom3@3.6.0-1+deb12u2", "PkgName": "libaom3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libaom3@3.6.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "8cffe3264c58c158" }, "InstalledVersion": "3.6.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56209", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd22e7a2a5dfaea77e0e046e5a565960030055a229476035b2708712149a0d39", "Title": "libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack", "Description": "An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30814", "https://access.redhat.com/errata/RHSA-2026:42875", "https://access.redhat.com/security/cve/CVE-2026-56209", "https://aomedia.googlesource.com/aom/+/a93ba0ffaa", "https://bugzilla.redhat.com/show_bug.cgi?id=2490800", "https://issues.chromium.org/issues/503993984", "https://nvd.nist.gov/vuln/detail/CVE-2026-56209", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56209.json", "https://www.cve.org/CVERecord?id=CVE-2026-56209" ], "PublishedDate": "2026-06-19T17:16:30.427Z", "LastModifiedDate": "2026-07-22T12:18:15.07Z" }, { "VulnerabilityID": "CVE-2026-56210", "PkgID": "libaom3@3.6.0-1+deb12u2", "PkgName": "libaom3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libaom3@3.6.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "8cffe3264c58c158" }, "InstalledVersion": "3.6.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56210", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:64a49e858d705a1cd980de7931f39f6fa9367a733cae0e49a6a4ec60e21afb44", "Title": "libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id", "Description": "A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30814", "https://access.redhat.com/errata/RHSA-2026:42875", "https://access.redhat.com/security/cve/CVE-2026-56210", "https://aomedia.googlesource.com/aom/+/a93ba0ffaa", "https://bugzilla.redhat.com/show_bug.cgi?id=2490801", "https://issues.chromium.org/issues/503975732", "https://nvd.nist.gov/vuln/detail/CVE-2026-56210", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56210.json", "https://www.cve.org/CVERecord?id=CVE-2026-56210" ], "PublishedDate": "2026-06-19T17:16:30.557Z", "LastModifiedDate": "2026-07-22T12:18:15.57Z" }, { "VulnerabilityID": "CVE-2026-56211", "PkgID": "libaom3@3.6.0-1+deb12u2", "PkgName": "libaom3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libaom3@3.6.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "8cffe3264c58c158" }, "InstalledVersion": "3.6.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56211", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:af0bf1ff808feaf4f9ba738fd2c7fc56ce6d28095af997677f06996fc6b1c0b3", "Title": "libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames", "Description": "A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30814", "https://access.redhat.com/errata/RHSA-2026:42875", "https://access.redhat.com/security/cve/CVE-2026-56211", "https://aomedia.googlesource.com/aom/+/a93ba0ffaa", "https://bugzilla.redhat.com/show_bug.cgi?id=2490802", "https://issues.chromium.org/issues/503993985", "https://nvd.nist.gov/vuln/detail/CVE-2026-56211", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56211.json", "https://www.cve.org/CVERecord?id=CVE-2026-56211" ], "PublishedDate": "2026-06-19T17:16:30.68Z", "LastModifiedDate": "2026-07-22T12:18:16.063Z" }, { "VulnerabilityID": "CVE-2011-3374", "PkgID": "libapt-pkg6.0@2.6.1", "PkgName": "libapt-pkg6.0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libapt-pkg6.0@2.6.1?arch=amd64\u0026distro=debian-12.15", "UID": "1643dd5a3358bf0d" }, "InstalledVersion": "2.6.1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-3374", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7ef4a62a6b3d027b1c7eeceaa869de969fefb82897d80aa0d6d848d6dddae3fd", "Title": "It was found that apt-key in apt, all versions, do not correctly valid ...", "Description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.", "Severity": "LOW", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "debian": 1, "nvd": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V2Score": 4.3, "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/cve-2011-3374", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480", "https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html", "https://seclists.org/fulldisclosure/2011/Sep/221", "https://security-tracker.debian.org/tracker/CVE-2011-3374", "https://snyk.io/vuln/SNYK-LINUX-APT-116518", "https://ubuntu.com/security/CVE-2011-3374" ], "PublishedDate": "2019-11-26T00:15:11.03Z", "LastModifiedDate": "2024-11-21T01:30:22.61Z" }, { "VulnerabilityID": "CVE-2026-25068", "PkgID": "libasound2@1.2.8-1+b1", "PkgName": "libasound2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libasound2@1.2.8-1%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "bf64d1802f689b11" }, "InstalledVersion": "1.2.8-1+b1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25068", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:10b59d19bb3d22101dd9ca66e4052985e7ca350949bf47545640c3bdfc087110", "Title": "alsa-lib: alsa-lib Topology Decoder Heap-based Buffer Overflow", "Description": "alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.", "Severity": "MEDIUM", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "amazon": 2, "azure": 2, "cbl-mariner": 2, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 4.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-25068", "https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40", "https://lists.debian.org/debian-lts-announce/2026/02/msg00008.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25068", "https://ubuntu.com/security/notices/USN-8044-1", "https://ubuntu.com/security/notices/USN-8044-2", "https://www.cve.org/CVERecord?id=CVE-2026-25068", "https://www.vulncheck.com/advisories/alsa-lib-topology-decoder-heap-based-buffer-overflow" ], "PublishedDate": "2026-01-29T20:16:10.623Z", "LastModifiedDate": "2026-06-17T10:24:04.38Z" }, { "VulnerabilityID": "CVE-2026-56109", "PkgID": "libasound2@1.2.8-1+b1", "PkgName": "libasound2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libasound2@1.2.8-1%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "bf64d1802f689b11" }, "InstalledVersion": "1.2.8-1+b1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56109", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:00c88d8be393859a8362ce6f99547d956bed6bf0cf461f17cfb8b9cd15b98ed4", "Title": "The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 c ...", "Description": "The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.", "Severity": "LOW", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "debian": 1, "ubuntu": 2 }, "References": [ "https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0", "https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1", "https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/", "https://ubuntu.com/security/notices/USN-8538-1", "https://www.cve.org/CVERecord?id=CVE-2026-56109", "https://www.vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c" ], "PublishedDate": "2026-06-22T18:16:48.557Z", "LastModifiedDate": "2026-07-14T22:17:18.487Z" }, { "VulnerabilityID": "CVE-2026-25068", "PkgID": "libasound2-data@1.2.8-1", "PkgName": "libasound2-data", "PkgIdentifier": { "PURL": "pkg:deb/debian/libasound2-data@1.2.8-1?arch=all\u0026distro=debian-12.15", "UID": "c04e41ab2b1b1f93" }, "InstalledVersion": "1.2.8-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25068", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4a68596382af2c6c4c696398889571de0c42cd3bf5abeab6cd6861f1617363ff", "Title": "alsa-lib: alsa-lib Topology Decoder Heap-based Buffer Overflow", "Description": "alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.", "Severity": "MEDIUM", "CweIDs": [ "CWE-129" ], "VendorSeverity": { "amazon": 2, "azure": 2, "cbl-mariner": 2, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 4.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-25068", "https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40", "https://lists.debian.org/debian-lts-announce/2026/02/msg00008.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25068", "https://ubuntu.com/security/notices/USN-8044-1", "https://ubuntu.com/security/notices/USN-8044-2", "https://www.cve.org/CVERecord?id=CVE-2026-25068", "https://www.vulncheck.com/advisories/alsa-lib-topology-decoder-heap-based-buffer-overflow" ], "PublishedDate": "2026-01-29T20:16:10.623Z", "LastModifiedDate": "2026-06-17T10:24:04.38Z" }, { "VulnerabilityID": "CVE-2026-56109", "PkgID": "libasound2-data@1.2.8-1", "PkgName": "libasound2-data", "PkgIdentifier": { "PURL": "pkg:deb/debian/libasound2-data@1.2.8-1?arch=all\u0026distro=debian-12.15", "UID": "c04e41ab2b1b1f93" }, "InstalledVersion": "1.2.8-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56109", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8945559b89b3acf2a1a7d5efcfd9ac7ad55a22fc5172082c96572a327d0ea94a", "Title": "The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 c ...", "Description": "The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.", "Severity": "LOW", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "debian": 1, "ubuntu": 2 }, "References": [ "https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0", "https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1", "https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/", "https://ubuntu.com/security/notices/USN-8538-1", "https://www.cve.org/CVERecord?id=CVE-2026-56109", "https://www.vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c" ], "PublishedDate": "2026-06-22T18:16:48.557Z", "LastModifiedDate": "2026-07-14T22:17:18.487Z" }, { "VulnerabilityID": "CVE-2026-61627", "PkgID": "libass9@1:0.17.1-1", "PkgName": "libass9", "PkgIdentifier": { "PURL": "pkg:deb/debian/libass9@0.17.1-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "5060c4b9be28c3c1" }, "InstalledVersion": "1:0.17.1-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-61627", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3eb817c7db1b558e646558c95a8800004e44cdc6d7078b9d5ae0c71cb1feed85", "Title": "[GHSA-pjjp-65r7-ppgm: Out-of-bounds read and write in wrap_lines_measure]", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-54371", "PkgID": "libattr1@1:2.5.1-4", "PkgName": "libattr1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libattr1@2.5.1-4?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f518c6c499c1b23d" }, "InstalledVersion": "1:2.5.1-4", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54371", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d4b21d973f773d9bbba61e44e1a68e5b0703c34de34bb648484c4ed5875f0854", "Title": "attr: Symlink Traversal Privilege Escalation via getfattr and setfattr", "Description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "Severity": "MEDIUM", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "azure": 2, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34889", "https://access.redhat.com/security/cve/CVE-2026-54371", "https://bugzilla.redhat.com/show_bug.cgi?id=2490283", "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f", "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b", "https://nvd.nist.gov/vuln/detail/CVE-2026-54371", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json", "https://www.cve.org/CVERecord?id=CVE-2026-54371", "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr" ], "PublishedDate": "2026-06-29T14:16:57.823Z", "LastModifiedDate": "2026-07-15T01:16:35.507Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:07cae3aacffe59ec7945dc8d120833ea818a3ddf9b6d401603d7285ed047dc1e", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-07-23T12:18:30.933Z" }, { "VulnerabilityID": "CVE-2026-64831", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64831", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1bc5dc523d2028366bb62a5a6add346dff7d07f9a6070ec9fd9ee967d9178636", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted HEVC/H.265 bitstream", "Description": "FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64831", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665", "https://nvd.nist.gov/vuln/detail/CVE-2026-64831", "https://www.cve.org/CVERecord?id=CVE-2026-64831", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder" ], "PublishedDate": "2026-07-22T17:16:58.697Z", "LastModifiedDate": "2026-07-23T14:17:40.63Z" }, { "VulnerabilityID": "CVE-2026-8461", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6f197238f925a5747e596d65f0b47217582d330a385c96d1a405e2a4d2ed5a65", "Title": "ffmpeg: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder", "Description": "An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-8461", "https://bugzilla.redhat.com/show_bug.cgi?id=2490308", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159", "https://github.com/advisories/GHSA-qff7-4q6c-m8h6", "https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/", "https://nvd.nist.gov/vuln/detail/CVE-2026-8461", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json", "https://www.cve.org/CVERecord?id=CVE-2026-8461" ], "PublishedDate": "2026-06-18T14:17:36.66Z", "LastModifiedDate": "2026-07-23T12:18:51.763Z" }, { "VulnerabilityID": "CVE-2023-49528", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-49528", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3e85c2bb4fd9f05dc5e19e53f240d7dd134f7d7ad641daf57a8dce88aa3f9bfe", "Title": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, al ...", "Description": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component.", "Severity": "MEDIUM", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "ubuntu": 2 }, "References": [ "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://trac.ffmpeg.org/ticket/10691", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2023-49528" ], "PublishedDate": "2024-04-12T06:15:06.32Z", "LastModifiedDate": "2026-06-17T06:36:05.573Z" }, { "VulnerabilityID": "CVE-2023-6601", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6601", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:38e4c7693e9547abe87c4839e35fdedcff6a3ea084fd83edad9c90fa2ab1cf02", "Title": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows by ...", "Description": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-99", "CWE-94" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://bugzilla.redhat.com/show_bug.cgi?id=2253172", "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html", "https://www.cve.org/CVERecord?id=CVE-2023-6601" ], "PublishedDate": "2025-01-06T17:15:14.217Z", "LastModifiedDate": "2026-06-17T06:51:04.107Z" }, { "VulnerabilityID": "CVE-2024-31578", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-31578", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ea47d3a56181b819e59a24dfbabb2a0e93cb11b7eb673ee0352e8f1e9d8a1606", "Title": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free ...", "Description": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "julia": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179", "https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7", "https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2024-31578" ], "PublishedDate": "2024-04-17T14:15:08.563Z", "LastModifiedDate": "2026-06-17T07:28:36.03Z" }, { "VulnerabilityID": "CVE-2024-35369", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-35369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:04a19e792dd49964d5f81f234e369d74e6bc25970fcaecb090d2fef96aa014eb", "Title": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c m ...", "Description": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8", "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423", "https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c" ], "PublishedDate": "2024-11-29T17:15:07.707Z", "LastModifiedDate": "2026-06-17T07:34:49.86Z" }, { "VulnerabilityID": "CVE-2025-10256", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-10256", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a6578c2f4ecff3e2fc9be7ebf3ba583f054901f706424f1a4453fffb08a10085", "Title": "ffmpeg: NULL pointer dereference in Firequalizer filter (libavfilter/af_firequalizer.c)", "Description": "A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-10256", "https://bugzilla.redhat.com/show_bug.cgi?id=2394495", "https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931", "https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a", "https://nvd.nist.gov/vuln/detail/CVE-2025-10256", "https://ubuntu.com/security/notices/USN-7830-1", "https://www.cve.org/CVERecord?id=CVE-2025-10256" ], "PublishedDate": "2026-02-18T21:16:20.183Z", "LastModifiedDate": "2026-06-17T08:28:00.503Z" }, { "VulnerabilityID": "CVE-2025-22921", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:485b8198ffc00e1e5231d896846917bb7ac159ef32803c96a7c8168a6b59d184", "Title": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a seg ...", "Description": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html", "https://trac.ffmpeg.org/ticket/11393", "https://ubuntu.com/security/notices/USN-7538-1", "https://www.cve.org/CVERecord?id=CVE-2025-22921" ], "PublishedDate": "2025-02-18T22:15:18.04Z", "LastModifiedDate": "2026-06-17T08:50:59.503Z" }, { "VulnerabilityID": "CVE-2026-6385", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6385", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a9e947545f3c33a6d52dd174c82ad643d809c31ef57af762442464b6a20d4d46", "Title": "ffmpeg: FFmpeg: Denial of Service and potential arbitrary code execution via signed integer overflow in DVD subtitle parser", "Description": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-6385", "https://bugzilla.redhat.com/show_bug.cgi?id=2458764", "https://nvd.nist.gov/vuln/detail/CVE-2026-6385", "https://www.cve.org/CVERecord?id=CVE-2026-6385" ], "PublishedDate": "2026-04-15T20:16:44.23Z", "LastModifiedDate": "2026-06-17T11:00:45.583Z" }, { "VulnerabilityID": "CVE-2026-65703", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65703", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4068334257105dfbb24ff1285d2e9cb23e72e1c6cf67af2c9f768ccf55bd5e2c", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via crafted AVI file in TDSC video decoder", "Description": "FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65703", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773", "https://nvd.nist.gov/vuln/detail/CVE-2026-65703", "https://www.cve.org/CVERecord?id=CVE-2026-65703", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder" ], "PublishedDate": "2026-07-23T20:17:21.803Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65704", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65704", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e941766e44775e346858e435f4c4706a9c4f89f47af19d4b6fd9910461b49bf1", "Title": "ffmpeg: FFmpeg: Heap corruption via crafted ffconcat file can lead to arbitrary code execution", "Description": "FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.", "Severity": "MEDIUM", "CweIDs": [ "CWE-191", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65704", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767", "https://nvd.nist.gov/vuln/detail/CVE-2026-65704", "https://www.cve.org/CVERecord?id=CVE-2026-65704", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder" ], "PublishedDate": "2026-07-23T20:17:21.973Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65705", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65705", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a767af43ad7a03512d2b48eb60bc01d78a028a3efb0acdab63c1d2a3b8bf340e", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via out-of-bounds write in vf_floodfill video filter", "Description": "FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65705", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780", "https://nvd.nist.gov/vuln/detail/CVE-2026-65705", "https://www.cve.org/CVERecord?id=CVE-2026-65705", "https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame" ], "PublishedDate": "2026-07-23T20:17:22.12Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65706", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65706", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:15a0ff976ea5843d223806334fcd6fd9b3fa1497784df39828cae5b7b85d6393", "Title": "FFmpeg: FFmpeg: Arbitrary Code Execution via Crafted Video Frame", "Description": "FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65706", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779", "https://nvd.nist.gov/vuln/detail/CVE-2026-65706", "https://www.cve.org/CVERecord?id=CVE-2026-65706", "https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing" ], "PublishedDate": "2026-07-23T20:17:22.257Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-30999", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-30999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ce8712c11f2e8969cafbad6b31f12fc13867dbcf4a24f62dd92ba20750ae7913", "Title": "FFmpeg: FFmpeg: Denial of Service via heap buffer overflow in av_bprint_finalize()", "Description": "A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.", "Severity": "LOW", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "debian": 1, "julia": 3, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-30999", "https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6", "https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html", "https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c", "https://nvd.nist.gov/vuln/detail/CVE-2026-30999", "https://www.cve.org/CVERecord?id=CVE-2026-30999", "https://www.ffmpeg.org/download.html" ], "PublishedDate": "2026-04-13T15:17:32.827Z", "LastModifiedDate": "2026-06-17T10:33:17.66Z" }, { "VulnerabilityID": "CVE-2024-36615", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-36615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fdab9dda2c7f57ce6f7b5f46040b1c66571444faef9756442200d901249d1520", "Title": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Thi ...", "Description": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-362" ], "References": [ "https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb", "https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738", "https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61" ], "PublishedDate": "2024-11-29T19:15:07.703Z", "LastModifiedDate": "2026-06-17T07:37:01.797Z" }, { "VulnerabilityID": "CVE-2026-13858", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13858", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:93acd56c658cf75e8a47e95463315132d914852505462afed0adc426080d3a18", "Title": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 a ...", "Description": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html", "https://issues.chromium.org/issues/507090179" ], "PublishedDate": "2026-06-30T23:17:00.22Z", "LastModifiedDate": "2026-07-01T15:36:19.657Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2d4056e63063d3523578b2987d4206bc3b3cfc111ff2f95737f1aa202a5d39b3", "Title": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vuln ...", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0043185c1405dc07313b271bca23f2fba3a6b19b8f8c59b538f65013429af3ab", "Title": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-415" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:90c484ad45829728392e1aa9974df976f1456cc6f291674afe74cc41958ff9ad", "Title": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vuln ...", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:327d3053014442cf9442f8a83c8dc35abaf072b896d4f8fa8350b647056d8adf", "Title": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerabi ...", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-835" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-07-23T16:17:49.397Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:19da7f025bb3adf321eaa36e6c909bbd52c08f5cf5ef5eaf8b5fe8a45625c73b", "Title": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory acce ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-07-23T14:17:41.17Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1ebfc1e83c0494566e28c304c4f80acee50e499971930107668692f7589b83d0", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66037", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66037", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:586a582f805ade67ec4080a500a895d9591754282b4794da5095260926635f1d", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolle ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-770" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627", "https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu" ], "PublishedDate": "2026-07-24T20:18:20.573Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66038", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66038", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:33ac692966ae9bae2a8b0d7137ed8970a6b84aa0c2f012426fe7c077903d4488", "Title": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information ...", "Description": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-908" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626", "https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c" ], "PublishedDate": "2026-07-24T20:18:20.727Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b204d01f958bdce7a7c557b8439f3fff0d7239864d95e52d250859b20f54aa3b", "Title": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integ ...", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122", "CWE-190" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3da6a72a0f0b5ece1bdd970ebdfc9d755bbc1142d0a6ed34d1af7412361708ba", "Title": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libavcodec59@7:5.1.9-0+deb12u1", "PkgName": "libavcodec59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavcodec59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "e42ae598aad7f69c" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e7a994387e8c0e03613648de882d26051a0192e878b203e94bef99de6f3f1888", "Title": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out ...", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e31e576f982c3d17ff05e4cb50b0348f46fc21ac65a224cb4269f014e9e759e7", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-07-23T12:18:30.933Z" }, { "VulnerabilityID": "CVE-2026-64831", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64831", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7f1ffa22e0f722454cbba2d61671f78aff6c414f3cdf0d4634764120a028b529", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted HEVC/H.265 bitstream", "Description": "FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64831", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665", "https://nvd.nist.gov/vuln/detail/CVE-2026-64831", "https://www.cve.org/CVERecord?id=CVE-2026-64831", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder" ], "PublishedDate": "2026-07-22T17:16:58.697Z", "LastModifiedDate": "2026-07-23T14:17:40.63Z" }, { "VulnerabilityID": "CVE-2026-8461", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:683126b4d37acb58281dabac367a27f27347d316423c2ed0d15a7781d8872e5c", "Title": "ffmpeg: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder", "Description": "An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-8461", "https://bugzilla.redhat.com/show_bug.cgi?id=2490308", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159", "https://github.com/advisories/GHSA-qff7-4q6c-m8h6", "https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/", "https://nvd.nist.gov/vuln/detail/CVE-2026-8461", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json", "https://www.cve.org/CVERecord?id=CVE-2026-8461" ], "PublishedDate": "2026-06-18T14:17:36.66Z", "LastModifiedDate": "2026-07-23T12:18:51.763Z" }, { "VulnerabilityID": "CVE-2023-49528", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-49528", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fe4bfad7aa9c48e61a3a3fcc4936be3e9f897ad36fd8c4cc7da6b7253d71b62a", "Title": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, al ...", "Description": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component.", "Severity": "MEDIUM", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "ubuntu": 2 }, "References": [ "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://trac.ffmpeg.org/ticket/10691", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2023-49528" ], "PublishedDate": "2024-04-12T06:15:06.32Z", "LastModifiedDate": "2026-06-17T06:36:05.573Z" }, { "VulnerabilityID": "CVE-2023-6601", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6601", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8a4a05fc53e7ddcdc6818d1f308a074a993069581ff837f2895d615f535b3e54", "Title": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows by ...", "Description": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-99", "CWE-94" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://bugzilla.redhat.com/show_bug.cgi?id=2253172", "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html", "https://www.cve.org/CVERecord?id=CVE-2023-6601" ], "PublishedDate": "2025-01-06T17:15:14.217Z", "LastModifiedDate": "2026-06-17T06:51:04.107Z" }, { "VulnerabilityID": "CVE-2024-31578", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-31578", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:100e03553c0f12bfff3bf717a2f6c198339f9ea3a1a693656a3f098b4b87aac8", "Title": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free ...", "Description": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "julia": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179", "https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7", "https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2024-31578" ], "PublishedDate": "2024-04-17T14:15:08.563Z", "LastModifiedDate": "2026-06-17T07:28:36.03Z" }, { "VulnerabilityID": "CVE-2024-35369", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-35369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c550dc872b3bc5f9ac6059515a08274723f877a04b588d572a0857af20e18d98", "Title": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c m ...", "Description": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8", "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423", "https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c" ], "PublishedDate": "2024-11-29T17:15:07.707Z", "LastModifiedDate": "2026-06-17T07:34:49.86Z" }, { "VulnerabilityID": "CVE-2025-10256", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-10256", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b74bdfb1841b494f93cd6c4c8b74a8ab512db00d10bfb02297a70af6f98a5380", "Title": "ffmpeg: NULL pointer dereference in Firequalizer filter (libavfilter/af_firequalizer.c)", "Description": "A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-10256", "https://bugzilla.redhat.com/show_bug.cgi?id=2394495", "https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931", "https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a", "https://nvd.nist.gov/vuln/detail/CVE-2025-10256", "https://ubuntu.com/security/notices/USN-7830-1", "https://www.cve.org/CVERecord?id=CVE-2025-10256" ], "PublishedDate": "2026-02-18T21:16:20.183Z", "LastModifiedDate": "2026-06-17T08:28:00.503Z" }, { "VulnerabilityID": "CVE-2025-22921", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c711d5efc714e2c0df0018ac87265d9f6139f9fad854c6b4580913da6d9ae872", "Title": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a seg ...", "Description": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html", "https://trac.ffmpeg.org/ticket/11393", "https://ubuntu.com/security/notices/USN-7538-1", "https://www.cve.org/CVERecord?id=CVE-2025-22921" ], "PublishedDate": "2025-02-18T22:15:18.04Z", "LastModifiedDate": "2026-06-17T08:50:59.503Z" }, { "VulnerabilityID": "CVE-2026-6385", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6385", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:647e1a008d7f92eca323639ccb5b073181ffb507f4172c4b25ae377ac6743737", "Title": "ffmpeg: FFmpeg: Denial of Service and potential arbitrary code execution via signed integer overflow in DVD subtitle parser", "Description": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-6385", "https://bugzilla.redhat.com/show_bug.cgi?id=2458764", "https://nvd.nist.gov/vuln/detail/CVE-2026-6385", "https://www.cve.org/CVERecord?id=CVE-2026-6385" ], "PublishedDate": "2026-04-15T20:16:44.23Z", "LastModifiedDate": "2026-06-17T11:00:45.583Z" }, { "VulnerabilityID": "CVE-2026-65703", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65703", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0a40d35fc0b7e5fc161f8e7a2dad5f9a7fbb484ce3232ee48d6903b252691765", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via crafted AVI file in TDSC video decoder", "Description": "FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65703", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773", "https://nvd.nist.gov/vuln/detail/CVE-2026-65703", "https://www.cve.org/CVERecord?id=CVE-2026-65703", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder" ], "PublishedDate": "2026-07-23T20:17:21.803Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65704", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65704", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e8f9a3785948126d89461dee03dff88bb396dd1d087c8e5bcdce11382b2ae6f2", "Title": "ffmpeg: FFmpeg: Heap corruption via crafted ffconcat file can lead to arbitrary code execution", "Description": "FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.", "Severity": "MEDIUM", "CweIDs": [ "CWE-191", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65704", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767", "https://nvd.nist.gov/vuln/detail/CVE-2026-65704", "https://www.cve.org/CVERecord?id=CVE-2026-65704", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder" ], "PublishedDate": "2026-07-23T20:17:21.973Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65705", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65705", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3771995e8b038c45837747bd995ff14d7f4049f8a2de1b0fcb2b6ad5cdf71964", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via out-of-bounds write in vf_floodfill video filter", "Description": "FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65705", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780", "https://nvd.nist.gov/vuln/detail/CVE-2026-65705", "https://www.cve.org/CVERecord?id=CVE-2026-65705", "https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame" ], "PublishedDate": "2026-07-23T20:17:22.12Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65706", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65706", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:06cd08a3f94983e5f20ed4c901f7497f10249f2913f45f2b6120ddc61379ce7d", "Title": "FFmpeg: FFmpeg: Arbitrary Code Execution via Crafted Video Frame", "Description": "FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65706", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779", "https://nvd.nist.gov/vuln/detail/CVE-2026-65706", "https://www.cve.org/CVERecord?id=CVE-2026-65706", "https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing" ], "PublishedDate": "2026-07-23T20:17:22.257Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-30999", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-30999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4d18b46574f91da0bcbe06cd702aee72dd9bd8af2730a68d6bcbd5c68f43a66a", "Title": "FFmpeg: FFmpeg: Denial of Service via heap buffer overflow in av_bprint_finalize()", "Description": "A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.", "Severity": "LOW", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "debian": 1, "julia": 3, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-30999", "https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6", "https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html", "https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c", "https://nvd.nist.gov/vuln/detail/CVE-2026-30999", "https://www.cve.org/CVERecord?id=CVE-2026-30999", "https://www.ffmpeg.org/download.html" ], "PublishedDate": "2026-04-13T15:17:32.827Z", "LastModifiedDate": "2026-06-17T10:33:17.66Z" }, { "VulnerabilityID": "CVE-2024-36615", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-36615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:990c7dcefa30c389b4b35939151eb28266ff95b140169963200023f70a24a03a", "Title": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Thi ...", "Description": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-362" ], "References": [ "https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb", "https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738", "https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61" ], "PublishedDate": "2024-11-29T19:15:07.703Z", "LastModifiedDate": "2026-06-17T07:37:01.797Z" }, { "VulnerabilityID": "CVE-2026-13858", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13858", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2ad2d17503ee8932ad827d0098494d2cad9f985229eb1878972ff730725ba203", "Title": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 a ...", "Description": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html", "https://issues.chromium.org/issues/507090179" ], "PublishedDate": "2026-06-30T23:17:00.22Z", "LastModifiedDate": "2026-07-01T15:36:19.657Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d325b4098c3e55d5ade0d3d45c97c2271580efc81ee655c3ae9f55683999292a", "Title": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vuln ...", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:26c355ce4900bf8f56293985cb0d11c19188010ad695a5830d2b9a9e1aebfecf", "Title": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-415" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1daa599151c0367ca246cdeb71e1bfe4e363a623ef45e2452ba12c1ff00a8388", "Title": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vuln ...", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e1809f832882c7ff0685ef5d2db82a9ddc4d795afd49fb23113151e7af2c14cb", "Title": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerabi ...", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-835" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-07-23T16:17:49.397Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fb92ff96581871cdc380baae32954b04648f731a1e6336548a606e4dd34e5a2a", "Title": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory acce ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-07-23T14:17:41.17Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd8a2cacb887fef0dfd1c1c640c6f90698802bf99fee5ebda5551847a289a0d2", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66037", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66037", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:139222a9ef8d16356f20a9a61bb9bd678703991629c4758b544cfb0e31350292", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolle ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-770" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627", "https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu" ], "PublishedDate": "2026-07-24T20:18:20.573Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66038", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66038", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:63cb6be5d1ae9f493db0ed4ad130fb1a1001ac1d5acfc4e01a8c6e710d23df89", "Title": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information ...", "Description": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-908" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626", "https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c" ], "PublishedDate": "2026-07-24T20:18:20.727Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:44e502d5d5d9fb73346a08078b879fdb674959536f4ad984b0b322f734f71f32", "Title": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integ ...", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122", "CWE-190" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d2c9f87f618bf3591ae193ad3b57e4f63c0195e43d1cc11ea6c5a8f1f65db417", "Title": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libavdevice59@7:5.1.9-0+deb12u1", "PkgName": "libavdevice59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavdevice59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "2e0b7e6e722b042b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8bf7b539cea7d682e4907bf9e66619c1eccae0533840f93b021c0ab8013c40ea", "Title": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out ...", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e317bce5d9814e6cdd3e522fd1f586bdfad57425955313a09aa45ca656abe016", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-07-23T12:18:30.933Z" }, { "VulnerabilityID": "CVE-2026-64831", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64831", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:82063dd43a69047b56822848e014ae8636db51b73eadec9dbcd9e9968ffb220e", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted HEVC/H.265 bitstream", "Description": "FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64831", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665", "https://nvd.nist.gov/vuln/detail/CVE-2026-64831", "https://www.cve.org/CVERecord?id=CVE-2026-64831", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder" ], "PublishedDate": "2026-07-22T17:16:58.697Z", "LastModifiedDate": "2026-07-23T14:17:40.63Z" }, { "VulnerabilityID": "CVE-2026-8461", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f5ed3a14f8d75430a89a1d5f53a27396dd4d345d2662eeb766e4a890197ed876", "Title": "ffmpeg: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder", "Description": "An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-8461", "https://bugzilla.redhat.com/show_bug.cgi?id=2490308", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159", "https://github.com/advisories/GHSA-qff7-4q6c-m8h6", "https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/", "https://nvd.nist.gov/vuln/detail/CVE-2026-8461", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json", "https://www.cve.org/CVERecord?id=CVE-2026-8461" ], "PublishedDate": "2026-06-18T14:17:36.66Z", "LastModifiedDate": "2026-07-23T12:18:51.763Z" }, { "VulnerabilityID": "CVE-2023-49528", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-49528", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d3b3c2afacd49225cfb6a5e1054bc3a6f6d3e9fb28b457a5cf8edd2415d043e5", "Title": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, al ...", "Description": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component.", "Severity": "MEDIUM", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "ubuntu": 2 }, "References": [ "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://trac.ffmpeg.org/ticket/10691", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2023-49528" ], "PublishedDate": "2024-04-12T06:15:06.32Z", "LastModifiedDate": "2026-06-17T06:36:05.573Z" }, { "VulnerabilityID": "CVE-2023-6601", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6601", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c781d98b0dde444a648d21022cd0949df8511510e503a3c794ef7e6e1313f8cd", "Title": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows by ...", "Description": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-99", "CWE-94" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://bugzilla.redhat.com/show_bug.cgi?id=2253172", "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html", "https://www.cve.org/CVERecord?id=CVE-2023-6601" ], "PublishedDate": "2025-01-06T17:15:14.217Z", "LastModifiedDate": "2026-06-17T06:51:04.107Z" }, { "VulnerabilityID": "CVE-2024-31578", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-31578", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7c527716643d14900ad1e6b193ca51feb1420adb6bc919cc20db8fca4d080945", "Title": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free ...", "Description": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "julia": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179", "https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7", "https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2024-31578" ], "PublishedDate": "2024-04-17T14:15:08.563Z", "LastModifiedDate": "2026-06-17T07:28:36.03Z" }, { "VulnerabilityID": "CVE-2024-35369", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-35369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:429d894f38c78ce11155d4d321ad92e6bbee6d3a5943cb3d065137b99a1dcfda", "Title": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c m ...", "Description": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8", "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423", "https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c" ], "PublishedDate": "2024-11-29T17:15:07.707Z", "LastModifiedDate": "2026-06-17T07:34:49.86Z" }, { "VulnerabilityID": "CVE-2025-10256", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-10256", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6d9697b7327ff1554a6751b0e7a8c0728c63880b83c32b4ba8087c45992ed301", "Title": "ffmpeg: NULL pointer dereference in Firequalizer filter (libavfilter/af_firequalizer.c)", "Description": "A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-10256", "https://bugzilla.redhat.com/show_bug.cgi?id=2394495", "https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931", "https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a", "https://nvd.nist.gov/vuln/detail/CVE-2025-10256", "https://ubuntu.com/security/notices/USN-7830-1", "https://www.cve.org/CVERecord?id=CVE-2025-10256" ], "PublishedDate": "2026-02-18T21:16:20.183Z", "LastModifiedDate": "2026-06-17T08:28:00.503Z" }, { "VulnerabilityID": "CVE-2025-22921", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0ecff210eb067f28fd988a4331aac50d68e4fb783b941f4efac4c788f3bb1de1", "Title": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a seg ...", "Description": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html", "https://trac.ffmpeg.org/ticket/11393", "https://ubuntu.com/security/notices/USN-7538-1", "https://www.cve.org/CVERecord?id=CVE-2025-22921" ], "PublishedDate": "2025-02-18T22:15:18.04Z", "LastModifiedDate": "2026-06-17T08:50:59.503Z" }, { "VulnerabilityID": "CVE-2026-6385", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6385", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:09e89c61422fea917084b9fdd6406ca1bc7e506764bd92129d34eda2b89062d3", "Title": "ffmpeg: FFmpeg: Denial of Service and potential arbitrary code execution via signed integer overflow in DVD subtitle parser", "Description": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-6385", "https://bugzilla.redhat.com/show_bug.cgi?id=2458764", "https://nvd.nist.gov/vuln/detail/CVE-2026-6385", "https://www.cve.org/CVERecord?id=CVE-2026-6385" ], "PublishedDate": "2026-04-15T20:16:44.23Z", "LastModifiedDate": "2026-06-17T11:00:45.583Z" }, { "VulnerabilityID": "CVE-2026-65703", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65703", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6536ad307fc284b67541244019786de9d0c22cdb57aca756dcd56aa84903c9a8", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via crafted AVI file in TDSC video decoder", "Description": "FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65703", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773", "https://nvd.nist.gov/vuln/detail/CVE-2026-65703", "https://www.cve.org/CVERecord?id=CVE-2026-65703", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder" ], "PublishedDate": "2026-07-23T20:17:21.803Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65704", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65704", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:27b82e3c17cc9ea42b743dc643041860afbb7aebd33afa47b1a665433aba4559", "Title": "ffmpeg: FFmpeg: Heap corruption via crafted ffconcat file can lead to arbitrary code execution", "Description": "FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.", "Severity": "MEDIUM", "CweIDs": [ "CWE-191", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65704", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767", "https://nvd.nist.gov/vuln/detail/CVE-2026-65704", "https://www.cve.org/CVERecord?id=CVE-2026-65704", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder" ], "PublishedDate": "2026-07-23T20:17:21.973Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65705", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65705", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:145f4037a53782e18aa31556fefc6c9a957aea2344a37acfa16279666eed6ee7", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via out-of-bounds write in vf_floodfill video filter", "Description": "FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65705", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780", "https://nvd.nist.gov/vuln/detail/CVE-2026-65705", "https://www.cve.org/CVERecord?id=CVE-2026-65705", "https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame" ], "PublishedDate": "2026-07-23T20:17:22.12Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65706", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65706", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4d41d14ad0dcdf5bf69bb3bd16443bbd50fe467a94f9fba74040e3486a9f3595", "Title": "FFmpeg: FFmpeg: Arbitrary Code Execution via Crafted Video Frame", "Description": "FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65706", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779", "https://nvd.nist.gov/vuln/detail/CVE-2026-65706", "https://www.cve.org/CVERecord?id=CVE-2026-65706", "https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing" ], "PublishedDate": "2026-07-23T20:17:22.257Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-30999", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-30999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:12e9b65b8ee477b8bc201b047cca858f5f1346c380af8f60e97bd013875f9b42", "Title": "FFmpeg: FFmpeg: Denial of Service via heap buffer overflow in av_bprint_finalize()", "Description": "A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.", "Severity": "LOW", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "debian": 1, "julia": 3, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-30999", "https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6", "https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html", "https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c", "https://nvd.nist.gov/vuln/detail/CVE-2026-30999", "https://www.cve.org/CVERecord?id=CVE-2026-30999", "https://www.ffmpeg.org/download.html" ], "PublishedDate": "2026-04-13T15:17:32.827Z", "LastModifiedDate": "2026-06-17T10:33:17.66Z" }, { "VulnerabilityID": "CVE-2024-36615", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-36615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:43ec1be438085cc85fdbd31dc70e118bf4066e218bd4458f2eef6a331b87eaf4", "Title": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Thi ...", "Description": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-362" ], "References": [ "https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb", "https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738", "https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61" ], "PublishedDate": "2024-11-29T19:15:07.703Z", "LastModifiedDate": "2026-06-17T07:37:01.797Z" }, { "VulnerabilityID": "CVE-2026-13858", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13858", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:030ea07fcea1a79a326bb9f7e2747ec41aab05317ad1d57c86c900decbdf32d1", "Title": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 a ...", "Description": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html", "https://issues.chromium.org/issues/507090179" ], "PublishedDate": "2026-06-30T23:17:00.22Z", "LastModifiedDate": "2026-07-01T15:36:19.657Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:809255b4eb0f68dcc9ff6eec3fa8f5b9996d3447fbe4b137b8c51ddf2acefff7", "Title": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vuln ...", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f700fe5d2fd7b0b5bf7dd15e448545cf6709998a148fa4926f0db1b1b9ebd747", "Title": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-415" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ef109d1d1d2b3b6f3932f68cc8f8435c61991f31a42f9a60bc3610f8c90e6108", "Title": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vuln ...", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:940c3efdc06fc08fce97acc0d02e2220b3fd10f4af76cc41d732df46e8623a11", "Title": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerabi ...", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-835" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-07-23T16:17:49.397Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3bc4f01fa7d666464d1136a104ca7b390f0e1f473e9aa47f40e8c730b6915fb0", "Title": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory acce ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-07-23T14:17:41.17Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:eecb872640a7cd128e60ce2bb1da92d260cab2bb5ef8445c9c7705d8bc737423", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66037", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66037", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a5ba52f336a63c9dbc97c569084c6bc05a379167bb41a2738c00d502f2a79896", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolle ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-770" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627", "https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu" ], "PublishedDate": "2026-07-24T20:18:20.573Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66038", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66038", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:007bc7aa07defc66563e90bc37091d749d8409cd69fc10673e554221779cffeb", "Title": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information ...", "Description": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-908" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626", "https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c" ], "PublishedDate": "2026-07-24T20:18:20.727Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3e59c699c34951181b7e4fcd1a2786c8fd869d38caefc080a0d4c8582a35a58c", "Title": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integ ...", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122", "CWE-190" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:89f1760f439c493ab2a6fb8f1dadfcd2b1d3a6d89e5b0534da71c9d1d12decce", "Title": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libavfilter8@7:5.1.9-0+deb12u1", "PkgName": "libavfilter8", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavfilter8@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "c123416896dbe3b" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8562520fda021064f8db51d865c52ba699a615119305f95cea30faa1dafd1670", "Title": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out ...", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1d08d0d804b366b7b3c0db75713396953982d8d969438a08c8c3de2de0d73c3f", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-07-23T12:18:30.933Z" }, { "VulnerabilityID": "CVE-2026-64831", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64831", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b6b6d4c035d9bc1b9794e092168a691899dadb1612d42aab9fd9947d65009fe", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted HEVC/H.265 bitstream", "Description": "FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64831", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665", "https://nvd.nist.gov/vuln/detail/CVE-2026-64831", "https://www.cve.org/CVERecord?id=CVE-2026-64831", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder" ], "PublishedDate": "2026-07-22T17:16:58.697Z", "LastModifiedDate": "2026-07-23T14:17:40.63Z" }, { "VulnerabilityID": "CVE-2026-8461", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0e6276ac7eee9e74ef9095a95bc4e39abd7a45cf5b24788534da09c4bd9e7b36", "Title": "ffmpeg: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder", "Description": "An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-8461", "https://bugzilla.redhat.com/show_bug.cgi?id=2490308", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159", "https://github.com/advisories/GHSA-qff7-4q6c-m8h6", "https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/", "https://nvd.nist.gov/vuln/detail/CVE-2026-8461", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json", "https://www.cve.org/CVERecord?id=CVE-2026-8461" ], "PublishedDate": "2026-06-18T14:17:36.66Z", "LastModifiedDate": "2026-07-23T12:18:51.763Z" }, { "VulnerabilityID": "CVE-2023-49528", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-49528", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3af27cfc81aa54cb56be290260a09642a943bba00e96ab90bd62bb90affe5ab1", "Title": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, al ...", "Description": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component.", "Severity": "MEDIUM", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "ubuntu": 2 }, "References": [ "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://trac.ffmpeg.org/ticket/10691", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2023-49528" ], "PublishedDate": "2024-04-12T06:15:06.32Z", "LastModifiedDate": "2026-06-17T06:36:05.573Z" }, { "VulnerabilityID": "CVE-2023-6601", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6601", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b9a8b2867f6227bc886c7d7040d2f9b42b752e242ded3e05b7311ba57d5741f", "Title": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows by ...", "Description": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-99", "CWE-94" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://bugzilla.redhat.com/show_bug.cgi?id=2253172", "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html", "https://www.cve.org/CVERecord?id=CVE-2023-6601" ], "PublishedDate": "2025-01-06T17:15:14.217Z", "LastModifiedDate": "2026-06-17T06:51:04.107Z" }, { "VulnerabilityID": "CVE-2024-31578", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-31578", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fa5599ca4475bc6c5689a0cfdb9417d5e184956c331143d31db45aa38a0b984c", "Title": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free ...", "Description": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "julia": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179", "https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7", "https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2024-31578" ], "PublishedDate": "2024-04-17T14:15:08.563Z", "LastModifiedDate": "2026-06-17T07:28:36.03Z" }, { "VulnerabilityID": "CVE-2024-35369", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-35369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1e5eb5c074e9bf839871d2e32036ce6336f9fd3e8b218351dac2d6ddeb948c14", "Title": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c m ...", "Description": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8", "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423", "https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c" ], "PublishedDate": "2024-11-29T17:15:07.707Z", "LastModifiedDate": "2026-06-17T07:34:49.86Z" }, { "VulnerabilityID": "CVE-2025-10256", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-10256", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2bb4c883b96999b37326797c248e49dc7b129e38ccf573dfaf2b246704c84223", "Title": "ffmpeg: NULL pointer dereference in Firequalizer filter (libavfilter/af_firequalizer.c)", "Description": "A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-10256", "https://bugzilla.redhat.com/show_bug.cgi?id=2394495", "https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931", "https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a", "https://nvd.nist.gov/vuln/detail/CVE-2025-10256", "https://ubuntu.com/security/notices/USN-7830-1", "https://www.cve.org/CVERecord?id=CVE-2025-10256" ], "PublishedDate": "2026-02-18T21:16:20.183Z", "LastModifiedDate": "2026-06-17T08:28:00.503Z" }, { "VulnerabilityID": "CVE-2025-22921", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cfde4f2a8b12bdecd3bcc1b7f72c6a40e66d6621b5c3ca1bd62170e682316506", "Title": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a seg ...", "Description": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html", "https://trac.ffmpeg.org/ticket/11393", "https://ubuntu.com/security/notices/USN-7538-1", "https://www.cve.org/CVERecord?id=CVE-2025-22921" ], "PublishedDate": "2025-02-18T22:15:18.04Z", "LastModifiedDate": "2026-06-17T08:50:59.503Z" }, { "VulnerabilityID": "CVE-2026-6385", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6385", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b81dbfd0aafbb6b1aa79337000cfc7c9319acc71c44417e3c2f75cd242a89ef8", "Title": "ffmpeg: FFmpeg: Denial of Service and potential arbitrary code execution via signed integer overflow in DVD subtitle parser", "Description": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-6385", "https://bugzilla.redhat.com/show_bug.cgi?id=2458764", "https://nvd.nist.gov/vuln/detail/CVE-2026-6385", "https://www.cve.org/CVERecord?id=CVE-2026-6385" ], "PublishedDate": "2026-04-15T20:16:44.23Z", "LastModifiedDate": "2026-06-17T11:00:45.583Z" }, { "VulnerabilityID": "CVE-2026-65703", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65703", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ccc93ae189435c75ea24df14b78966c7256241d79277b2603ab3c9be1494dce7", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via crafted AVI file in TDSC video decoder", "Description": "FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65703", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773", "https://nvd.nist.gov/vuln/detail/CVE-2026-65703", "https://www.cve.org/CVERecord?id=CVE-2026-65703", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder" ], "PublishedDate": "2026-07-23T20:17:21.803Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65704", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65704", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:86a2af3691734fd3bea64fef20fcce46c0bd5557fb2e7c80fdea1289df5e910d", "Title": "ffmpeg: FFmpeg: Heap corruption via crafted ffconcat file can lead to arbitrary code execution", "Description": "FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.", "Severity": "MEDIUM", "CweIDs": [ "CWE-191", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65704", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767", "https://nvd.nist.gov/vuln/detail/CVE-2026-65704", "https://www.cve.org/CVERecord?id=CVE-2026-65704", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder" ], "PublishedDate": "2026-07-23T20:17:21.973Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65705", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65705", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a9592e3336797da37ae67ae98bffe97b5353f294c0597c6812f052bf232c39e7", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via out-of-bounds write in vf_floodfill video filter", "Description": "FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65705", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780", "https://nvd.nist.gov/vuln/detail/CVE-2026-65705", "https://www.cve.org/CVERecord?id=CVE-2026-65705", "https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame" ], "PublishedDate": "2026-07-23T20:17:22.12Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65706", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65706", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:40b5b5866601e4194007c088f00c1b214c1d59a97463ef5ecae59a7f568c1c38", "Title": "FFmpeg: FFmpeg: Arbitrary Code Execution via Crafted Video Frame", "Description": "FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65706", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779", "https://nvd.nist.gov/vuln/detail/CVE-2026-65706", "https://www.cve.org/CVERecord?id=CVE-2026-65706", "https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing" ], "PublishedDate": "2026-07-23T20:17:22.257Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-30999", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-30999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1e3fe2b4cb43b999a896cce0c15b136c348047e16f25ff16cb02e764b0ddebd4", "Title": "FFmpeg: FFmpeg: Denial of Service via heap buffer overflow in av_bprint_finalize()", "Description": "A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.", "Severity": "LOW", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "debian": 1, "julia": 3, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-30999", "https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6", "https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html", "https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c", "https://nvd.nist.gov/vuln/detail/CVE-2026-30999", "https://www.cve.org/CVERecord?id=CVE-2026-30999", "https://www.ffmpeg.org/download.html" ], "PublishedDate": "2026-04-13T15:17:32.827Z", "LastModifiedDate": "2026-06-17T10:33:17.66Z" }, { "VulnerabilityID": "CVE-2024-36615", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-36615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f99822d164b12c4b75760a53d032e7d24e573af12bfe052b33b3698037ff905d", "Title": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Thi ...", "Description": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-362" ], "References": [ "https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb", "https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738", "https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61" ], "PublishedDate": "2024-11-29T19:15:07.703Z", "LastModifiedDate": "2026-06-17T07:37:01.797Z" }, { "VulnerabilityID": "CVE-2026-13858", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13858", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7f364d462b329fbc9aec28c6c0d4fa3fdf397420e61852d1abc0f60540c470c7", "Title": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 a ...", "Description": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html", "https://issues.chromium.org/issues/507090179" ], "PublishedDate": "2026-06-30T23:17:00.22Z", "LastModifiedDate": "2026-07-01T15:36:19.657Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0697f753ca0b38d8ee233facc7ef653e89b170b5cb294148a8575c42a5c5fb50", "Title": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vuln ...", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:23392010b4289e37948847cd275408367e42823c926d34d724c6444469948782", "Title": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-415" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bdd0816de479c0410b59e04df856fd92fe750c6f9188dc14209b9612cf0d2cba", "Title": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vuln ...", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4b97347e985081ea50246192847dad44eb73272cdc1d3d74614591b1c54f8b51", "Title": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerabi ...", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-835" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-07-23T16:17:49.397Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d9b09bb769e385c3bea5fc8438b59853378d2c907f818c59f3843c6b203fa69b", "Title": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory acce ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-07-23T14:17:41.17Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4682a5a40a25c653111e7b4fd6eed64f12f8cfa2bbb5d883d39e45578601dc35", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66037", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66037", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c03cdc5c9ed5a3cfe17580183ed04bf4d695e4860877cfc86f3c8f970ee5b252", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolle ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-770" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627", "https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu" ], "PublishedDate": "2026-07-24T20:18:20.573Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66038", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66038", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:129ab9b410084f2a80585280c6972a769e105782ee4baaa1175a3357f76409df", "Title": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information ...", "Description": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-908" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626", "https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c" ], "PublishedDate": "2026-07-24T20:18:20.727Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:344b97bc5af1f3850cb9ec4f695a2bb330be6f0813d792164da58ab5891b9e23", "Title": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integ ...", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122", "CWE-190" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:36476a13efce147885709355b2b1e3ee52c429eb38ccb3ea2a886c6f7d36601f", "Title": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libavformat59@7:5.1.9-0+deb12u1", "PkgName": "libavformat59", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavformat59@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5487e12bc7eb1a0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:30d01df2e9e48a1ee7e3037322ad4b7c98e616d93e800c52f15120e2114b0eff", "Title": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out ...", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c7cb7df9fc4d1ce4bbe2e620d6d8c6991609fc7fa6f25fd7e8ef93406ae348cc", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-07-23T12:18:30.933Z" }, { "VulnerabilityID": "CVE-2026-64831", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64831", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d2f95d36467dfbabc465fefc34ca5fbccc8b10f2f700929924ce3f1d09dd6867", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted HEVC/H.265 bitstream", "Description": "FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64831", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665", "https://nvd.nist.gov/vuln/detail/CVE-2026-64831", "https://www.cve.org/CVERecord?id=CVE-2026-64831", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder" ], "PublishedDate": "2026-07-22T17:16:58.697Z", "LastModifiedDate": "2026-07-23T14:17:40.63Z" }, { "VulnerabilityID": "CVE-2026-8461", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b874871a51fdec05bd1f05c4c437d379f6deee444b830f997de00d199533bc0a", "Title": "ffmpeg: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder", "Description": "An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-8461", "https://bugzilla.redhat.com/show_bug.cgi?id=2490308", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159", "https://github.com/advisories/GHSA-qff7-4q6c-m8h6", "https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/", "https://nvd.nist.gov/vuln/detail/CVE-2026-8461", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json", "https://www.cve.org/CVERecord?id=CVE-2026-8461" ], "PublishedDate": "2026-06-18T14:17:36.66Z", "LastModifiedDate": "2026-07-23T12:18:51.763Z" }, { "VulnerabilityID": "CVE-2023-49528", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-49528", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:81b961b47dbd4c720dd86a02ca93fa9008b889d1cd8b9649dc1ea830b8cb1585", "Title": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, al ...", "Description": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component.", "Severity": "MEDIUM", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "ubuntu": 2 }, "References": [ "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://trac.ffmpeg.org/ticket/10691", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2023-49528" ], "PublishedDate": "2024-04-12T06:15:06.32Z", "LastModifiedDate": "2026-06-17T06:36:05.573Z" }, { "VulnerabilityID": "CVE-2023-6601", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6601", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8564b9ada374a42d5da5ad014f14b86f2ea5c6c33590a977b4e16fd17e956c71", "Title": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows by ...", "Description": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-99", "CWE-94" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://bugzilla.redhat.com/show_bug.cgi?id=2253172", "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html", "https://www.cve.org/CVERecord?id=CVE-2023-6601" ], "PublishedDate": "2025-01-06T17:15:14.217Z", "LastModifiedDate": "2026-06-17T06:51:04.107Z" }, { "VulnerabilityID": "CVE-2024-31578", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-31578", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d9228128173f6f28d434889879463f6ea05714cafcf6affbae8fe52d8a798ae0", "Title": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free ...", "Description": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "julia": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179", "https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7", "https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2024-31578" ], "PublishedDate": "2024-04-17T14:15:08.563Z", "LastModifiedDate": "2026-06-17T07:28:36.03Z" }, { "VulnerabilityID": "CVE-2024-35369", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-35369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:201a7145bcb16f8f7e4141dde1c1a6e2839f975cb4b9250776f1d42479593f00", "Title": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c m ...", "Description": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8", "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423", "https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c" ], "PublishedDate": "2024-11-29T17:15:07.707Z", "LastModifiedDate": "2026-06-17T07:34:49.86Z" }, { "VulnerabilityID": "CVE-2025-10256", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-10256", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7212c257144dbdec6f5c43825da024b34ee43b070932ff37dc7aacb897f0a4e1", "Title": "ffmpeg: NULL pointer dereference in Firequalizer filter (libavfilter/af_firequalizer.c)", "Description": "A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-10256", "https://bugzilla.redhat.com/show_bug.cgi?id=2394495", "https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931", "https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a", "https://nvd.nist.gov/vuln/detail/CVE-2025-10256", "https://ubuntu.com/security/notices/USN-7830-1", "https://www.cve.org/CVERecord?id=CVE-2025-10256" ], "PublishedDate": "2026-02-18T21:16:20.183Z", "LastModifiedDate": "2026-06-17T08:28:00.503Z" }, { "VulnerabilityID": "CVE-2025-22921", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3b79335ac999f37de5bb046a5d333e9c104d16a0ed357ba7e69b46a8ec06a7c1", "Title": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a seg ...", "Description": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html", "https://trac.ffmpeg.org/ticket/11393", "https://ubuntu.com/security/notices/USN-7538-1", "https://www.cve.org/CVERecord?id=CVE-2025-22921" ], "PublishedDate": "2025-02-18T22:15:18.04Z", "LastModifiedDate": "2026-06-17T08:50:59.503Z" }, { "VulnerabilityID": "CVE-2026-6385", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6385", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7be56fb57ab880b95595f7bc6562dc8d66009a381cdc17d721aa02a6b9948ca1", "Title": "ffmpeg: FFmpeg: Denial of Service and potential arbitrary code execution via signed integer overflow in DVD subtitle parser", "Description": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-6385", "https://bugzilla.redhat.com/show_bug.cgi?id=2458764", "https://nvd.nist.gov/vuln/detail/CVE-2026-6385", "https://www.cve.org/CVERecord?id=CVE-2026-6385" ], "PublishedDate": "2026-04-15T20:16:44.23Z", "LastModifiedDate": "2026-06-17T11:00:45.583Z" }, { "VulnerabilityID": "CVE-2026-65703", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65703", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:010ba8ddbacbaea7e7a47702d1a1997482ef045351ee2cc4afd95766dd88341d", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via crafted AVI file in TDSC video decoder", "Description": "FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65703", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773", "https://nvd.nist.gov/vuln/detail/CVE-2026-65703", "https://www.cve.org/CVERecord?id=CVE-2026-65703", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder" ], "PublishedDate": "2026-07-23T20:17:21.803Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65704", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65704", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5213940bc8e04e6a890a1e6a7966c2fe27b52b5f1797ea01bc3d03d3ef423da0", "Title": "ffmpeg: FFmpeg: Heap corruption via crafted ffconcat file can lead to arbitrary code execution", "Description": "FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.", "Severity": "MEDIUM", "CweIDs": [ "CWE-191", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65704", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767", "https://nvd.nist.gov/vuln/detail/CVE-2026-65704", "https://www.cve.org/CVERecord?id=CVE-2026-65704", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder" ], "PublishedDate": "2026-07-23T20:17:21.973Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65705", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65705", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9012dc52b1270a2252c9365e1d4dee9cf0e2ad47628a8c859bef52194a1ee3fa", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via out-of-bounds write in vf_floodfill video filter", "Description": "FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65705", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780", "https://nvd.nist.gov/vuln/detail/CVE-2026-65705", "https://www.cve.org/CVERecord?id=CVE-2026-65705", "https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame" ], "PublishedDate": "2026-07-23T20:17:22.12Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65706", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65706", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d2d0a6fb670dca3cd54d72a85b03f8fdc1c1ef1a061d996db336586d36bebfd0", "Title": "FFmpeg: FFmpeg: Arbitrary Code Execution via Crafted Video Frame", "Description": "FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65706", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779", "https://nvd.nist.gov/vuln/detail/CVE-2026-65706", "https://www.cve.org/CVERecord?id=CVE-2026-65706", "https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing" ], "PublishedDate": "2026-07-23T20:17:22.257Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-30999", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-30999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:569c4ffc215d2b9edd03b49f740c415e607dd6d41b0366bdb95e19ddd8724e73", "Title": "FFmpeg: FFmpeg: Denial of Service via heap buffer overflow in av_bprint_finalize()", "Description": "A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.", "Severity": "LOW", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "debian": 1, "julia": 3, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-30999", "https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6", "https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html", "https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c", "https://nvd.nist.gov/vuln/detail/CVE-2026-30999", "https://www.cve.org/CVERecord?id=CVE-2026-30999", "https://www.ffmpeg.org/download.html" ], "PublishedDate": "2026-04-13T15:17:32.827Z", "LastModifiedDate": "2026-06-17T10:33:17.66Z" }, { "VulnerabilityID": "CVE-2024-36615", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-36615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b76919d4e7d08b557d9fbccd7e675ac01fc02f06e037e7b5771fbc4bce47e0f0", "Title": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Thi ...", "Description": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-362" ], "References": [ "https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb", "https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738", "https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61" ], "PublishedDate": "2024-11-29T19:15:07.703Z", "LastModifiedDate": "2026-06-17T07:37:01.797Z" }, { "VulnerabilityID": "CVE-2026-13858", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13858", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c4499b6acebf8b2c829ac01916f1c5faf721efaf4f5ea189bf87f2da7f9e7c47", "Title": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 a ...", "Description": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html", "https://issues.chromium.org/issues/507090179" ], "PublishedDate": "2026-06-30T23:17:00.22Z", "LastModifiedDate": "2026-07-01T15:36:19.657Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:47726e6fb108198c72f2da2aa4cd778e6af67701d310c6701afef9798256b13e", "Title": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vuln ...", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9529ac57b734f80aefb88beafdbae107b838bd44d0e7ac268addee27ebdfd6c5", "Title": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-415" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cb9d2d5eff7febdece55288c32bc3f1039978cb81d569a7a3b26442bf3304a95", "Title": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vuln ...", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9499e46909c3873485969ae618d75a600b712f463536a80eb6916c2682fb64e1", "Title": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerabi ...", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-835" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-07-23T16:17:49.397Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dceaa17f4850f69c4a27fc93402c1011b05941366dfd775ad27d85ba11376781", "Title": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory acce ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-07-23T14:17:41.17Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd1740bc6a366d09a22a5350c40c83b0f611087841b341dd1107d4570fb3d598", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66037", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66037", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8985a959504c1eea82514933d59a3321aec94b6e58a82084bebb6a9e8d8f3283", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolle ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-770" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627", "https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu" ], "PublishedDate": "2026-07-24T20:18:20.573Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66038", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66038", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aa93e2f9e4bf576974bfd612ce3d0e05e4e1e41784ba2544986b655bb29f93dc", "Title": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information ...", "Description": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-908" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626", "https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c" ], "PublishedDate": "2026-07-24T20:18:20.727Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:259714454d4f6d9e1cdccf8965acfa8bafae31c4a7062656aa150ede9d8c29f2", "Title": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integ ...", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122", "CWE-190" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b87207eabaff853846784d5ffc8f82c1ff3f2d21f0945477b5ffc24a53fbec64", "Title": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libavutil57@7:5.1.9-0+deb12u1", "PkgName": "libavutil57", "PkgIdentifier": { "PURL": "pkg:deb/debian/libavutil57@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "f5bba3ffc4f64900" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:267f746ba9581ce147eb03293f584d8285bb32bd2795eb76fcdb94b421dc3061", "Title": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out ...", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libblkid1@2.38.1-5+deb12u3", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ef2ef32fd8f1c6bb" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a102ab58efe74f5dbf54a5d10e349bb0d538c946edf1250ee60581e7a4fc83cb", "Title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "Description": "Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:\nCVE-2026-53615:\n\tInteger Overflow or Wraparound in libblkid/src/partitions/dos.c\n", "Severity": "HIGH", "VendorSeverity": { "amazon": 3 } }, { "VulnerabilityID": "CVE-2026-13595", "PkgID": "libblkid1@2.38.1-5+deb12u3", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ef2ef32fd8f1c6bb" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13595", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aa7f6680c174a8a197a92e3b6d17b6ac2fe3fb9058e8d3ef24ed64fb140ad26c", "Title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "Description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26573", "https://access.redhat.com/security/cve/CVE-2026-13595", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c", "https://nvd.nist.gov/vuln/detail/CVE-2026-13595", "https://www.cve.org/CVERecord?id=CVE-2026-13595" ], "PublishedDate": "2026-06-29T09:16:28.303Z", "LastModifiedDate": "2026-07-08T03:37:21.637Z" }, { "VulnerabilityID": "CVE-2026-27456", "PkgID": "libblkid1@2.38.1-5+deb12u3", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ef2ef32fd8f1c6bb" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f3a23c39e43e82d77b4cc9d88703a23c70feb27f2d82327fe1c379717f1917e6", "Title": "util-linux: TOCTOU in the mount program when setting up loop devices", "Description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "Severity": "MEDIUM", "CweIDs": [ "CWE-59", "CWE-269", "CWE-367" ], "VendorSeverity": { "azure": 2, "bottlerocket": 2, "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://access.redhat.com/security/cve/CVE-2026-27456", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-jgcxwcxt3sxd.toml", "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g", "https://nvd.nist.gov/vuln/detail/CVE-2026-27456", "https://www.cve.org/CVERecord?id=CVE-2026-27456" ], "PublishedDate": "2026-04-03T22:16:25.4Z", "LastModifiedDate": "2026-07-24T22:10:00.14Z" }, { "VulnerabilityID": "CVE-2026-3184", "PkgID": "libblkid1@2.38.1-5+deb12u3", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ef2ef32fd8f1c6bb" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-3184", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:79a8e43e3c8dbb662ef9ca0c9ff6dafc06a1abfe9724b1e0d82c890c7ee6ceb1", "Title": "util-linux: util-linux: Access control bypass due to improper hostname canonicalization", "Description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "Severity": "MEDIUM", "CweIDs": [ "CWE-289" ], "VendorSeverity": { "azure": 1, "nvd": 2, "photon": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2026-3184", "https://bugzilla.redhat.com/show_bug.cgi?id=2442570", "https://nvd.nist.gov/vuln/detail/CVE-2026-3184", "https://www.cve.org/CVERecord?id=CVE-2026-3184" ], "PublishedDate": "2026-04-03T19:17:23.377Z", "LastModifiedDate": "2026-07-21T19:10:00.107Z" }, { "VulnerabilityID": "CVE-2022-0563", "PkgID": "libblkid1@2.38.1-5+deb12u3", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ef2ef32fd8f1c6bb" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b64709fd979a4e1a7a709e38f4b3e51e3a964979231d125633cb7b57e1f4b2b", "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", "Severity": "LOW", "CweIDs": [ "CWE-209" ], "VendorSeverity": { "amazon": 2, "bottlerocket": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 }, "nvd": { "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V2Score": 1.9, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0563", "https://access.redhat.com/security/cve/CVE-2022-0563", "https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-mv4q-wq4c-5xmg", "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", "https://security.gentoo.org/glsa/202401-08", "https://security.netapp.com/advisory/ntap-20220331-0002/", "https://www.cve.org/CVERecord?id=CVE-2022-0563" ], "PublishedDate": "2022-02-21T19:15:08.393Z", "LastModifiedDate": "2026-06-17T04:20:51.053Z" }, { "VulnerabilityID": "CVE-2025-14104", "PkgID": "libblkid1@2.38.1-5+deb12u3", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ef2ef32fd8f1c6bb" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-14104", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:873e7620269df56c492186347189f930aa8a75f256b4cef9d7e9b49623d9e3ae", "Title": "util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames", "Description": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1696", "https://access.redhat.com/errata/RHSA-2026:1852", "https://access.redhat.com/errata/RHSA-2026:1913", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2737", "https://access.redhat.com/errata/RHSA-2026:2800", "https://access.redhat.com/errata/RHSA-2026:3406", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2025-14104", "https://bugzilla.redhat.com/2419369", "https://bugzilla.redhat.com/show_bug.cgi?id=2419369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14104", "https://errata.almalinux.org/9/ALSA-2026-1913.html", "https://errata.rockylinux.org/RLSA-2026:1913", "https://linux.oracle.com/cve/CVE-2025-14104.html", "https://linux.oracle.com/errata/ELSA-2026-1913.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-14104", "https://www.cve.org/CVERecord?id=CVE-2025-14104" ], "PublishedDate": "2025-12-05T17:16:03.117Z", "LastModifiedDate": "2026-06-30T00:16:53.04Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "libblkid1@2.38.1-5+deb12u3", "PkgName": "libblkid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ef2ef32fd8f1c6bb" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0aa09fbd52420a110ab4929800ddf1ec62a01dc7e8bdad9575a9be0846270dde", "Title": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-42250", "PkgID": "libbz2-1.0@1.0.8-5+b1", "PkgName": "libbz2-1.0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libbz2-1.0@1.0.8-5%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "a9f97ed113aa4026" }, "InstalledVersion": "1.0.8-5+b1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42250", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:adfbbe2cf5860fc92409e21e5033aa39d953abefb054afc1d99fc6b780c899a8", "Title": "bzip2: bzip2: Denial of Service in bzip2recover via a specially crafted file", "Description": "bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "Severity": "MEDIUM", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42250", "https://cert.pl/en/posts/2026/05/CVE-2026-42250/", "https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/", "https://nvd.nist.gov/vuln/detail/CVE-2026-42250", "https://sourceware.org/bzip2/", "https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "https://www.cve.org/CVERecord?id=CVE-2026-42250" ], "PublishedDate": "2026-05-28T14:16:19.89Z", "LastModifiedDate": "2026-06-17T10:47:34.687Z" }, { "VulnerabilityID": "CVE-2026-5435", "PkgID": "libc-bin@2.36-9+deb12u14", "PkgName": "libc-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "fffe74ad3db2b1d6" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5435", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5ee0aaf947d61d5016cf81a73f6a757683ca9064a920f7e4ae8922ef366cfefc", "Title": "glibc: glibc: Out-of-bounds write via TSIG record processing", "Description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "Severity": "MEDIUM", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 2, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42952", "https://access.redhat.com/security/cve/CVE-2026-5435", "https://bugzilla.redhat.com/2459854", "https://bugzilla.redhat.com/2463465", "https://bugzilla.redhat.com/2463539", "https://bugzilla.redhat.com/show_bug.cgi?id=2459854", "https://bugzilla.redhat.com/show_bug.cgi?id=2463465", "https://bugzilla.redhat.com/show_bug.cgi?id=2463539", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5435", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5928", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6238", "https://errata.almalinux.org/9/ALSA-2026-42952.html", "https://errata.rockylinux.org/RLSA-2026:42952", "https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/", "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u", "https://linux.oracle.com/cve/CVE-2026-5435.html", "https://linux.oracle.com/errata/ELSA-2026-42952.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-5435", "https://sourceware.org/bugzilla/show_bug.cgi?id=34033", "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0011", "https://ubuntu.com/security/notices/USN-8611-1", "https://www.cve.org/CVERecord?id=CVE-2026-5435" ], "PublishedDate": "2026-04-28T13:19:22.29Z", "LastModifiedDate": "2026-07-14T13:19:01.36Z" }, { "VulnerabilityID": "CVE-2026-5450", "PkgID": "libc-bin@2.36-9+deb12u14", "PkgName": "libc-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "fffe74ad3db2b1d6" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5450", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:19fa295d5cf2a5c7fa3a033b0e29c0a6601773bfd45031e1fb2c7567d84eea42", "Title": "glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width", "Description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "Severity": "MEDIUM", "CweIDs": [ "CWE-122", "CWE-787" ], "VendorSeverity": { "alma": 2, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H", "V3Score": 5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:33226", "https://access.redhat.com/security/cve/CVE-2026-5450", "https://bugzilla.redhat.com/2459853", "https://bugzilla.redhat.com/show_bug.cgi?id=2459853", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5450", "https://errata.almalinux.org/9/ALSA-2026-33226.html", "https://errata.rockylinux.org/RLSA-2026:33226", "https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u", "https://linux.oracle.com/cve/CVE-2026-5450.html", "https://linux.oracle.com/errata/ELSA-2026-50370.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-5450", "https://nvd.nist.gov/vuln/detail/CVE-2026-5450#range-21286997", "https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450", "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0009", "https://ubuntu.com/security/notices/USN-8611-1", "https://www.cve.org/CVERecord?id=CVE-2026-5450" ], "PublishedDate": "2026-04-20T21:16:36.85Z", "LastModifiedDate": "2026-07-14T13:19:01.52Z" }, { "VulnerabilityID": "CVE-2026-5928", "PkgID": "libc-bin@2.36-9+deb12u14", "PkgName": "libc-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "fffe74ad3db2b1d6" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5928", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fbfa949d967707db3b256b5e0f48f9c61d880e3ce16403816028c32082803fae", "Title": "glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings", "Description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.\n\nA bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp-\u003e_IO_read_ptr) instead of the actual wide-stream read pointer (fp-\u003e_wide_data-\u003e_IO_read_ptr). The program crash may happen in cases where fp-\u003e_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "Severity": "MEDIUM", "CweIDs": [ "CWE-127" ], "VendorSeverity": { "alma": 2, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H", "V3Score": 5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42952", "https://access.redhat.com/security/cve/CVE-2026-5928", "https://bugzilla.redhat.com/2459854", "https://bugzilla.redhat.com/2463465", "https://bugzilla.redhat.com/2463539", "https://bugzilla.redhat.com/show_bug.cgi?id=2459854", "https://bugzilla.redhat.com/show_bug.cgi?id=2463465", "https://bugzilla.redhat.com/show_bug.cgi?id=2463539", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5435", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5928", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6238", "https://errata.almalinux.org/9/ALSA-2026-42952.html", "https://errata.rockylinux.org/RLSA-2026:42952", "https://linux.oracle.com/cve/CVE-2026-5928.html", "https://linux.oracle.com/errata/ELSA-2026-42952.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-5928", "https://sourceware.org/bugzilla/show_bug.cgi?id=33998", "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0010", "https://ubuntu.com/security/notices/USN-8611-1", "https://www.cve.org/CVERecord?id=CVE-2026-5928" ], "PublishedDate": "2026-04-20T21:16:36.963Z", "LastModifiedDate": "2026-07-14T13:19:01.69Z" }, { "VulnerabilityID": "CVE-2026-6238", "PkgID": "libc-bin@2.36-9+deb12u14", "PkgName": "libc-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "fffe74ad3db2b1d6" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6238", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:28246bf9ae73d391495c4aab4c179589a45741dcfd3daad6b671565b65d656dc", "Title": "glibc: glibc: Application crash or uninitialized memory read via crafted DNS response", "Description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "alma": 2, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42952", "https://access.redhat.com/security/cve/CVE-2026-6238", "https://bugzilla.redhat.com/2459854", "https://bugzilla.redhat.com/2463465", "https://bugzilla.redhat.com/2463539", "https://bugzilla.redhat.com/show_bug.cgi?id=2459854", "https://bugzilla.redhat.com/show_bug.cgi?id=2463465", "https://bugzilla.redhat.com/show_bug.cgi?id=2463539", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5435", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5928", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6238", "https://errata.almalinux.org/9/ALSA-2026-42952.html", "https://errata.rockylinux.org/RLSA-2026:42952", "https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/", "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u", "https://linux.oracle.com/cve/CVE-2026-6238.html", "https://linux.oracle.com/errata/ELSA-2026-42952.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-6238", "https://sourceware.org/bugzilla/show_bug.cgi?id=34069", "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0012", "https://ubuntu.com/security/notices/USN-8611-1", "https://www.cve.org/CVERecord?id=CVE-2026-6238" ], "PublishedDate": "2026-04-28T19:37:47.523Z", "LastModifiedDate": "2026-07-14T13:19:09.2Z" }, { "VulnerabilityID": "CVE-2010-4756", "PkgID": "libc-bin@2.36-9+deb12u14", "PkgName": "libc-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "fffe74ad3db2b1d6" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2010-4756", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c95848b23192cb984eb8073524710a7f052ca1818eba3d95604db161de0f43f6", "Title": "glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions", "Description": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.", "Severity": "LOW", "CweIDs": [ "CWE-399" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "V2Score": 4 }, "redhat": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V2Score": 5 } }, "References": [ "http://cxib.net/stuff/glob-0day.c", "http://securityreason.com/achievement_securityalert/89", "http://securityreason.com/exploitalert/9223", "https://access.redhat.com/security/cve/CVE-2010-4756", "https://bugzilla.redhat.com/show_bug.cgi?id=681681", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756", "https://nvd.nist.gov/vuln/detail/CVE-2010-4756", "https://security.netapp.com/advisory/ntap-20241108-0002/", "https://www.cve.org/CVERecord?id=CVE-2010-4756" ], "PublishedDate": "2011-03-02T20:00:01.037Z", "LastModifiedDate": "2026-04-29T01:13:23.04Z" }, { "VulnerabilityID": "CVE-2018-20796", "PkgID": "libc-bin@2.36-9+deb12u14", "PkgName": "libc-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "fffe74ad3db2b1d6" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20796", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6ac17e8f6f89cba469ba427647735f6357885c5a33ad1f0b31ed6912330e57d6", "Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c", "Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.", "Severity": "LOW", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "cbl-mariner": 3, "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "http://www.securityfocus.com/bid/107160", "https://access.redhat.com/security/cve/CVE-2018-20796", "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141", "https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html", "https://nvd.nist.gov/vuln/detail/CVE-2018-20796", "https://security.netapp.com/advisory/ntap-20190315-0002/", "https://support.f5.com/csp/article/K26346590?utm_source=f5support\u0026amp%3Butm_medium=RSS", "https://www.cve.org/CVERecord?id=CVE-2018-20796" ], "PublishedDate": "2019-02-26T02:29:00.45Z", "LastModifiedDate": "2026-06-17T01:53:29.553Z" }, { "VulnerabilityID": "CVE-2019-1010022", "PkgID": "libc-bin@2.36-9+deb12u14", "PkgName": "libc-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "fffe74ad3db2b1d6" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010022", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8d03d113a3ae1371f0b9ae9d5d5f26c77416396456b27520355ca30b8b6d971b", "Title": "glibc: stack guard protection bypass", "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.", "Severity": "LOW", "CweIDs": [ "CWE-119" ], "VendorSeverity": { "debian": 1, "nvd": 4 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V2Score": 7.5, "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-1010022", "https://nvd.nist.gov/vuln/detail/CVE-2019-1010022", "https://security-tracker.debian.org/tracker/CVE-2019-1010022", "https://sourceware.org/bugzilla/show_bug.cgi?id=22850", "https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3", "https://ubuntu.com/security/CVE-2019-1010022", "https://www.cve.org/CVERecord?id=CVE-2019-1010022" ], "PublishedDate": "2019-07-15T04:15:13.317Z", "LastModifiedDate": "2026-06-17T02:09:43.957Z" }, { "VulnerabilityID": "CVE-2019-1010023", "PkgID": "libc-bin@2.36-9+deb12u14", "PkgName": "libc-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "fffe74ad3db2b1d6" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010023", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:753c22a77ed14c3de314b318797cf081a518c42ba31d6678ef75118783500122", "Title": "glibc: running ldd on malicious ELF leads to code execution because of wrong size computation", "Description": "GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.", "Severity": "LOW", "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V2Score": 6.8, "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.securityfocus.com/bid/109167", "https://access.redhat.com/security/cve/CVE-2019-1010023", "https://nvd.nist.gov/vuln/detail/CVE-2019-1010023", "https://security-tracker.debian.org/tracker/CVE-2019-1010023", "https://sourceware.org/bugzilla/show_bug.cgi?id=22851", "https://support.f5.com/csp/article/K11932200?utm_source=f5support\u0026amp%3Butm_medium=RSS", "https://ubuntu.com/security/CVE-2019-1010023", "https://www.cve.org/CVERecord?id=CVE-2019-1010023" ], "PublishedDate": "2019-07-15T04:15:13.397Z", "LastModifiedDate": "2026-06-17T02:09:44.09Z" }, { "VulnerabilityID": "CVE-2019-1010024", "PkgID": "libc-bin@2.36-9+deb12u14", "PkgName": "libc-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "fffe74ad3db2b1d6" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010024", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:74fc9e9550c39d901e6a434a47e18d32bbf2e46ff3dca8052dc9e08405dd7105", "Title": "glibc: ASLR bypass using cache of thread stack and heap", "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.", "Severity": "LOW", "CweIDs": [ "CWE-200" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V2Score": 5, "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 } }, "References": [ "http://www.securityfocus.com/bid/109162", "https://access.redhat.com/security/cve/CVE-2019-1010024", "https://nvd.nist.gov/vuln/detail/CVE-2019-1010024", "https://security-tracker.debian.org/tracker/CVE-2019-1010024", "https://sourceware.org/bugzilla/show_bug.cgi?id=22852", "https://support.f5.com/csp/article/K06046097", "https://support.f5.com/csp/article/K06046097?utm_source=f5support\u0026amp%3Butm_medium=RSS", "https://ubuntu.com/security/CVE-2019-1010024", "https://www.cve.org/CVERecord?id=CVE-2019-1010024" ], "PublishedDate": "2019-07-15T04:15:13.473Z", "LastModifiedDate": "2026-06-17T02:09:44.273Z" }, { "VulnerabilityID": "CVE-2019-1010025", "PkgID": "libc-bin@2.36-9+deb12u14", "PkgName": "libc-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "fffe74ad3db2b1d6" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010025", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b52e59c9cc313caee9e7a16faafc494d64afcb17a6a66bcf607dcd727d5a9ac", "Title": "glibc: information disclosure of heap addresses of pthread_created thread", "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.", "Severity": "LOW", "CweIDs": [ "CWE-330" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V2Score": 5, "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 2.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-1010025", "https://nvd.nist.gov/vuln/detail/CVE-2019-1010025", "https://security-tracker.debian.org/tracker/CVE-2019-1010025", "https://sourceware.org/bugzilla/show_bug.cgi?id=22853", "https://support.f5.com/csp/article/K06046097", "https://support.f5.com/csp/article/K06046097?utm_source=f5support\u0026amp%3Butm_medium=RSS", "https://ubuntu.com/security/CVE-2019-1010025", "https://www.cve.org/CVERecord?id=CVE-2019-1010025" ], "PublishedDate": "2019-07-15T04:15:13.537Z", "LastModifiedDate": "2026-06-17T02:09:44.397Z" }, { "VulnerabilityID": "CVE-2019-9192", "PkgID": "libc-bin@2.36-9+deb12u14", "PkgName": "libc-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "fffe74ad3db2b1d6" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9192", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1bf1886c17fb2b850e8dc4dbb3bee972182a4f9dea36cb0f4221db4aab96aa27", "Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c", "Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern", "Severity": "LOW", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "cbl-mariner": 3, "debian": 1, "nvd": 3, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "V3Score": 2.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-9192", "https://nvd.nist.gov/vuln/detail/CVE-2019-9192", "https://sourceware.org/bugzilla/show_bug.cgi?id=24269", "https://support.f5.com/csp/article/K26346590?utm_source=f5support\u0026amp%3Butm_medium=RSS", "https://www.cve.org/CVERecord?id=CVE-2019-9192" ], "PublishedDate": "2019-02-26T18:29:00.34Z", "LastModifiedDate": "2026-06-17T02:43:19.643Z" }, { "VulnerabilityID": "CVE-2026-5435", "PkgID": "libc6@2.36-9+deb12u14", "PkgName": "libc6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "348ed513aa2cf7e9" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5435", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c72768ffeee171f55170814f885260b755fa4a092bb3a07a6eb9a9b34b3b4bc1", "Title": "glibc: glibc: Out-of-bounds write via TSIG record processing", "Description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "Severity": "MEDIUM", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 2, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42952", "https://access.redhat.com/security/cve/CVE-2026-5435", "https://bugzilla.redhat.com/2459854", "https://bugzilla.redhat.com/2463465", "https://bugzilla.redhat.com/2463539", "https://bugzilla.redhat.com/show_bug.cgi?id=2459854", "https://bugzilla.redhat.com/show_bug.cgi?id=2463465", "https://bugzilla.redhat.com/show_bug.cgi?id=2463539", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5435", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5928", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6238", "https://errata.almalinux.org/9/ALSA-2026-42952.html", "https://errata.rockylinux.org/RLSA-2026:42952", "https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/", "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u", "https://linux.oracle.com/cve/CVE-2026-5435.html", "https://linux.oracle.com/errata/ELSA-2026-42952.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-5435", "https://sourceware.org/bugzilla/show_bug.cgi?id=34033", "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0011", "https://ubuntu.com/security/notices/USN-8611-1", "https://www.cve.org/CVERecord?id=CVE-2026-5435" ], "PublishedDate": "2026-04-28T13:19:22.29Z", "LastModifiedDate": "2026-07-14T13:19:01.36Z" }, { "VulnerabilityID": "CVE-2026-5450", "PkgID": "libc6@2.36-9+deb12u14", "PkgName": "libc6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "348ed513aa2cf7e9" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5450", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b41125e26f138d71e0ac50c23979076215e913f23b325341ec2e203aafdf3ec3", "Title": "glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width", "Description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "Severity": "MEDIUM", "CweIDs": [ "CWE-122", "CWE-787" ], "VendorSeverity": { "alma": 2, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H", "V3Score": 5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:33226", "https://access.redhat.com/security/cve/CVE-2026-5450", "https://bugzilla.redhat.com/2459853", "https://bugzilla.redhat.com/show_bug.cgi?id=2459853", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5450", "https://errata.almalinux.org/9/ALSA-2026-33226.html", "https://errata.rockylinux.org/RLSA-2026:33226", "https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u", "https://linux.oracle.com/cve/CVE-2026-5450.html", "https://linux.oracle.com/errata/ELSA-2026-50370.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-5450", "https://nvd.nist.gov/vuln/detail/CVE-2026-5450#range-21286997", "https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450", "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0009", "https://ubuntu.com/security/notices/USN-8611-1", "https://www.cve.org/CVERecord?id=CVE-2026-5450" ], "PublishedDate": "2026-04-20T21:16:36.85Z", "LastModifiedDate": "2026-07-14T13:19:01.52Z" }, { "VulnerabilityID": "CVE-2026-5928", "PkgID": "libc6@2.36-9+deb12u14", "PkgName": "libc6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "348ed513aa2cf7e9" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5928", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:750c3d857717ca1890bf08d02703405a43b07a63bd47a3d440a659c09678011b", "Title": "glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings", "Description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.\n\nA bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp-\u003e_IO_read_ptr) instead of the actual wide-stream read pointer (fp-\u003e_wide_data-\u003e_IO_read_ptr). The program crash may happen in cases where fp-\u003e_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "Severity": "MEDIUM", "CweIDs": [ "CWE-127" ], "VendorSeverity": { "alma": 2, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H", "V3Score": 5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42952", "https://access.redhat.com/security/cve/CVE-2026-5928", "https://bugzilla.redhat.com/2459854", "https://bugzilla.redhat.com/2463465", "https://bugzilla.redhat.com/2463539", "https://bugzilla.redhat.com/show_bug.cgi?id=2459854", "https://bugzilla.redhat.com/show_bug.cgi?id=2463465", "https://bugzilla.redhat.com/show_bug.cgi?id=2463539", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5435", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5928", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6238", "https://errata.almalinux.org/9/ALSA-2026-42952.html", "https://errata.rockylinux.org/RLSA-2026:42952", "https://linux.oracle.com/cve/CVE-2026-5928.html", "https://linux.oracle.com/errata/ELSA-2026-42952.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-5928", "https://sourceware.org/bugzilla/show_bug.cgi?id=33998", "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0010", "https://ubuntu.com/security/notices/USN-8611-1", "https://www.cve.org/CVERecord?id=CVE-2026-5928" ], "PublishedDate": "2026-04-20T21:16:36.963Z", "LastModifiedDate": "2026-07-14T13:19:01.69Z" }, { "VulnerabilityID": "CVE-2026-6238", "PkgID": "libc6@2.36-9+deb12u14", "PkgName": "libc6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "348ed513aa2cf7e9" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6238", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:611c0ae9bb684385409b33e5dc1c971b289fa797e677c10e7b016ace9dbe4855", "Title": "glibc: glibc: Application crash or uninitialized memory read via crafted DNS response", "Description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "alma": 2, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42952", "https://access.redhat.com/security/cve/CVE-2026-6238", "https://bugzilla.redhat.com/2459854", "https://bugzilla.redhat.com/2463465", "https://bugzilla.redhat.com/2463539", "https://bugzilla.redhat.com/show_bug.cgi?id=2459854", "https://bugzilla.redhat.com/show_bug.cgi?id=2463465", "https://bugzilla.redhat.com/show_bug.cgi?id=2463539", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5435", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5928", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6238", "https://errata.almalinux.org/9/ALSA-2026-42952.html", "https://errata.rockylinux.org/RLSA-2026:42952", "https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/", "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u", "https://linux.oracle.com/cve/CVE-2026-6238.html", "https://linux.oracle.com/errata/ELSA-2026-42952.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-6238", "https://sourceware.org/bugzilla/show_bug.cgi?id=34069", "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0012", "https://ubuntu.com/security/notices/USN-8611-1", "https://www.cve.org/CVERecord?id=CVE-2026-6238" ], "PublishedDate": "2026-04-28T19:37:47.523Z", "LastModifiedDate": "2026-07-14T13:19:09.2Z" }, { "VulnerabilityID": "CVE-2010-4756", "PkgID": "libc6@2.36-9+deb12u14", "PkgName": "libc6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "348ed513aa2cf7e9" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2010-4756", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:42b240b6ffbdf706ce97eebdc2b430e5d134b84e45c2532a2ee7730f06736647", "Title": "glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions", "Description": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.", "Severity": "LOW", "CweIDs": [ "CWE-399" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "V2Score": 4 }, "redhat": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V2Score": 5 } }, "References": [ "http://cxib.net/stuff/glob-0day.c", "http://securityreason.com/achievement_securityalert/89", "http://securityreason.com/exploitalert/9223", "https://access.redhat.com/security/cve/CVE-2010-4756", "https://bugzilla.redhat.com/show_bug.cgi?id=681681", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756", "https://nvd.nist.gov/vuln/detail/CVE-2010-4756", "https://security.netapp.com/advisory/ntap-20241108-0002/", "https://www.cve.org/CVERecord?id=CVE-2010-4756" ], "PublishedDate": "2011-03-02T20:00:01.037Z", "LastModifiedDate": "2026-04-29T01:13:23.04Z" }, { "VulnerabilityID": "CVE-2018-20796", "PkgID": "libc6@2.36-9+deb12u14", "PkgName": "libc6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "348ed513aa2cf7e9" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20796", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2906731645e2e819396ae100730110a47e5932c7ef47245279e67d6f863721c5", "Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c", "Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.", "Severity": "LOW", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "cbl-mariner": 3, "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "http://www.securityfocus.com/bid/107160", "https://access.redhat.com/security/cve/CVE-2018-20796", "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141", "https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html", "https://nvd.nist.gov/vuln/detail/CVE-2018-20796", "https://security.netapp.com/advisory/ntap-20190315-0002/", "https://support.f5.com/csp/article/K26346590?utm_source=f5support\u0026amp%3Butm_medium=RSS", "https://www.cve.org/CVERecord?id=CVE-2018-20796" ], "PublishedDate": "2019-02-26T02:29:00.45Z", "LastModifiedDate": "2026-06-17T01:53:29.553Z" }, { "VulnerabilityID": "CVE-2019-1010022", "PkgID": "libc6@2.36-9+deb12u14", "PkgName": "libc6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "348ed513aa2cf7e9" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010022", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:809c3516c24f7066413c36ef32bd2182169c27404e38b3f0c63e46b2b9d98155", "Title": "glibc: stack guard protection bypass", "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.", "Severity": "LOW", "CweIDs": [ "CWE-119" ], "VendorSeverity": { "debian": 1, "nvd": 4 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V2Score": 7.5, "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-1010022", "https://nvd.nist.gov/vuln/detail/CVE-2019-1010022", "https://security-tracker.debian.org/tracker/CVE-2019-1010022", "https://sourceware.org/bugzilla/show_bug.cgi?id=22850", "https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3", "https://ubuntu.com/security/CVE-2019-1010022", "https://www.cve.org/CVERecord?id=CVE-2019-1010022" ], "PublishedDate": "2019-07-15T04:15:13.317Z", "LastModifiedDate": "2026-06-17T02:09:43.957Z" }, { "VulnerabilityID": "CVE-2019-1010023", "PkgID": "libc6@2.36-9+deb12u14", "PkgName": "libc6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "348ed513aa2cf7e9" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010023", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3564528a80f3591581d8e7eb0deb97e93ed3b06b2726ccf317cc2a7dc319ae2f", "Title": "glibc: running ldd on malicious ELF leads to code execution because of wrong size computation", "Description": "GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.", "Severity": "LOW", "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V2Score": 6.8, "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.securityfocus.com/bid/109167", "https://access.redhat.com/security/cve/CVE-2019-1010023", "https://nvd.nist.gov/vuln/detail/CVE-2019-1010023", "https://security-tracker.debian.org/tracker/CVE-2019-1010023", "https://sourceware.org/bugzilla/show_bug.cgi?id=22851", "https://support.f5.com/csp/article/K11932200?utm_source=f5support\u0026amp%3Butm_medium=RSS", "https://ubuntu.com/security/CVE-2019-1010023", "https://www.cve.org/CVERecord?id=CVE-2019-1010023" ], "PublishedDate": "2019-07-15T04:15:13.397Z", "LastModifiedDate": "2026-06-17T02:09:44.09Z" }, { "VulnerabilityID": "CVE-2019-1010024", "PkgID": "libc6@2.36-9+deb12u14", "PkgName": "libc6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "348ed513aa2cf7e9" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010024", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:36c5c6d19ee2c9afd316b222bd34b224abbdd6a7497ccd629318755c82be3e2a", "Title": "glibc: ASLR bypass using cache of thread stack and heap", "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.", "Severity": "LOW", "CweIDs": [ "CWE-200" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V2Score": 5, "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 } }, "References": [ "http://www.securityfocus.com/bid/109162", "https://access.redhat.com/security/cve/CVE-2019-1010024", "https://nvd.nist.gov/vuln/detail/CVE-2019-1010024", "https://security-tracker.debian.org/tracker/CVE-2019-1010024", "https://sourceware.org/bugzilla/show_bug.cgi?id=22852", "https://support.f5.com/csp/article/K06046097", "https://support.f5.com/csp/article/K06046097?utm_source=f5support\u0026amp%3Butm_medium=RSS", "https://ubuntu.com/security/CVE-2019-1010024", "https://www.cve.org/CVERecord?id=CVE-2019-1010024" ], "PublishedDate": "2019-07-15T04:15:13.473Z", "LastModifiedDate": "2026-06-17T02:09:44.273Z" }, { "VulnerabilityID": "CVE-2019-1010025", "PkgID": "libc6@2.36-9+deb12u14", "PkgName": "libc6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "348ed513aa2cf7e9" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1010025", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e6d11c1fda4c6cf0e2debf1de946e4d2c340453bbd49209f90896048d5ebf693", "Title": "glibc: information disclosure of heap addresses of pthread_created thread", "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.", "Severity": "LOW", "CweIDs": [ "CWE-330" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V2Score": 5, "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 2.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-1010025", "https://nvd.nist.gov/vuln/detail/CVE-2019-1010025", "https://security-tracker.debian.org/tracker/CVE-2019-1010025", "https://sourceware.org/bugzilla/show_bug.cgi?id=22853", "https://support.f5.com/csp/article/K06046097", "https://support.f5.com/csp/article/K06046097?utm_source=f5support\u0026amp%3Butm_medium=RSS", "https://ubuntu.com/security/CVE-2019-1010025", "https://www.cve.org/CVERecord?id=CVE-2019-1010025" ], "PublishedDate": "2019-07-15T04:15:13.537Z", "LastModifiedDate": "2026-06-17T02:09:44.397Z" }, { "VulnerabilityID": "CVE-2019-9192", "PkgID": "libc6@2.36-9+deb12u14", "PkgName": "libc6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12.15", "UID": "348ed513aa2cf7e9" }, "InstalledVersion": "2.36-9+deb12u14", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9192", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c029280ca240872dc9ed6aa5da66911061131bfcafa7dd330969e5c481e70d5", "Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c", "Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern", "Severity": "LOW", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "cbl-mariner": 3, "debian": 1, "nvd": 3, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "V3Score": 2.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-9192", "https://nvd.nist.gov/vuln/detail/CVE-2019-9192", "https://sourceware.org/bugzilla/show_bug.cgi?id=24269", "https://support.f5.com/csp/article/K26346590?utm_source=f5support\u0026amp%3Butm_medium=RSS", "https://www.cve.org/CVERecord?id=CVE-2019-9192" ], "PublishedDate": "2019-02-26T18:29:00.34Z", "LastModifiedDate": "2026-06-17T02:43:19.643Z" }, { "VulnerabilityID": "CVE-2022-0856", "PkgID": "libcaca0@0.99.beta20-3+deb12u1", "PkgName": "libcaca0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcaca0@0.99.beta20-3%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "5e138c1b59ffdbb3" }, "InstalledVersion": "0.99.beta20-3+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0856", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:df59a4e81064e3f0e405f1b7c93b84f2a1682dc2ea7cb76bf5aba46bfafa7af4", "Title": "libcaca is affected by a Divide By Zero issue via img2txt, which allow ...", "Description": "libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service", "Severity": "LOW", "CweIDs": [ "CWE-369" ], "VendorSeverity": { "debian": 1, "nvd": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 } }, "References": [ "https://github.com/cacalabs/libcaca/issues/65", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B3E5GF2LSX2ZEY5JZNM7HXJMLHMY436X/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTDRPVX3HCYLQCLMQ6NNSRC3B7L6WGUM/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MFOFTTMHO666HB3TVHBMCES6GCKG5PPG/", "https://ubuntu.com/security/notices/USN-7943-1", "https://www.cve.org/CVERecord?id=CVE-2022-0856" ], "PublishedDate": "2022-03-10T17:44:57.487Z", "LastModifiedDate": "2026-06-17T04:21:22.763Z" }, { "VulnerabilityID": "CVE-2017-7475", "PkgID": "libcairo-gobject2@1.16.0-7", "PkgName": "libcairo-gobject2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcairo-gobject2@1.16.0-7?arch=amd64\u0026distro=debian-12.15", "UID": "59c30bde839149ea" }, "InstalledVersion": "1.16.0-7", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-7475", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b9b2cfb02e4bf03155132cd039cf298b50b115e25ddb8ed773c88ce40b382a83", "Title": "cairo: NULL pointer dereference with a crafted font file", "Description": "Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1, "ghsa": 2, "nvd": 2, "redhat": 1, "ruby-advisory-db": 2, "ubuntu": 1 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "http://seclists.org/oss-sec/2017/q2/151", "https://access.redhat.com/security/cve/CVE-2017-7475", "https://bugs.freedesktop.org/show_bug.cgi?id=100763", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475", "https://github.com/rcairo/rcairo", "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cairo/CVE-2017-7475.yml", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2017-7475", "https://www.cve.org/CVERecord?id=CVE-2017-7475" ], "PublishedDate": "2017-05-19T20:29:00.207Z", "LastModifiedDate": "2026-06-17T01:24:25.357Z" }, { "VulnerabilityID": "CVE-2018-18064", "PkgID": "libcairo-gobject2@1.16.0-7", "PkgName": "libcairo-gobject2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcairo-gobject2@1.16.0-7?arch=amd64\u0026distro=debian-12.15", "UID": "59c30bde839149ea" }, "InstalledVersion": "1.16.0-7", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-18064", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:53595447db3de0e05be0c92ebe30222c2270ef7dd1affbc7a7c0248c988b918f", "Title": "cairo: Stack-based buffer overflow via parsing of crafted WebKitGTK+ document", "Description": "cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).", "Severity": "LOW", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2018-18064", "https://gitlab.freedesktop.org/cairo/cairo/issues/341", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2018-18064", "https://www.cve.org/CVERecord?id=CVE-2018-18064" ], "PublishedDate": "2018-10-08T18:29:00.27Z", "LastModifiedDate": "2026-06-17T01:46:43.463Z" }, { "VulnerabilityID": "CVE-2019-6461", "PkgID": "libcairo-gobject2@1.16.0-7", "PkgName": "libcairo-gobject2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcairo-gobject2@1.16.0-7?arch=amd64\u0026distro=debian-12.15", "UID": "59c30bde839149ea" }, "InstalledVersion": "1.16.0-7", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-6461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5ac7b4030739768a02b3b4fe5b5533d9c21ec1c7bf1e803a677c8e4e661730e6", "Title": "cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c", "Description": "An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.", "Severity": "LOW", "CweIDs": [ "CWE-617" ], "VendorSeverity": { "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-6461", "https://github.com/TeamSeri0us/pocs/tree/master/gerbv", "https://gitlab.freedesktop.org/cairo/cairo/issues/352", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2019-6461", "https://ubuntu.com/security/notices/USN-8140-1", "https://www.cve.org/CVERecord?id=CVE-2019-6461" ], "PublishedDate": "2019-01-16T18:29:00.51Z", "LastModifiedDate": "2026-06-17T02:39:05.313Z" }, { "VulnerabilityID": "CVE-2019-6462", "PkgID": "libcairo-gobject2@1.16.0-7", "PkgName": "libcairo-gobject2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcairo-gobject2@1.16.0-7?arch=amd64\u0026distro=debian-12.15", "UID": "59c30bde839149ea" }, "InstalledVersion": "1.16.0-7", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-6462", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:abe09ed355103f0a4118f09e2372fd71b5b4a7c98cd3c626ee57bd0b7e6c5174", "Title": "cairo: infinite loop in the function _arc_error_normalized in the file cairo-arc.c", "Description": "An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.", "Severity": "LOW", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-6462", "https://github.com/TeamSeri0us/pocs/tree/master/gerbv", "https://gitlab.freedesktop.org/cairo/cairo/issues/353", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2019-6462", "https://ubuntu.com/security/notices/USN-5407-1", "https://ubuntu.com/security/notices/USN-8140-1", "https://www.cve.org/CVERecord?id=CVE-2019-6462" ], "PublishedDate": "2019-01-16T18:29:00.573Z", "LastModifiedDate": "2026-06-17T02:39:05.423Z" }, { "VulnerabilityID": "CVE-2025-50422", "PkgID": "libcairo-gobject2@1.16.0-7", "PkgName": "libcairo-gobject2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcairo-gobject2@1.16.0-7?arch=amd64\u0026distro=debian-12.15", "UID": "59c30bde839149ea" }, "InstalledVersion": "1.16.0-7", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-50422", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4ada83f2ba4a0a785984f656c73df0221e40c229ae9afb5262e8b3bc9487b2da", "Title": "poppler: Poppler crash on malformed input", "Description": "Cairo through 1.18.4, as used in Poppler through 25.08.0, has an \"unscaled-\u003eface == NULL\" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.", "Severity": "LOW", "CweIDs": [ "CWE-617" ], "VendorSeverity": { "amazon": 2, "redhat": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "http://freedesktop.com", "http://poppler.com", "https://access.redhat.com/security/cve/CVE-2025-50422", "https://github.com/Landw-hub/CVE-2025-50422", "https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/621", "https://gitlab.freedesktop.org/poppler/poppler/-/issues/1591", "https://gitlab.freedesktop.org/poppler/poppler/-/issues/1591#note_3045081", "https://nvd.nist.gov/vuln/detail/CVE-2025-50422", "https://www.cve.org/CVERecord?id=CVE-2025-50422" ], "PublishedDate": "2025-08-04T17:15:30.813Z", "LastModifiedDate": "2026-06-17T09:35:04.097Z" }, { "VulnerabilityID": "CVE-2017-7475", "PkgID": "libcairo2@1.16.0-7", "PkgName": "libcairo2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcairo2@1.16.0-7?arch=amd64\u0026distro=debian-12.15", "UID": "33aa9515f3ad17b4" }, "InstalledVersion": "1.16.0-7", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-7475", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6616f956a94c0c6f8954e96e8f296ebcc5b1269c908c636e4a54e5d8086de3ea", "Title": "cairo: NULL pointer dereference with a crafted font file", "Description": "Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1, "ghsa": 2, "nvd": 2, "redhat": 1, "ruby-advisory-db": 2, "ubuntu": 1 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "http://seclists.org/oss-sec/2017/q2/151", "https://access.redhat.com/security/cve/CVE-2017-7475", "https://bugs.freedesktop.org/show_bug.cgi?id=100763", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475", "https://github.com/rcairo/rcairo", "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cairo/CVE-2017-7475.yml", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2017-7475", "https://www.cve.org/CVERecord?id=CVE-2017-7475" ], "PublishedDate": "2017-05-19T20:29:00.207Z", "LastModifiedDate": "2026-06-17T01:24:25.357Z" }, { "VulnerabilityID": "CVE-2018-18064", "PkgID": "libcairo2@1.16.0-7", "PkgName": "libcairo2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcairo2@1.16.0-7?arch=amd64\u0026distro=debian-12.15", "UID": "33aa9515f3ad17b4" }, "InstalledVersion": "1.16.0-7", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-18064", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:84658f30fc7a7e1b5786269bea9df31fd0cfdcccfbfdfeb985023de37861303c", "Title": "cairo: Stack-based buffer overflow via parsing of crafted WebKitGTK+ document", "Description": "cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).", "Severity": "LOW", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2018-18064", "https://gitlab.freedesktop.org/cairo/cairo/issues/341", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2018-18064", "https://www.cve.org/CVERecord?id=CVE-2018-18064" ], "PublishedDate": "2018-10-08T18:29:00.27Z", "LastModifiedDate": "2026-06-17T01:46:43.463Z" }, { "VulnerabilityID": "CVE-2019-6461", "PkgID": "libcairo2@1.16.0-7", "PkgName": "libcairo2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcairo2@1.16.0-7?arch=amd64\u0026distro=debian-12.15", "UID": "33aa9515f3ad17b4" }, "InstalledVersion": "1.16.0-7", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-6461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3f938c9c77968b6c714337ec4e385be9aa114d73413f27bdc8b5ad47457b45d4", "Title": "cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c", "Description": "An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.", "Severity": "LOW", "CweIDs": [ "CWE-617" ], "VendorSeverity": { "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-6461", "https://github.com/TeamSeri0us/pocs/tree/master/gerbv", "https://gitlab.freedesktop.org/cairo/cairo/issues/352", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2019-6461", "https://ubuntu.com/security/notices/USN-8140-1", "https://www.cve.org/CVERecord?id=CVE-2019-6461" ], "PublishedDate": "2019-01-16T18:29:00.51Z", "LastModifiedDate": "2026-06-17T02:39:05.313Z" }, { "VulnerabilityID": "CVE-2019-6462", "PkgID": "libcairo2@1.16.0-7", "PkgName": "libcairo2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcairo2@1.16.0-7?arch=amd64\u0026distro=debian-12.15", "UID": "33aa9515f3ad17b4" }, "InstalledVersion": "1.16.0-7", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-6462", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:223279cb4b51139705d7a8ff9f69c9383babafcf7408f557e4ac5e250de0138a", "Title": "cairo: infinite loop in the function _arc_error_normalized in the file cairo-arc.c", "Description": "An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.", "Severity": "LOW", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2019-6462", "https://github.com/TeamSeri0us/pocs/tree/master/gerbv", "https://gitlab.freedesktop.org/cairo/cairo/issues/353", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2019-6462", "https://ubuntu.com/security/notices/USN-5407-1", "https://ubuntu.com/security/notices/USN-8140-1", "https://www.cve.org/CVERecord?id=CVE-2019-6462" ], "PublishedDate": "2019-01-16T18:29:00.573Z", "LastModifiedDate": "2026-06-17T02:39:05.423Z" }, { "VulnerabilityID": "CVE-2025-50422", "PkgID": "libcairo2@1.16.0-7", "PkgName": "libcairo2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcairo2@1.16.0-7?arch=amd64\u0026distro=debian-12.15", "UID": "33aa9515f3ad17b4" }, "InstalledVersion": "1.16.0-7", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-50422", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6b3e661398402668d4918c8de2d20e821b930f7f9018720eb8456f7341be2544", "Title": "poppler: Poppler crash on malformed input", "Description": "Cairo through 1.18.4, as used in Poppler through 25.08.0, has an \"unscaled-\u003eface == NULL\" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.", "Severity": "LOW", "CweIDs": [ "CWE-617" ], "VendorSeverity": { "amazon": 2, "redhat": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "http://freedesktop.com", "http://poppler.com", "https://access.redhat.com/security/cve/CVE-2025-50422", "https://github.com/Landw-hub/CVE-2025-50422", "https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/621", "https://gitlab.freedesktop.org/poppler/poppler/-/issues/1591", "https://gitlab.freedesktop.org/poppler/poppler/-/issues/1591#note_3045081", "https://nvd.nist.gov/vuln/detail/CVE-2025-50422", "https://www.cve.org/CVERecord?id=CVE-2025-50422" ], "PublishedDate": "2025-08-04T17:15:30.813Z", "LastModifiedDate": "2026-06-17T09:35:04.097Z" }, { "VulnerabilityID": "CVE-2026-16554", "PkgID": "libcjson1@1.7.15-1+deb12u4", "PkgName": "libcjson1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libcjson1@1.7.15-1%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "2964162759c39c15" }, "InstalledVersion": "1.7.15-1+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16554", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:17efb05da1a8c95f523bbef9a9c6d377f6c2653022f5e7e9d1a7cc90506b7970", "Title": "cJSON: cJSON: Remote code execution due to integer overflow via crafted JSON", "Description": "cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.\n\n\n\n\nBecause project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16554", "https://cert.pl/en/posts/2026/07/CVE-2026-16554", "https://github.com/DaveGamble/cJSON", "https://nvd.nist.gov/vuln/detail/CVE-2026-16554", "https://www.cve.org/CVERecord?id=CVE-2026-16554" ], "PublishedDate": "2026-07-27T09:16:37.383Z", "LastModifiedDate": "2026-07-27T12:16:43.057Z" }, { "VulnerabilityID": "CVE-2023-32570", "PkgID": "libdav1d6@1.0.0-2+deb12u1", "PkgName": "libdav1d6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libdav1d6@1.0.0-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "867667e06260a7da" }, "InstalledVersion": "1.0.0-2+deb12u1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-32570", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2a17e63b683483c29a9c42541ea3d232cb059210e930a2ae5a6532a5ccf0dfbc", "Title": "VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that ca ...", "Description": "VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.", "Severity": "MEDIUM", "CweIDs": [ "CWE-362" ], "VendorSeverity": { "nvd": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa", "https://code.videolan.org/videolan/dav1d/-/tags/1.2.0", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP/", "https://security.gentoo.org/glsa/202310-05", "https://www.cve.org/CVERecord?id=CVE-2023-32570" ], "PublishedDate": "2023-05-10T05:15:12.19Z", "LastModifiedDate": "2026-06-17T05:59:08.593Z" }, { "VulnerabilityID": "CVE-2024-25260", "PkgID": "libelf1@0.188-2.1", "PkgName": "libelf1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libelf1@0.188-2.1?arch=amd64\u0026distro=debian-12.15", "UID": "c6c69bc70a4c3977" }, "InstalledVersion": "0.188-2.1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-25260", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a3c4e806caeb1a5f8115218ae19efd928a68d84fb323d833e3f50c259c75672a", "Title": "elfutils: global-buffer-overflow exists in the function ebl_machine_flag_name in eblmachineflagname.c", "Description": "elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "azure": 2, "debian": 1, "redhat": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-25260", "https://github.com/schsiung/fuzzer_issues/issues/1", "https://nvd.nist.gov/vuln/detail/CVE-2024-25260", "https://sourceware.org/bugzilla/show_bug.cgi?id=31058", "https://sourceware.org/elfutils/", "https://ubuntu.com/security/notices/USN-7369-1", "https://www.cve.org/CVERecord?id=CVE-2024-25260" ], "PublishedDate": "2024-02-20T18:15:52.88Z", "LastModifiedDate": "2026-06-17T07:15:47.303Z" }, { "VulnerabilityID": "CVE-2025-1352", "PkgID": "libelf1@0.188-2.1", "PkgName": "libelf1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libelf1@0.188-2.1?arch=amd64\u0026distro=debian-12.15", "UID": "c6c69bc70a4c3977" }, "InstalledVersion": "0.188-2.1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-1352", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dbdd2d955da3dd13ef11df033e42a060f319b80c1a597642984410cbf6e78ff1", "Title": "elfutils: GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption", "Description": "A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.", "Severity": "LOW", "CweIDs": [ "CWE-119" ], "VendorSeverity": { "amazon": 2, "azure": 1, "debian": 1, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "V3Score": 5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-1352", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-1352", "https://sourceware.org/bugzilla/attachment.cgi?id=15923", "https://sourceware.org/bugzilla/show_bug.cgi?id=32650", "https://sourceware.org/bugzilla/show_bug.cgi?id=32650#c2", "https://vuldb.com/?ctiid.295960", "https://vuldb.com/?id.295960", "https://vuldb.com/?submit.495965", "https://www.cve.org/CVERecord?id=CVE-2025-1352", "https://www.gnu.org/" ], "PublishedDate": "2025-02-16T15:15:09.133Z", "LastModifiedDate": "2026-06-17T08:38:57.857Z" }, { "VulnerabilityID": "CVE-2025-1365", "PkgID": "libelf1@0.188-2.1", "PkgName": "libelf1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libelf1@0.188-2.1?arch=amd64\u0026distro=debian-12.15", "UID": "c6c69bc70a4c3977" }, "InstalledVersion": "0.188-2.1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-1365", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:480531db9fa812d51873ea14d6f87019252debd89cbc5ef3f848499bd786915c", "Title": "elfutils: GNU elfutils eu-readelf readelf.c process_symtab buffer overflow", "Description": "A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.", "Severity": "LOW", "CweIDs": [ "CWE-119", "CWE-120" ], "VendorSeverity": { "azure": 2, "debian": 1, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-1365", "https://nvd.nist.gov/vuln/detail/CVE-2025-1365", "https://sourceware.org/bugzilla/attachment.cgi?id=15925", "https://sourceware.org/bugzilla/show_bug.cgi?id=32654", "https://sourceware.org/bugzilla/show_bug.cgi?id=32654#c2", "https://ubuntu.com/security/notices/USN-7369-1", "https://vuldb.com/?ctiid.295977", "https://vuldb.com/?id.295977", "https://vuldb.com/?submit.496483", "https://www.cve.org/CVERecord?id=CVE-2025-1365", "https://www.gnu.org/" ], "PublishedDate": "2025-02-17T00:15:09.14Z", "LastModifiedDate": "2026-06-17T08:38:59.54Z" }, { "VulnerabilityID": "CVE-2025-1371", "PkgID": "libelf1@0.188-2.1", "PkgName": "libelf1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libelf1@0.188-2.1?arch=amd64\u0026distro=debian-12.15", "UID": "c6c69bc70a4c3977" }, "InstalledVersion": "0.188-2.1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-1371", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ce3dad5f69da16bf566713c92f56d5b512cf2bc12d21e9e427dccf0689d9d7fc", "Title": "elfutils: GNU elfutils eu-read readelf.c handle_dynamic_symtab null pointer dereference", "Description": "A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue.", "Severity": "LOW", "CweIDs": [ "CWE-404", "CWE-476" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-1371", "https://nvd.nist.gov/vuln/detail/CVE-2025-1371", "https://sourceware.org/bugzilla/attachment.cgi?id=15926", "https://sourceware.org/bugzilla/show_bug.cgi?id=32655", "https://sourceware.org/bugzilla/show_bug.cgi?id=32655#c2", "https://ubuntu.com/security/notices/USN-7369-1", "https://vuldb.com/?ctiid.295978", "https://vuldb.com/?id.295978", "https://vuldb.com/?submit.496484", "https://www.cve.org/CVERecord?id=CVE-2025-1371", "https://www.gnu.org/" ], "PublishedDate": "2025-02-17T03:15:09.4Z", "LastModifiedDate": "2026-06-17T08:39:00.347Z" }, { "VulnerabilityID": "CVE-2025-1372", "PkgID": "libelf1@0.188-2.1", "PkgName": "libelf1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libelf1@0.188-2.1?arch=amd64\u0026distro=debian-12.15", "UID": "c6c69bc70a4c3977" }, "InstalledVersion": "0.188-2.1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-1372", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4f1bcc599bd93a6f861b455040aa1273b4ccaa028569d89966053e0b1b4b8168", "Title": "elfutils: GNU elfutils eu-readelf readelf.c print_string_section buffer overflow", "Description": "A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue.", "Severity": "LOW", "CweIDs": [ "CWE-119", "CWE-120" ], "VendorSeverity": { "amazon": 2, "azure": 2, "debian": 1, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-1372", "https://nvd.nist.gov/vuln/detail/CVE-2025-1372", "https://sourceware.org/bugzilla/attachment.cgi?id=15927", "https://sourceware.org/bugzilla/show_bug.cgi?id=32656", "https://sourceware.org/bugzilla/show_bug.cgi?id=32656#c3", "https://sourceware.org/bugzilla/show_bug.cgi?id=32657", "https://ubuntu.com/security/notices/USN-7369-1", "https://vuldb.com/?ctiid.295981", "https://vuldb.com/?id.295981", "https://vuldb.com/?submit.496485", "https://www.cve.org/CVERecord?id=CVE-2025-1372", "https://www.gnu.org/" ], "PublishedDate": "2025-02-17T03:15:09.573Z", "LastModifiedDate": "2026-06-17T08:39:00.497Z" }, { "VulnerabilityID": "CVE-2025-1376", "PkgID": "libelf1@0.188-2.1", "PkgName": "libelf1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libelf1@0.188-2.1?arch=amd64\u0026distro=debian-12.15", "UID": "c6c69bc70a4c3977" }, "InstalledVersion": "0.188-2.1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-1376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0ee7d3aa92d280349cb9cb610c872e2a7a2bb0bbd9ada4104cf925475feccbbc", "Title": "elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service", "Description": "A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue.", "Severity": "LOW", "CweIDs": [ "CWE-404" ], "VendorSeverity": { "azure": 1, "debian": 1, "nvd": 2, "photon": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 2.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-1376", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-1376", "https://sourceware.org/bugzilla/attachment.cgi?id=15940", "https://sourceware.org/bugzilla/show_bug.cgi?id=32672", "https://sourceware.org/bugzilla/show_bug.cgi?id=32672#c3", "https://vuldb.com/?ctiid.295984", "https://vuldb.com/?id.295984", "https://vuldb.com/?submit.497538", "https://www.cve.org/CVERecord?id=CVE-2025-1376", "https://www.gnu.org/" ], "PublishedDate": "2025-02-17T05:15:09.807Z", "LastModifiedDate": "2026-06-17T08:39:00.957Z" }, { "VulnerabilityID": "CVE-2025-1377", "PkgID": "libelf1@0.188-2.1", "PkgName": "libelf1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libelf1@0.188-2.1?arch=amd64\u0026distro=debian-12.15", "UID": "c6c69bc70a4c3977" }, "InstalledVersion": "0.188-2.1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-1377", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a67b5bc994de27b292a4a0e8fefb775777e90533a2e27402b252bf2b55fc4372", "Title": "elfutils: GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service", "Description": "A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue.", "Severity": "LOW", "CweIDs": [ "CWE-404" ], "VendorSeverity": { "azure": 1, "debian": 1, "nvd": 2, "photon": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-1377", "https://nvd.nist.gov/vuln/detail/CVE-2025-1377", "https://sourceware.org/bugzilla/attachment.cgi?id=15941", "https://sourceware.org/bugzilla/show_bug.cgi?id=32673", "https://sourceware.org/bugzilla/show_bug.cgi?id=32673#c2", "https://ubuntu.com/security/notices/USN-7369-1", "https://vuldb.com/?ctiid.295985", "https://vuldb.com/?id.295985", "https://vuldb.com/?submit.497539", "https://www.cve.org/CVERecord?id=CVE-2025-1377", "https://www.gnu.org/" ], "PublishedDate": "2025-02-17T05:15:10.09Z", "LastModifiedDate": "2026-06-17T08:39:01.14Z" }, { "VulnerabilityID": "CVE-2025-59375", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-59375", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ef839703c0ca7811dbb196ceec8ee56d2412c045c576378d4526ce25f9e42c37", "Title": "firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing", "Description": "libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "cbl-mariner": 2, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375", "http://www.openwall.com/lists/oss-security/2025/09/16/2", "http://www.openwall.com/lists/oss-security/2026/05/01/5", "https://access.redhat.com/errata/RHSA-2026:19177", "https://access.redhat.com/security/cve/CVE-2025-59375", "https://bugzilla.redhat.com/2395108", "https://bugzilla.redhat.com/2408891", "https://bugzilla.redhat.com/2418084", "https://bugzilla.redhat.com/2431366", "https://bugzilla.redhat.com/2431374", "https://bugzilla.redhat.com/2444691", "https://bugzilla.redhat.com/2448168", "https://bugzilla.redhat.com/2448181", "https://bugzilla.redhat.com/2449649", "https://bugzilla.redhat.com/2457409", "https://bugzilla.redhat.com/2457932", "https://bugzilla.redhat.com/2458049", "https://bugzilla.redhat.com/show_bug.cgi?id=2395108", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-089022.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375", "https://errata.almalinux.org/9/ALSA-2026-19177.html", "https://errata.rockylinux.org/RLSA-2025:22175", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/10.5.0/BRSA-ja1ptrrpkcey.toml", "https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74", "https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes", "https://github.com/libexpat/libexpat/issues/1018", "https://github.com/libexpat/libexpat/pull/1034", "https://issues.oss-fuzz.com/issues/439133977", "https://linux.oracle.com/cve/CVE-2025-59375.html", "https://linux.oracle.com/errata/ELSA-2026-3407.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-59375", "https://ubuntu.com/security/notices/USN-8022-1", "https://www.cve.org/CVERecord?id=CVE-2025-59375", "https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2025-59375", "https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2025-59375" ], "PublishedDate": "2025-09-15T03:15:40.92Z", "LastModifiedDate": "2026-06-17T09:46:02.697Z" }, { "VulnerabilityID": "CVE-2026-25210", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25210", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:274c3142ca1a0ed590a461fbfa13e1e7665688fe5e5ebbd131edfe664a830d40", "Title": "libexpat: libexpat: Information disclosure and data integrity issues due to integer overflow in buffer reallocation", "Description": "In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-25210", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://github.com/libexpat/libexpat/pull/1075", "https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7", "https://nvd.nist.gov/vuln/detail/CVE-2026-25210", "https://ubuntu.com/security/notices/USN-8022-1", "https://ubuntu.com/security/notices/USN-8022-2", "https://ubuntu.com/security/notices/USN-8023-1", "https://www.cve.org/CVERecord?id=CVE-2026-25210" ], "PublishedDate": "2026-01-30T07:16:15.57Z", "LastModifiedDate": "2026-06-17T10:24:19.123Z" }, { "VulnerabilityID": "CVE-2026-45186", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45186", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:57026d40064c3d1a0847b33e8fed66001b283db445a781475244d4d431110c7c", "Title": "libexpat: denial of service via crafted XML input", "Description": "In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 1, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/11/16", "https://access.redhat.com/errata/RHSA-2026:22715", "https://access.redhat.com/errata/RHSA-2026:22721", "https://access.redhat.com/errata/RHSA-2026:23230", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:27201", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/security/cve/CVE-2026-45186", "https://bugzilla.redhat.com/2468575", "https://bugzilla.redhat.com/show_bug.cgi?id=2468575", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45186", "https://errata.almalinux.org/9/ALSA-2026-23230.html", "https://errata.rockylinux.org/RLSA-2026:23230", "https://github.com/libexpat/libexpat/pull/1216", "https://linux.oracle.com/cve/CVE-2026-45186.html", "https://linux.oracle.com/errata/ELSA-2026-23230.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45186", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json", "https://www.cve.org/CVERecord?id=CVE-2026-45186" ], "PublishedDate": "2026-05-10T07:16:07.883Z", "LastModifiedDate": "2026-07-24T20:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-56131", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56131", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c49dadc670f6ec1a89c3ee882abc277beaa3d683027cabddd9757489b6f87ba4", "Title": "libexpat before 2.8.2 lacks handler call depth tracking for calls to X ...", "Description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2 }, "References": [ "https://github.com/libexpat/libexpat/pull/1267", "https://nvd.nist.gov/vuln/detail/CVE-2026-56131" ], "PublishedDate": "2026-06-19T06:17:10.107Z", "LastModifiedDate": "2026-06-23T20:15:48.007Z" }, { "VulnerabilityID": "CVE-2026-56407", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56407", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f6102b6b8abb8dd70cf3f92c9e6e91846e8aebe05ed212cc01a5f350baa804f1", "Title": "libexpat before 2.8.2 has an integer overflow in doProlog that is rela ...", "Description": "libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 3, "azure": 2 }, "References": [ "https://github.com/libexpat/libexpat/pull/1262", "https://nvd.nist.gov/vuln/detail/CVE-2026-56407" ], "PublishedDate": "2026-06-21T16:16:27.987Z", "LastModifiedDate": "2026-06-23T16:28:29.983Z" }, { "VulnerabilityID": "CVE-2026-56408", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56408", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c6f603c12340630c871b3f4c22c66f5b7692dbd4accfb5cee28682bd4a4746c3", "Title": "libexpat before 2.8.2 has an integer overflow in copyString.", "Description": "libexpat before 2.8.2 has an integer overflow in copyString.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 3, "azure": 2 }, "References": [ "https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817", "https://nvd.nist.gov/vuln/detail/CVE-2026-56408" ], "PublishedDate": "2026-06-21T16:16:28.11Z", "LastModifiedDate": "2026-06-23T16:27:26.523Z" }, { "VulnerabilityID": "CVE-2025-66382", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-66382", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0e31308f233cba45439d85a6659bfa880da7e2c5894e3d7bbb88dd43e72fcb60", "Title": "libexpat: libexpat: Denial of service via crafted file processing", "Description": "In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.", "Severity": "MEDIUM", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "azure": 1, "julia": 2, "nvd": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 2.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2025/12/02/1", "https://access.redhat.com/security/cve/CVE-2025-66382", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://github.com/libexpat/libexpat/issues/1076", "https://nvd.nist.gov/vuln/detail/CVE-2025-66382", "https://www.cve.org/CVERecord?id=CVE-2025-66382" ], "PublishedDate": "2025-11-28T07:15:57.9Z", "LastModifiedDate": "2026-06-17T09:56:45.24Z" }, { "VulnerabilityID": "CVE-2026-32776", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32776", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d46d93153c9dbdbac7a15d94d245f66e38c536d081f2a494f71cd7040d613ded", "Title": "libexpat: libexpat: Denial of Service due to NULL pointer dereference", "Description": "libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 2, "azure": 2, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-32776", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://github.com/libexpat/libexpat/pull/1158", "https://github.com/libexpat/libexpat/pull/1159", "https://nvd.nist.gov/vuln/detail/CVE-2026-32776", "https://www.cve.org/CVERecord?id=CVE-2026-32776" ], "PublishedDate": "2026-03-16T14:19:44.6Z", "LastModifiedDate": "2026-07-14T13:18:49.53Z" }, { "VulnerabilityID": "CVE-2026-32777", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32777", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d748465df0494e599abfb8a823c29c4d64e60de831ac74f8d359bc98a5ccc08c", "Title": "libexpat: libexpat: Denial of Service via infinite loop in DTD content parsing", "Description": "libexpat before 2.7.5 allows an infinite loop while parsing DTD content.", "Severity": "MEDIUM", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "amazon": 2, "azure": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-32777", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://github.com/libexpat/libexpat/issues/1161", "https://github.com/libexpat/libexpat/pull/1159", "https://github.com/libexpat/libexpat/pull/1162", "https://issues.oss-fuzz.com/issues/486993411", "https://nvd.nist.gov/vuln/detail/CVE-2026-32777", "https://www.cve.org/CVERecord?id=CVE-2026-32777" ], "PublishedDate": "2026-03-16T14:19:44.78Z", "LastModifiedDate": "2026-07-14T13:18:49.687Z" }, { "VulnerabilityID": "CVE-2026-32778", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32778", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1ae15b6454ac76039524f11053035b30e18b92b080a3001d0dee046bc6a735da", "Title": "libexpat: libexpat: Denial of Service via NULL pointer dereference after out-of-memory condition", "Description": "libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 2, "azure": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-32778", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://github.com/libexpat/libexpat/pull/1159", "https://github.com/libexpat/libexpat/pull/1163", "https://nvd.nist.gov/vuln/detail/CVE-2026-32778", "https://www.cve.org/CVERecord?id=CVE-2026-32778" ], "PublishedDate": "2026-03-16T14:19:44.97Z", "LastModifiedDate": "2026-07-14T13:18:49.843Z" }, { "VulnerabilityID": "CVE-2026-50219", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50219", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:144ddd959119aea5a6e5c26241104b8bf0c76a0ccdaf81832db37dd6b03177b0", "Title": "expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking", "Description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 4.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-50219", "https://github.com/libexpat/libexpat/pull/1246", "https://nvd.nist.gov/vuln/detail/CVE-2026-50219", "https://www.cve.org/CVERecord?id=CVE-2026-50219" ], "PublishedDate": "2026-06-04T06:16:25.05Z", "LastModifiedDate": "2026-07-22T20:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-56132", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56132", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b8f58919aac90ce5f166514fdd9df3da342e225721ad6cb845e41348f43eed8d", "Title": "expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow", "Description": "In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.", "Severity": "MEDIUM", "CweIDs": [ "CWE-821" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56132", "https://github.com/libexpat/libexpat/pull/1272", "https://nvd.nist.gov/vuln/detail/CVE-2026-56132", "https://www.cve.org/CVERecord?id=CVE-2026-56132" ], "PublishedDate": "2026-06-19T06:17:10.253Z", "LastModifiedDate": "2026-06-23T20:15:26.23Z" }, { "VulnerabilityID": "CVE-2026-56403", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56403", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ce1921e9e80d0ac89e833f086675ae1e88eb2251a64470036622a4ab2753476e", "Title": "libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAtts", "Description": "libexpat before 2.8.2 has an integer overflow in storeAtts.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56403", "https://github.com/libexpat/libexpat/pull/1232", "https://nvd.nist.gov/vuln/detail/CVE-2026-56403", "https://www.cve.org/CVERecord?id=CVE-2026-56403" ], "PublishedDate": "2026-06-21T16:16:26.59Z", "LastModifiedDate": "2026-06-23T20:15:16.76Z" }, { "VulnerabilityID": "CVE-2026-56404", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56404", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d7c9ced7387eea7a8e885fdd989c79b32b371627d264136aac1f05a6b8a7be8c", "Title": "libexpat before 2.8.2 has an integer overflow in addBinding.", "Description": "libexpat before 2.8.2 has an integer overflow in addBinding.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://github.com/libexpat/libexpat/pull/1249", "https://nvd.nist.gov/vuln/detail/CVE-2026-56404" ], "PublishedDate": "2026-06-21T16:16:27.62Z", "LastModifiedDate": "2026-06-23T20:15:05.85Z" }, { "VulnerabilityID": "CVE-2026-56405", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56405", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:18234e9844e59ed5ccc732c00b44686d9d62dd7ad872f2ca3fd62c92db13fd30", "Title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "Description": "libexpat before 2.8.2 has an integer overflow in getAttributeId.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 4.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56405", "https://github.com/libexpat/libexpat/pull/1251", "https://nvd.nist.gov/vuln/detail/CVE-2026-56405", "https://www.cve.org/CVERecord?id=CVE-2026-56405" ], "PublishedDate": "2026-06-21T16:16:27.74Z", "LastModifiedDate": "2026-06-23T20:14:51.73Z" }, { "VulnerabilityID": "CVE-2026-56406", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56406", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:31c93c85faf40ea277f01b6062bbee55a163858cf2d7701b7d01eaaffc3120b5", "Title": "libexpat: libexpat: Arbitrary code execution via integer overflow in XML_ParseBuffer", "Description": "libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 3, "azure": 2, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56406", "https://github.com/libexpat/libexpat/pull/1255", "https://nvd.nist.gov/vuln/detail/CVE-2026-56406", "https://www.cve.org/CVERecord?id=CVE-2026-56406" ], "PublishedDate": "2026-06-21T16:16:27.87Z", "LastModifiedDate": "2026-06-23T16:29:06.077Z" }, { "VulnerabilityID": "CVE-2026-56409", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56409", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:475dad465a2f8f78468dd137d4f86c113d346317e51299a9a7129012d9c8e832", "Title": "xmlwf in libexpat before 2.8.2 has an integer overflow for the output ...", "Description": "xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "azure": 2 }, "References": [ "https://github.com/libexpat/libexpat/pull/1259", "https://nvd.nist.gov/vuln/detail/CVE-2026-56409" ], "PublishedDate": "2026-06-21T16:16:28.23Z", "LastModifiedDate": "2026-06-23T16:21:55.607Z" }, { "VulnerabilityID": "CVE-2026-56410", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56410", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:685bc804cee1a780223eedd45d3b1a5425b00bec7d3081b28da15dbbd97b8d42", "Title": "libexpat: libexpat: Integer overflow in xmlwf can lead to information disclosure and arbitrary code execution.", "Description": "xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "azure": 2, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56410", "https://github.com/libexpat/libexpat/pull/1252", "https://nvd.nist.gov/vuln/detail/CVE-2026-56410", "https://www.cve.org/CVERecord?id=CVE-2026-56410" ], "PublishedDate": "2026-06-21T16:16:28.36Z", "LastModifiedDate": "2026-06-23T16:18:16.427Z" }, { "VulnerabilityID": "CVE-2026-56411", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56411", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4427f9b9654f8e49ca08b8804bfb3c4727f7b9ce91ad128e79820757f42b40c5", "Title": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution", "Description": "xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "azure": 2, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56411", "https://github.com/libexpat/libexpat/pull/1263", "https://nvd.nist.gov/vuln/detail/CVE-2026-56411", "https://www.cve.org/CVERecord?id=CVE-2026-56411" ], "PublishedDate": "2026-06-21T17:16:44.523Z", "LastModifiedDate": "2026-06-23T16:16:36.417Z" }, { "VulnerabilityID": "CVE-2026-56412", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56412", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cde0dcdc85d3f12d388e925ef0cb967526c2b0f96642f64ae1dd1393fdb2dc6d", "Title": "libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections", "Description": "libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 4.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56412", "https://github.com/libexpat/libexpat/pull/1278", "https://nvd.nist.gov/vuln/detail/CVE-2026-56412", "https://www.cve.org/CVERecord?id=CVE-2026-56412" ], "PublishedDate": "2026-06-21T17:16:44.657Z", "LastModifiedDate": "2026-06-23T15:31:30.853Z" }, { "VulnerabilityID": "CVE-2023-52426", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-52426", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:39f35ff47467671032cc51b79930acaf5920ece56d56582ab9c2e8b9b8643282", "Title": "expat: recursive XML entity expansion vulnerability", "Description": "libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.", "Severity": "LOW", "CweIDs": [ "CWE-776" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52426", "https://access.redhat.com/security/cve/CVE-2023-52426", "https://cwe.mitre.org/data/definitions/776.html", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-vc92-wc47-6qmx", "https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404", "https://github.com/libexpat/libexpat/pull/777", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/", "https://nvd.nist.gov/vuln/detail/CVE-2023-52426", "https://security.netapp.com/advisory/ntap-20240307-0005/", "https://www.cve.org/CVERecord?id=CVE-2023-52426" ], "PublishedDate": "2024-02-04T20:15:46.12Z", "LastModifiedDate": "2026-06-17T06:42:39.69Z" }, { "VulnerabilityID": "CVE-2024-28757", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-28757", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1e0bb836c6750c068c4356d78a8ab83c8ac067377dbaff330e9167edfbe2b7a7", "Title": "expat: XML Entity Expansion", "Description": "libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).", "Severity": "LOW", "CweIDs": [ "CWE-776" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "bottlerocket": 2, "cbl-mariner": 3, "debian": 1, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28757", "http://www.openwall.com/lists/oss-security/2024/03/15/1", "https://access.redhat.com/errata/RHSA-2024:1530", "https://access.redhat.com/security/cve/CVE-2024-28757", "https://bugzilla.redhat.com/2262877", "https://bugzilla.redhat.com/2268766", "https://errata.almalinux.org/9/ALSA-2024-1530.html", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-rjp2-2459-62cp", "https://github.com/libexpat/libexpat/issues/839", "https://github.com/libexpat/libexpat/pull/842", "https://linux.oracle.com/cve/CVE-2024-28757.html", "https://linux.oracle.com/errata/ELSA-2024-1530.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/", "https://nvd.nist.gov/vuln/detail/CVE-2024-28757", "https://security.netapp.com/advisory/ntap-20240322-0001/", "https://ubuntu.com/security/notices/USN-6694-1", "https://www.cve.org/CVERecord?id=CVE-2024-28757" ], "PublishedDate": "2024-03-10T05:15:06.57Z", "LastModifiedDate": "2026-06-17T07:21:45.16Z" }, { "VulnerabilityID": "CVE-2026-24515", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-24515", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:275e9b07ff5a7c45f0b296c981c73a250888344c5060d526a09064ec5f80b9ce", "Title": "libexpat: libexpat null pointer dereference", "Description": "In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "azure": 1, "cbl-mariner": 1, "julia": 1, "nvd": 1, "photon": 1, "redhat": 1, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 2.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 2.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 2.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-24515", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://github.com/libexpat/libexpat/pull/1131", "https://nvd.nist.gov/vuln/detail/CVE-2026-24515", "https://ubuntu.com/security/notices/USN-8022-1", "https://ubuntu.com/security/notices/USN-8022-2", "https://ubuntu.com/security/notices/USN-8023-1", "https://www.cve.org/CVERecord?id=CVE-2026-24515" ], "PublishedDate": "2026-01-23T08:16:01.49Z", "LastModifiedDate": "2026-06-17T10:23:10.66Z" }, { "VulnerabilityID": "CVE-2026-41080", "PkgID": "libexpat1@2.5.0-1+deb12u2", "PkgName": "libexpat1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libexpat1@2.5.0-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "838daee52fa670e3" }, "InstalledVersion": "2.5.0-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41080", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b7687502b20a73c8d0199e07b7e56fb7ee26257f95f689764aed7b91d525e778", "Title": "libexpat: expat: libexpat: Denial of Service via hash flooding with crafted XML", "Description": "libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.", "Severity": "LOW", "CweIDs": [ "CWE-331" ], "VendorSeverity": { "amazon": 1, "azure": 1, "julia": 1, "photon": 3, "redhat": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 2.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/26/1", "https://access.redhat.com/security/cve/CVE-2026-41080", "https://blog.hartwork.org/posts/expat-2-8-0-released/", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://github.com/libexpat/libexpat/issues/47", "https://github.com/libexpat/libexpat/pull/1183", "https://nvd.nist.gov/vuln/detail/CVE-2026-41080", "https://www.cve.org/CVERecord?id=CVE-2026-41080", "https://www.openwall.com/lists/oss-security/2026/04/26/1" ], "PublishedDate": "2026-04-16T17:16:54.917Z", "LastModifiedDate": "2026-07-14T13:18:51.257Z" }, { "VulnerabilityID": "CVE-2023-45913", "PkgID": "libgbm1@22.3.6-1+deb12u2", "PkgName": "libgbm1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgbm1@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "c308bc0f36020bca" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45913", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:481ba95f9c3cb70cbbf1796df8a5c47b144eec9c0b4af5c403a4ff550c658868", "Title": "Mesa v23.0.4 was discovered to contain a NULL pointer dereference via ...", "Description": "Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId(). This vulnerability is triggered when the X11 server sends an DRI2_BufferSwapComplete event unexpectedly when the application is using DRI3. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176800/Mesa-23.0.4-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/28", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9856", "https://seclists.org/fulldisclosure/2024/Jan/71" ], "PublishedDate": "2024-03-27T04:15:10.59Z", "LastModifiedDate": "2026-06-17T06:29:47.107Z" }, { "VulnerabilityID": "CVE-2023-45919", "PkgID": "libgbm1@22.3.6-1+deb12u2", "PkgName": "libgbm1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgbm1@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "c308bc0f36020bca" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45919", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0ac44da765d90ccf66139c3ba6abcf1192e65567fa892e1cdc1d18e2478c963e", "Title": "Mesa 23.0.4 was discovered to contain a buffer over-read in glXQuerySe ...", "Description": "Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176802/Mesa-23.0.4-Buffer-Overflow.html", "http://seclists.org/fulldisclosure/2024/Jan/47", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9858" ], "PublishedDate": "2024-03-27T05:15:47.03Z", "LastModifiedDate": "2026-06-17T06:29:47.34Z" }, { "VulnerabilityID": "CVE-2023-45922", "PkgID": "libgbm1@22.3.6-1+deb12u2", "PkgName": "libgbm1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgbm1@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "c308bc0f36020bca" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45922", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a07c4a313ab93f78c66bb5d02aeaf209214a39606d843ca554fd0356290c4cf9", "Title": "glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation ...", "Description": "glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-754" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176805/Mesa-23.0.4-Buffer-Overflow-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/50", "http://seclists.org/fulldisclosure/2024/Jan/71", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9857" ], "PublishedDate": "2024-03-27T05:15:47.203Z", "LastModifiedDate": "2026-06-17T06:29:47.72Z" }, { "VulnerabilityID": "CVE-2023-45931", "PkgID": "libgbm1@22.3.6-1+deb12u2", "PkgName": "libgbm1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgbm1@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "c308bc0f36020bca" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45931", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b19597a4efcff6aa07790d772c8fd6bf1d056d11e732e3dfc2f8a9b720ea46a2", "Title": "Mesa 23.0.4 was discovered to contain a NULL pointer dereference in ch ...", "Description": "Mesa 23.0.4 was discovered to contain a NULL pointer dereference in check_xshm() for the has_error state. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176813/Mesa-23.0.4-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/59", "http://seclists.org/fulldisclosure/2024/Jan/71", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9859", "https://seclists.org/fulldisclosure/2024/Jan/71" ], "PublishedDate": "2024-03-27T04:15:11.25Z", "LastModifiedDate": "2026-06-17T06:29:48.707Z" }, { "VulnerabilityID": "CVE-2022-27943", "PkgID": "libgcc-s1@12.2.0-14+deb12u1", "PkgName": "libgcc-s1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "30dd46e15657e503" }, "InstalledVersion": "12.2.0-14+deb12u1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-27943", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:579e4fb36736efdf139f84ccaca571b028e0a98dc225da0c52cc5dbebc015fee", "Title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "Description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", "Severity": "LOW", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "amazon": 1, "debian": 1, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2022-27943", "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead", "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/", "https://nvd.nist.gov/vuln/detail/CVE-2022-27943", "https://sourceware.org/bugzilla/show_bug.cgi?id=28995", "https://www.cve.org/CVERecord?id=CVE-2022-27943" ], "PublishedDate": "2022-03-26T13:15:07.9Z", "LastModifiedDate": "2026-06-17T04:37:46.95Z" }, { "VulnerabilityID": "CVE-2018-6829", "PkgID": "libgcrypt20@1.10.1-3+deb12u1", "PkgName": "libgcrypt20", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgcrypt20@1.10.1-3%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "fa3462de6167db33" }, "InstalledVersion": "1.10.1-3+deb12u1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-6829", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:612b7c266c9f194ccfe685eb1b0acc087cdeac99fa2a1348334f969bcbfced1a", "Title": "libgcrypt: ElGamal implementation doesn't have semantic security due to incorrectly encoded plaintexts possibly allowing to obtain sensitive information", "Description": "cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.", "Severity": "LOW", "CweIDs": [ "CWE-327" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2018-6829", "https://github.com/weikengchen/attack-on-libgcrypt-elgamal", "https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki", "https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html", "https://nvd.nist.gov/vuln/detail/CVE-2018-6829", "https://www.cve.org/CVERecord?id=CVE-2018-6829", "https://www.oracle.com/security-alerts/cpujan2020.html" ], "PublishedDate": "2018-02-07T23:29:01.703Z", "LastModifiedDate": "2026-06-17T02:02:19.757Z" }, { "VulnerabilityID": "CVE-2024-2236", "PkgID": "libgcrypt20@1.10.1-3+deb12u1", "PkgName": "libgcrypt20", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgcrypt20@1.10.1-3%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "fa3462de6167db33" }, "InstalledVersion": "1.10.1-3+deb12u1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-2236", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:73e1e01bb2adf62db80678872c044b72cf2ed96215ed41cad5259561199634b6", "Title": "libgcrypt: vulnerable to Marvin Attack", "Description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.", "Severity": "LOW", "CweIDs": [ "CWE-385" ], "VendorSeverity": { "alma": 2, "amazon": 2, "debian": 1, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:9404", "https://access.redhat.com/errata/RHSA-2025:3530", "https://access.redhat.com/errata/RHSA-2025:3534", "https://access.redhat.com/security/cve/CVE-2024-2236", "https://bugzilla.redhat.com/2245218", "https://bugzilla.redhat.com/show_bug.cgi?id=2245218", "https://bugzilla.redhat.com/show_bug.cgi?id=2268268", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2236", "https://dev.gnupg.org/T7136", "https://errata.almalinux.org/9/ALSA-2024-9404.html", "https://errata.rockylinux.org/RLSA-2024:9404", "https://github.com/tomato42/marvin-toolkit/tree/master/example/libgcrypt", "https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/17", "https://linux.oracle.com/cve/CVE-2024-2236.html", "https://linux.oracle.com/errata/ELSA-2024-9404.html", "https://lists.gnupg.org/pipermail/gcrypt-devel/2024-March/005607.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-2236", "https://www.cve.org/CVERecord?id=CVE-2024-2236" ], "PublishedDate": "2024-03-06T22:15:57.977Z", "LastModifiedDate": "2026-06-17T07:24:06.083Z" }, { "VulnerabilityID": "CVE-2026-16768", "PkgID": "libgdk-pixbuf-2.0-0@2.42.10+dfsg-1+deb12u4", "PkgName": "libgdk-pixbuf-2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgdk-pixbuf-2.0-0@2.42.10%2Bdfsg-1%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "ce52b0ee879274d5" }, "InstalledVersion": "2.42.10+dfsg-1+deb12u4", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16768", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b7a8852eb298e111317622ca5be5068dae447c9b29e4d7c7e546c9349571750", "Title": "gdk-pixbuf: out-of-bounds read in ICO parser", "Description": "A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.", "Severity": "MEDIUM", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16768", "https://bugzilla.redhat.com/show_bug.cgi?id=2506437", "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302", "https://nvd.nist.gov/vuln/detail/CVE-2026-16768", "https://www.cve.org/CVERecord?id=CVE-2026-16768" ], "PublishedDate": "2026-07-23T17:16:28.037Z", "LastModifiedDate": "2026-07-24T16:16:33.737Z" }, { "VulnerabilityID": "CVE-2026-16768", "PkgID": "libgdk-pixbuf2.0-common@2.42.10+dfsg-1+deb12u4", "PkgName": "libgdk-pixbuf2.0-common", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgdk-pixbuf2.0-common@2.42.10%2Bdfsg-1%2Bdeb12u4?arch=all\u0026distro=debian-12.15", "UID": "b882baa913ba958a" }, "InstalledVersion": "2.42.10+dfsg-1+deb12u4", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16768", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6a138bb524dc883481405f40b0e566a1ccddf8112c84ce322545b702ddd9bd10", "Title": "gdk-pixbuf: out-of-bounds read in ICO parser", "Description": "A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail.", "Severity": "MEDIUM", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16768", "https://bugzilla.redhat.com/show_bug.cgi?id=2506437", "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302", "https://nvd.nist.gov/vuln/detail/CVE-2026-16768", "https://www.cve.org/CVERecord?id=CVE-2026-16768" ], "PublishedDate": "2026-07-23T17:16:28.037Z", "LastModifiedDate": "2026-07-24T16:16:33.737Z" }, { "VulnerabilityID": "CVE-2022-27943", "PkgID": "libgfortran5@12.2.0-14+deb12u1", "PkgName": "libgfortran5", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgfortran5@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "bedb900bb555afac" }, "InstalledVersion": "12.2.0-14+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-27943", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd1b24e4ef29b8d050e93385c2a612cec85a71966c89cf4df2f4e53b60d9a582", "Title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "Description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", "Severity": "LOW", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "amazon": 1, "debian": 1, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2022-27943", "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead", "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/", "https://nvd.nist.gov/vuln/detail/CVE-2022-27943", "https://sourceware.org/bugzilla/show_bug.cgi?id=28995", "https://www.cve.org/CVERecord?id=CVE-2022-27943" ], "PublishedDate": "2022-03-26T13:15:07.9Z", "LastModifiedDate": "2026-06-17T04:37:46.95Z" }, { "VulnerabilityID": "CVE-2023-45924", "PkgID": "libgl1@1.6.0-1", "PkgName": "libgl1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgl1@1.6.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "98aca896a70687f2" }, "InstalledVersion": "1.6.0-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45924", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ba5b37598e4db95af8f03255db5b892034d1629a445470642d590c3afadc4c7f", "Title": "libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a ...", "Description": "libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a segmentation violation via the function glXGetDrawableScreen(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-121", "CWE-476" ], "VendorSeverity": { "amazon": 2, "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176807/libglvnd-bb06db5a-Buffer-Overflow-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/52", "https://gitlab.freedesktop.org/glvnd/libglvnd/-/issues/242", "https://gitlab.freedesktop.org/glvnd/libglvnd/-/merge_requests/295" ], "PublishedDate": "2024-03-27T05:15:47.263Z", "LastModifiedDate": "2026-06-17T06:29:47.93Z" }, { "VulnerabilityID": "CVE-2023-45913", "PkgID": "libgl1-mesa-dri@22.3.6-1+deb12u2", "PkgName": "libgl1-mesa-dri", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgl1-mesa-dri@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "edc9e2d43b47100b" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45913", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2b4f36d87f1d7991dedd73b4850c417418c90df9ee8efc6d6fa258d99033033a", "Title": "Mesa v23.0.4 was discovered to contain a NULL pointer dereference via ...", "Description": "Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId(). This vulnerability is triggered when the X11 server sends an DRI2_BufferSwapComplete event unexpectedly when the application is using DRI3. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176800/Mesa-23.0.4-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/28", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9856", "https://seclists.org/fulldisclosure/2024/Jan/71" ], "PublishedDate": "2024-03-27T04:15:10.59Z", "LastModifiedDate": "2026-06-17T06:29:47.107Z" }, { "VulnerabilityID": "CVE-2023-45919", "PkgID": "libgl1-mesa-dri@22.3.6-1+deb12u2", "PkgName": "libgl1-mesa-dri", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgl1-mesa-dri@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "edc9e2d43b47100b" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45919", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a8835cd5ef84c27edd375c6ba3247549398da9e4a4731eecf0a611659419044a", "Title": "Mesa 23.0.4 was discovered to contain a buffer over-read in glXQuerySe ...", "Description": "Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176802/Mesa-23.0.4-Buffer-Overflow.html", "http://seclists.org/fulldisclosure/2024/Jan/47", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9858" ], "PublishedDate": "2024-03-27T05:15:47.03Z", "LastModifiedDate": "2026-06-17T06:29:47.34Z" }, { "VulnerabilityID": "CVE-2023-45922", "PkgID": "libgl1-mesa-dri@22.3.6-1+deb12u2", "PkgName": "libgl1-mesa-dri", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgl1-mesa-dri@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "edc9e2d43b47100b" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45922", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:82f5141d5f104c7436c75f337784d5c655543572a99e449f0b8d2d3a0acda9da", "Title": "glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation ...", "Description": "glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-754" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176805/Mesa-23.0.4-Buffer-Overflow-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/50", "http://seclists.org/fulldisclosure/2024/Jan/71", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9857" ], "PublishedDate": "2024-03-27T05:15:47.203Z", "LastModifiedDate": "2026-06-17T06:29:47.72Z" }, { "VulnerabilityID": "CVE-2023-45931", "PkgID": "libgl1-mesa-dri@22.3.6-1+deb12u2", "PkgName": "libgl1-mesa-dri", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgl1-mesa-dri@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "edc9e2d43b47100b" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45931", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7b3a90749567c01aa9c2effb5edea517642af243ecf094f53aadfdbfe8d085a6", "Title": "Mesa 23.0.4 was discovered to contain a NULL pointer dereference in ch ...", "Description": "Mesa 23.0.4 was discovered to contain a NULL pointer dereference in check_xshm() for the has_error state. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176813/Mesa-23.0.4-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/59", "http://seclists.org/fulldisclosure/2024/Jan/71", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9859", "https://seclists.org/fulldisclosure/2024/Jan/71" ], "PublishedDate": "2024-03-27T04:15:11.25Z", "LastModifiedDate": "2026-06-17T06:29:48.707Z" }, { "VulnerabilityID": "CVE-2023-45913", "PkgID": "libglapi-mesa@22.3.6-1+deb12u2", "PkgName": "libglapi-mesa", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglapi-mesa@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "231877390a5a63c1" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45913", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8ba618ba5a543b479d1363e112bb3c3ac0d59471da64a47c51f0bce574c7b88e", "Title": "Mesa v23.0.4 was discovered to contain a NULL pointer dereference via ...", "Description": "Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId(). This vulnerability is triggered when the X11 server sends an DRI2_BufferSwapComplete event unexpectedly when the application is using DRI3. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176800/Mesa-23.0.4-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/28", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9856", "https://seclists.org/fulldisclosure/2024/Jan/71" ], "PublishedDate": "2024-03-27T04:15:10.59Z", "LastModifiedDate": "2026-06-17T06:29:47.107Z" }, { "VulnerabilityID": "CVE-2023-45919", "PkgID": "libglapi-mesa@22.3.6-1+deb12u2", "PkgName": "libglapi-mesa", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglapi-mesa@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "231877390a5a63c1" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45919", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:79d6d965a870e2e0200de9bf91d560ccb48048c259f65bb40ac7ffbced3e1ca9", "Title": "Mesa 23.0.4 was discovered to contain a buffer over-read in glXQuerySe ...", "Description": "Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176802/Mesa-23.0.4-Buffer-Overflow.html", "http://seclists.org/fulldisclosure/2024/Jan/47", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9858" ], "PublishedDate": "2024-03-27T05:15:47.03Z", "LastModifiedDate": "2026-06-17T06:29:47.34Z" }, { "VulnerabilityID": "CVE-2023-45922", "PkgID": "libglapi-mesa@22.3.6-1+deb12u2", "PkgName": "libglapi-mesa", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglapi-mesa@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "231877390a5a63c1" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45922", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:244a39ea87e68e7b90c57735872f20ccfd7fa75016d120546080a32f30ee7ea5", "Title": "glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation ...", "Description": "glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-754" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176805/Mesa-23.0.4-Buffer-Overflow-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/50", "http://seclists.org/fulldisclosure/2024/Jan/71", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9857" ], "PublishedDate": "2024-03-27T05:15:47.203Z", "LastModifiedDate": "2026-06-17T06:29:47.72Z" }, { "VulnerabilityID": "CVE-2023-45931", "PkgID": "libglapi-mesa@22.3.6-1+deb12u2", "PkgName": "libglapi-mesa", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglapi-mesa@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "231877390a5a63c1" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45931", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4bc4295d7d513857f7bfc04f2739631822080c466cabce8441db044b91432acb", "Title": "Mesa 23.0.4 was discovered to contain a NULL pointer dereference in ch ...", "Description": "Mesa 23.0.4 was discovered to contain a NULL pointer dereference in check_xshm() for the has_error state. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176813/Mesa-23.0.4-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/59", "http://seclists.org/fulldisclosure/2024/Jan/71", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9859", "https://seclists.org/fulldisclosure/2024/Jan/71" ], "PublishedDate": "2024-03-27T04:15:11.25Z", "LastModifiedDate": "2026-06-17T06:29:48.707Z" }, { "VulnerabilityID": "CVE-2026-58016", "PkgID": "libglib2.0-0@2.74.6-2+deb12u9", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u9?arch=amd64\u0026distro=debian-12.15", "UID": "992130747c8c4933" }, "InstalledVersion": "2.74.6-2+deb12u9", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58016", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f78f1bb2f052422f7dcb512d1ea6dd262f624f783302168d3fa6c5084f8dd234", "Title": "glib: integer underflow in gio/gdbusintrospection.c via \"g_dbus_node_info_new_for_xml\"", "Description": "A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a \u003cnode\u003e element nested within other elements like \u003cmethod\u003e, \u003csignal\u003e, \u003cproperty\u003e or \u003carg\u003e. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.", "Severity": "CRITICAL", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42063", "https://access.redhat.com/errata/RHSA-2026:42089", "https://access.redhat.com/errata/RHSA-2026:42090", "https://access.redhat.com/errata/RHSA-2026:44481", "https://access.redhat.com/errata/RHSA-2026:46836", "https://access.redhat.com/security/cve/CVE-2026-58016", "https://bugzilla.redhat.com/2492257", "https://bugzilla.redhat.com/show_bug.cgi?id=2492257", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58016", "https://errata.almalinux.org/9/ALSA-2026-42089.html", "https://errata.rockylinux.org/RLSA-2026:42089", "https://gitlab.gnome.org/GNOME/glib/-/issues/3932", "https://linux.oracle.com/cve/CVE-2026-58016.html", "https://linux.oracle.com/errata/ELSA-2026-42090.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-58016", "https://www.cve.org/CVERecord?id=CVE-2026-58016" ], "PublishedDate": "2026-06-30T13:19:17.84Z", "LastModifiedDate": "2026-07-27T17:16:36.557Z" }, { "VulnerabilityID": "CVE-2026-58010", "PkgID": "libglib2.0-0@2.74.6-2+deb12u9", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u9?arch=amd64\u0026distro=debian-12.15", "UID": "992130747c8c4933" }, "InstalledVersion": "2.74.6-2+deb12u9", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58010", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8dfd0879753f3d7391e75916e861b456f9be016ec937e7c338e9c6e524d208c9", "Title": "glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()", "Description": "A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses \u003e instead of \u003e=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-58010", "https://bugzilla.redhat.com/show_bug.cgi?id=2492243", "https://gitlab.gnome.org/GNOME/glib/-/issues/3915", "https://nvd.nist.gov/vuln/detail/CVE-2026-58010", "https://www.cve.org/CVERecord?id=CVE-2026-58010" ], "PublishedDate": "2026-06-30T13:19:17.067Z", "LastModifiedDate": "2026-07-02T19:09:20.803Z" }, { "VulnerabilityID": "CVE-2026-58011", "PkgID": "libglib2.0-0@2.74.6-2+deb12u9", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u9?arch=amd64\u0026distro=debian-12.15", "UID": "992130747c8c4933" }, "InstalledVersion": "2.74.6-2+deb12u9", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58011", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dabf22bfa018bbf3d5f6d6e0a2a1beeb386f9165f57be3107dc7abdae709fb5c", "Title": "glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime", "Description": "A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-58011", "https://bugzilla.redhat.com/show_bug.cgi?id=2492245", "https://gitlab.gnome.org/GNOME/glib/-/issues/3917", "https://gitlab.gnome.org/GNOME/glib/-/work_items/3917", "https://nvd.nist.gov/vuln/detail/CVE-2026-58011", "https://www.cve.org/CVERecord?id=CVE-2026-58011" ], "PublishedDate": "2026-06-30T13:19:17.2Z", "LastModifiedDate": "2026-07-02T19:20:39.03Z" }, { "VulnerabilityID": "CVE-2026-58012", "PkgID": "libglib2.0-0@2.74.6-2+deb12u9", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u9?arch=amd64\u0026distro=debian-12.15", "UID": "992130747c8c4933" }, "InstalledVersion": "2.74.6-2+deb12u9", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58012", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a05210525a1a715aecfc92bd46a72b7e8b94a22f1e99619b8cce204a3d57954e", "Title": "glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()", "Description": "A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-58012", "https://bugzilla.redhat.com/show_bug.cgi?id=2492247", "https://gitlab.gnome.org/GNOME/glib/-/issues/3918", "https://nvd.nist.gov/vuln/detail/CVE-2026-58012", "https://www.cve.org/CVERecord?id=CVE-2026-58012" ], "PublishedDate": "2026-06-30T13:19:17.33Z", "LastModifiedDate": "2026-07-02T19:28:31.943Z" }, { "VulnerabilityID": "CVE-2026-58013", "PkgID": "libglib2.0-0@2.74.6-2+deb12u9", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u9?arch=amd64\u0026distro=debian-12.15", "UID": "992130747c8c4933" }, "InstalledVersion": "2.74.6-2+deb12u9", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58013", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:02e5af5caf9095f6d3d09525359971bac37cf34cf0b927400294e74ca98a1a68", "Title": "glib: buffer over-read in glib/giochannel.c via \"g_io_channel_read_line_backend\"", "Description": "A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-58013", "https://bugzilla.redhat.com/show_bug.cgi?id=2492248", "https://gitlab.gnome.org/GNOME/glib/-/issues/3925", "https://nvd.nist.gov/vuln/detail/CVE-2026-58013", "https://www.cve.org/CVERecord?id=CVE-2026-58013" ], "PublishedDate": "2026-06-30T13:19:17.457Z", "LastModifiedDate": "2026-07-02T19:29:25.16Z" }, { "VulnerabilityID": "CVE-2026-58014", "PkgID": "libglib2.0-0@2.74.6-2+deb12u9", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u9?arch=amd64\u0026distro=debian-12.15", "UID": "992130747c8c4933" }, "InstalledVersion": "2.74.6-2+deb12u9", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58014", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2430328949095ada5f78db6e8d0b64bd2a18a6487c4aacd2d043db348088f6ef", "Title": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\"", "Description": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-193" ], "VendorSeverity": { "amazon": 3, "azure": 3, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 8.6 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-58014", "https://bugzilla.redhat.com/show_bug.cgi?id=2492255", "https://gitlab.gnome.org/GNOME/glib/-/issues/3930", "https://nvd.nist.gov/vuln/detail/CVE-2026-58014", "https://www.cve.org/CVERecord?id=CVE-2026-58014" ], "PublishedDate": "2026-06-30T13:19:17.58Z", "LastModifiedDate": "2026-07-01T17:58:21.36Z" }, { "VulnerabilityID": "CVE-2026-58015", "PkgID": "libglib2.0-0@2.74.6-2+deb12u9", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u9?arch=amd64\u0026distro=debian-12.15", "UID": "992130747c8c4933" }, "InstalledVersion": "2.74.6-2+deb12u9", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58015", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e5f88069ce0309ad8191af7894d2b5ccd6851efa63020888b73540a2f68038ec", "Title": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive", "Description": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-58015", "https://bugzilla.redhat.com/show_bug.cgi?id=2492256", "https://gitlab.gnome.org/GNOME/glib/-/issues/3931", "https://nvd.nist.gov/vuln/detail/CVE-2026-58015", "https://www.cve.org/CVERecord?id=CVE-2026-58015" ], "PublishedDate": "2026-06-30T13:19:17.707Z", "LastModifiedDate": "2026-07-23T23:16:49.317Z" }, { "VulnerabilityID": "CVE-2026-15588", "PkgID": "libglib2.0-0@2.74.6-2+deb12u9", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u9?arch=amd64\u0026distro=debian-12.15", "UID": "992130747c8c4933" }, "InstalledVersion": "2.74.6-2+deb12u9", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-15588", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:74f1952728b030295d5815f8ed02f09161235da7fdfa47a1ab06dd4fffd9ceb5", "Title": "GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering", "Description": "A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.", "Severity": "MEDIUM", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:39985", "https://access.redhat.com/errata/RHSA-2026:40485", "https://access.redhat.com/errata/RHSA-2026:42329", "https://access.redhat.com/security/cve/CVE-2026-15588", "https://bugzilla.redhat.com/show_bug.cgi?id=2499675", "https://gitlab.gnome.org/GNOME/glib/-/issues/3985", "https://nvd.nist.gov/vuln/detail/CVE-2026-15588", "https://www.cve.org/CVERecord?id=CVE-2026-15588" ], "PublishedDate": "2026-07-20T12:17:55.22Z", "LastModifiedDate": "2026-07-21T18:31:51.68Z" }, { "VulnerabilityID": "CVE-2026-16118", "PkgID": "libglib2.0-0@2.74.6-2+deb12u9", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u9?arch=amd64\u0026distro=debian-12.15", "UID": "992130747c8c4933" }, "InstalledVersion": "2.74.6-2+deb12u9", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-16118", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ba98b0a00d88921a211055f7f194a08424d71851ff582c05f16ffd2a1126faa2", "Title": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c", "Description": "A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.", "Severity": "MEDIUM", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-16118", "https://bugzilla.redhat.com/show_bug.cgi?id=2501732", "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41", "https://nvd.nist.gov/vuln/detail/CVE-2026-16118", "https://www.cve.org/CVERecord?id=CVE-2026-16118" ], "PublishedDate": "2026-07-17T20:17:16.167Z", "LastModifiedDate": "2026-07-22T19:16:55.893Z" }, { "VulnerabilityID": "CVE-2012-0039", "PkgID": "libglib2.0-0@2.74.6-2+deb12u9", "PkgName": "libglib2.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglib2.0-0@2.74.6-2%2Bdeb12u9?arch=amd64\u0026distro=debian-12.15", "UID": "992130747c8c4933" }, "InstalledVersion": "2.74.6-2+deb12u9", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2012-0039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ddcc1d70acddca68146b739fd40224f387709fd8d842fbe2ec7a967b20e2242c", "Title": "glib2: hash table collisions CPU usage DoS", "Description": "GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.", "Severity": "LOW", "CweIDs": [ "CWE-310" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V2Score": 5 }, "redhat": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V2Score": 5 } }, "References": [ "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=655044", "http://mail.gnome.org/archives/gtk-devel-list/2003-May/msg00111.html", "http://openwall.com/lists/oss-security/2012/01/10/12", "https://access.redhat.com/security/cve/CVE-2012-0039", "https://bugzilla.redhat.com/show_bug.cgi?id=772720", "https://nvd.nist.gov/vuln/detail/CVE-2012-0039", "https://www.cve.org/CVERecord?id=CVE-2012-0039" ], "PublishedDate": "2012-01-14T17:55:01.257Z", "LastModifiedDate": "2026-04-29T01:13:23.04Z" }, { "VulnerabilityID": "CVE-2023-45924", "PkgID": "libglvnd0@1.6.0-1", "PkgName": "libglvnd0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglvnd0@1.6.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "6bba2663dee41b12" }, "InstalledVersion": "1.6.0-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45924", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0196e0a6afa5de780fda7148d59399fe05f753546c1362e3b8c3558742d64a80", "Title": "libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a ...", "Description": "libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a segmentation violation via the function glXGetDrawableScreen(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-121", "CWE-476" ], "VendorSeverity": { "amazon": 2, "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176807/libglvnd-bb06db5a-Buffer-Overflow-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/52", "https://gitlab.freedesktop.org/glvnd/libglvnd/-/issues/242", "https://gitlab.freedesktop.org/glvnd/libglvnd/-/merge_requests/295" ], "PublishedDate": "2024-03-27T05:15:47.263Z", "LastModifiedDate": "2026-06-17T06:29:47.93Z" }, { "VulnerabilityID": "CVE-2023-45913", "PkgID": "libglx-mesa0@22.3.6-1+deb12u2", "PkgName": "libglx-mesa0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglx-mesa0@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "2da6ad3db758cde9" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45913", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d0dd3a18b5349844c5a96418d760661eefc5984ecb3b2fb12cf2d7590203903d", "Title": "Mesa v23.0.4 was discovered to contain a NULL pointer dereference via ...", "Description": "Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId(). This vulnerability is triggered when the X11 server sends an DRI2_BufferSwapComplete event unexpectedly when the application is using DRI3. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176800/Mesa-23.0.4-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/28", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9856", "https://seclists.org/fulldisclosure/2024/Jan/71" ], "PublishedDate": "2024-03-27T04:15:10.59Z", "LastModifiedDate": "2026-06-17T06:29:47.107Z" }, { "VulnerabilityID": "CVE-2023-45919", "PkgID": "libglx-mesa0@22.3.6-1+deb12u2", "PkgName": "libglx-mesa0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglx-mesa0@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "2da6ad3db758cde9" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45919", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4693ab85599e7a9ac8347e61f23c562bf7570bb0ca9a627b6745367147e1ebd9", "Title": "Mesa 23.0.4 was discovered to contain a buffer over-read in glXQuerySe ...", "Description": "Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176802/Mesa-23.0.4-Buffer-Overflow.html", "http://seclists.org/fulldisclosure/2024/Jan/47", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9858" ], "PublishedDate": "2024-03-27T05:15:47.03Z", "LastModifiedDate": "2026-06-17T06:29:47.34Z" }, { "VulnerabilityID": "CVE-2023-45922", "PkgID": "libglx-mesa0@22.3.6-1+deb12u2", "PkgName": "libglx-mesa0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglx-mesa0@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "2da6ad3db758cde9" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45922", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:65de596b0cfea89ce790b92938bf2f0e227c0fb0f5bc8170cc73fb4df573d5e0", "Title": "glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation ...", "Description": "glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-754" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176805/Mesa-23.0.4-Buffer-Overflow-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/50", "http://seclists.org/fulldisclosure/2024/Jan/71", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9857" ], "PublishedDate": "2024-03-27T05:15:47.203Z", "LastModifiedDate": "2026-06-17T06:29:47.72Z" }, { "VulnerabilityID": "CVE-2023-45931", "PkgID": "libglx-mesa0@22.3.6-1+deb12u2", "PkgName": "libglx-mesa0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglx-mesa0@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "2da6ad3db758cde9" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45931", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1c91487c62b6988e52047f3a37a1b808ae70112c7cf60d6a2f4fa9e4234ee6bb", "Title": "Mesa 23.0.4 was discovered to contain a NULL pointer dereference in ch ...", "Description": "Mesa 23.0.4 was discovered to contain a NULL pointer dereference in check_xshm() for the has_error state. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176813/Mesa-23.0.4-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/59", "http://seclists.org/fulldisclosure/2024/Jan/71", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9859", "https://seclists.org/fulldisclosure/2024/Jan/71" ], "PublishedDate": "2024-03-27T04:15:11.25Z", "LastModifiedDate": "2026-06-17T06:29:48.707Z" }, { "VulnerabilityID": "CVE-2023-45924", "PkgID": "libglx0@1.6.0-1", "PkgName": "libglx0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libglx0@1.6.0-1?arch=amd64\u0026distro=debian-12.15", "UID": "cf0b062eed3b8a98" }, "InstalledVersion": "1.6.0-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45924", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:de7ccd6fd9df1b7ea27ffddda389ffd413ee5d66949ab5a7dc4eb2a0fe111ab7", "Title": "libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a ...", "Description": "libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a segmentation violation via the function glXGetDrawableScreen(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-121", "CWE-476" ], "VendorSeverity": { "amazon": 2, "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176807/libglvnd-bb06db5a-Buffer-Overflow-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/52", "https://gitlab.freedesktop.org/glvnd/libglvnd/-/issues/242", "https://gitlab.freedesktop.org/glvnd/libglvnd/-/merge_requests/295" ], "PublishedDate": "2024-03-27T05:15:47.263Z", "LastModifiedDate": "2026-06-17T06:29:47.93Z" }, { "VulnerabilityID": "CVE-2011-3389", "PkgID": "libgnutls30@3.7.9-2+deb12u7", "PkgName": "libgnutls30", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u7?arch=amd64\u0026distro=debian-12.15", "UID": "1825cdc4e3258ffb" }, "InstalledVersion": "3.7.9-2+deb12u7", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-3389", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8bd5576e2f04556c1a3a8bf3b6c9e5641cc7a0bebae6bc45bcaf34b780e8ae2b", "Title": "HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)", "Description": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.", "Severity": "LOW", "CweIDs": [ "CWE-326" ], "VendorSeverity": { "amazon": 4, "debian": 1, "nvd": 2, "oracle-oval": 4, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "V2Score": 4.3 }, "redhat": { "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "V2Score": 4.3 } }, "References": [ "http://arcticdog.wordpress.com/2012/08/29/beast-openssl-and-apache/", "http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/", "http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx", "http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx", "http://curl.haxx.se/docs/adv_20120124B.html", "http://downloads.asterisk.org/pub/security/AST-2016-001.html", "http://ekoparty.org/2011/juliano-rizzo.php", "http://eprint.iacr.org/2004/111", "http://eprint.iacr.org/2006/136", "http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html", "http://isc.sans.edu/diary/SSL+TLS+part+3+/11635", "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html", "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html", "http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html", "http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html", "http://lists.apple.com/archives/security-announce/2012/May/msg00001.html", "http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html", "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html", "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html", "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html", "http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html", "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html", "http://marc.info/?l=bugtraq\u0026m=132750579901589\u0026w=2", "http://marc.info/?l=bugtraq\u0026m=132872385320240\u0026w=2", "http://marc.info/?l=bugtraq\u0026m=133365109612558\u0026w=2", "http://marc.info/?l=bugtraq\u0026m=133728004526190\u0026w=2", "http://marc.info/?l=bugtraq\u0026m=134254866602253\u0026w=2", "http://marc.info/?l=bugtraq\u0026m=134254957702612\u0026w=2", "http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue", "http://osvdb.org/74829", "http://rhn.redhat.com/errata/RHSA-2012-0508.html", "http://rhn.redhat.com/errata/RHSA-2013-1455.html", "http://secunia.com/advisories/45791", "http://secunia.com/advisories/47998", "http://secunia.com/advisories/48256", "http://secunia.com/advisories/48692", "http://secunia.com/advisories/48915", "http://secunia.com/advisories/48948", "http://secunia.com/advisories/49198", "http://secunia.com/advisories/55322", "http://secunia.com/advisories/55350", "http://secunia.com/advisories/55351", "http://security.gentoo.org/glsa/glsa-201203-02.xml", "http://security.gentoo.org/glsa/glsa-201406-32.xml", "http://support.apple.com/kb/HT4999", "http://support.apple.com/kb/HT5001", "http://support.apple.com/kb/HT5130", "http://support.apple.com/kb/HT5281", "http://support.apple.com/kb/HT5501", "http://support.apple.com/kb/HT6150", "http://technet.microsoft.com/security/advisory/2588513", "http://vnhacker.blogspot.com/2011/09/beast.html", "http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf", "http://www.debian.org/security/2012/dsa-2398", "http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html", "http://www.ibm.com/developerworks/java/jdk/alerts/", "http://www.imperialviolet.org/2011/09/23/chromeandbeast.html", "http://www.insecure.cl/Beast-SSL.rar", "http://www.kb.cert.org/vuls/id/864643", "http://www.mandriva.com/security/advisories?name=MDVSA-2012:058", "http://www.opera.com/docs/changelogs/mac/1151/", "http://www.opera.com/docs/changelogs/mac/1160/", "http://www.opera.com/docs/changelogs/unix/1151/", "http://www.opera.com/docs/changelogs/unix/1160/", "http://www.opera.com/docs/changelogs/windows/1151/", "http://www.opera.com/docs/changelogs/windows/1160/", "http://www.opera.com/support/kb/view/1004/", "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html", "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html", "http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html", "http://www.redhat.com/support/errata/RHSA-2011-1384.html", "http://www.redhat.com/support/errata/RHSA-2012-0006.html", "http://www.securityfocus.com/bid/49388", "http://www.securityfocus.com/bid/49778", "http://www.securitytracker.com/id/1029190", "http://www.securitytracker.com/id?1025997", "http://www.securitytracker.com/id?1026103", "http://www.securitytracker.com/id?1026704", "http://www.ubuntu.com/usn/USN-1263-1", "http://www.us-cert.gov/cas/techalerts/TA12-010A.html", "https://access.redhat.com/security/cve/CVE-2011-3389", "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail", "https://bugzilla.novell.com/show_bug.cgi?id=719047", "https://bugzilla.redhat.com/show_bug.cgi?id=737506", "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006", "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862", "https://hermes.opensuse.org/messages/13154861", "https://hermes.opensuse.org/messages/13155432", "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "https://linux.oracle.com/cve/CVE-2011-3389.html", "https://linux.oracle.com/errata/ELSA-2011-1380.html", "https://nvd.nist.gov/vuln/detail/CVE-2011-3389", "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:14752", "https://ubuntu.com/security/notices/USN-1263-1", "https://www.cve.org/CVERecord?id=CVE-2011-3389" ], "PublishedDate": "2011-09-06T19:55:03.197Z", "LastModifiedDate": "2026-04-29T01:13:23.04Z" }, { "VulnerabilityID": "CVE-2022-27943", "PkgID": "libgomp1@12.2.0-14+deb12u1", "PkgName": "libgomp1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgomp1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "ab9f3376b6eee575" }, "InstalledVersion": "12.2.0-14+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-27943", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:00160ffec3dac28d9b527120b8d0415416f9c487a6219d146e535cf95439233e", "Title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "Description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", "Severity": "LOW", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "amazon": 1, "debian": 1, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2022-27943", "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead", "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/", "https://nvd.nist.gov/vuln/detail/CVE-2022-27943", "https://sourceware.org/bugzilla/show_bug.cgi?id=28995", "https://www.cve.org/CVERecord?id=CVE-2022-27943" ], "PublishedDate": "2022-03-26T13:15:07.9Z", "LastModifiedDate": "2026-06-17T04:37:46.95Z" }, { "VulnerabilityID": "CVE-2018-5709", "PkgID": "libgssapi-krb5-2@1.20.1-2+deb12u5", "PkgName": "libgssapi-krb5-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "cef581a5d8a0ac0f" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-5709", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3b3e3035bc193e4cc9385729ee3778e39089ac31edf22de4242d2a6db89efbf8", "Title": "krb5: integer overflow in dbentry-\u003en_key_data in kadmin/dbutil/dump.c", "Description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry-\u003en_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", "Severity": "LOW", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2018-5709", "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2018-5709", "https://www.cve.org/CVERecord?id=CVE-2018-5709" ], "PublishedDate": "2018-01-16T09:29:00.5Z", "LastModifiedDate": "2026-06-17T02:00:38.083Z" }, { "VulnerabilityID": "CVE-2024-26458", "PkgID": "libgssapi-krb5-2@1.20.1-2+deb12u5", "PkgName": "libgssapi-krb5-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "cef581a5d8a0ac0f" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c195a29fa5fac9157c809bc00e4008ac14fb39f9ee90e6cd4f8a2da1bc40b2c", "Title": "krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c", "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.", "Severity": "LOW", "CweIDs": [ "CWE-401" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 1, "rocky": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:9331", "https://access.redhat.com/security/cve/CVE-2024-26458", "https://bugzilla.redhat.com/2266731", "https://bugzilla.redhat.com/2266740", "https://bugzilla.redhat.com/2266742", "https://bugzilla.redhat.com/show_bug.cgi?id=2266731", "https://bugzilla.redhat.com/show_bug.cgi?id=2266740", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461", "https://errata.almalinux.org/9/ALSA-2024-9331.html", "https://errata.rockylinux.org/RLSA-2024:3268", "https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md", "https://linux.oracle.com/cve/CVE-2024-26458.html", "https://linux.oracle.com/errata/ELSA-2024-9331.html", "https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-26458", "https://security.netapp.com/advisory/ntap-20240415-0010/", "https://ubuntu.com/security/notices/USN-7314-1", "https://www.cve.org/CVERecord?id=CVE-2024-26458" ], "PublishedDate": "2024-02-29T01:44:18.78Z", "LastModifiedDate": "2026-06-17T07:17:40.823Z" }, { "VulnerabilityID": "CVE-2024-26461", "PkgID": "libgssapi-krb5-2@1.20.1-2+deb12u5", "PkgName": "libgssapi-krb5-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "cef581a5d8a0ac0f" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:74af2cd421105320c773cd6f786d297ea224f82f035a21dc021defa172682d6d", "Title": "krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c", "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.", "Severity": "LOW", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 3, "cbl-mariner": 3, "debian": 1, "oracle-oval": 2, "photon": 3, "redhat": 1, "rocky": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:9331", "https://access.redhat.com/security/cve/CVE-2024-26461", "https://bugzilla.redhat.com/2266731", "https://bugzilla.redhat.com/2266740", "https://bugzilla.redhat.com/2266742", "https://bugzilla.redhat.com/show_bug.cgi?id=2266731", "https://bugzilla.redhat.com/show_bug.cgi?id=2266740", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461", "https://errata.almalinux.org/9/ALSA-2024-9331.html", "https://errata.rockylinux.org/RLSA-2024:3268", "https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md", "https://linux.oracle.com/cve/CVE-2024-26461.html", "https://linux.oracle.com/errata/ELSA-2024-9331.html", "https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-26461", "https://security.netapp.com/advisory/ntap-20240415-0011/", "https://ubuntu.com/security/notices/USN-7314-1", "https://www.cve.org/CVERecord?id=CVE-2024-26461" ], "PublishedDate": "2024-02-29T01:44:18.82Z", "LastModifiedDate": "2026-06-17T07:17:41.003Z" }, { "VulnerabilityID": "CVE-2026-11850", "PkgID": "libgssapi-krb5-2@1.20.1-2+deb12u5", "PkgName": "libgssapi-krb5-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libgssapi-krb5-2@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "cef581a5d8a0ac0f" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11850", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b14d2fbc535234b30c3cae04ca5057333abeffe197f685a3ccc556a5e92515f0", "Title": "krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read", "Description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len \u003c 2, triggering the underflow when the KDC or kadmind reads principal data.", "Severity": "LOW", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "amazon": 2, "debian": 1, "photon": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25520", "https://access.redhat.com/security/cve/CVE-2026-11850", "https://bugzilla.redhat.com/show_bug.cgi?id=2459970", "https://nvd.nist.gov/vuln/detail/CVE-2026-11850", "https://ubuntu.com/security/notices/USN-8585-1", "https://www.cve.org/CVERecord?id=CVE-2026-11850" ], "PublishedDate": "2026-06-11T10:16:21.217Z", "LastModifiedDate": "2026-06-17T10:14:30.383Z" }, { "VulnerabilityID": "CVE-2023-25193", "PkgID": "libharfbuzz0b@6.0.0+dfsg-3", "PkgName": "libharfbuzz0b", "PkgIdentifier": { "PURL": "pkg:deb/debian/libharfbuzz0b@6.0.0%2Bdfsg-3?arch=amd64\u0026distro=debian-12.15", "UID": "da6f84dd706514a0" }, "InstalledVersion": "6.0.0+dfsg-3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-25193", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e49a1ed0af2d11fff7d44327252bd167f1a04676d7eabdd77af1f40f2b0cb2a6", "Title": "harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks", "Description": "hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 2, "amazon": 2, "bitnami": 3, "cbl-mariner": 3, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:2410", "https://access.redhat.com/security/cve/CVE-2023-25193", "https://bugzilla.redhat.com/2167254", "https://bugzilla.redhat.com/show_bug.cgi?id=2167254", "https://chromium.googlesource.com/chromium/src/+/e1f324aa681af54101c1f2d173d92adb80e37088/DEPS#361", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25193", "https://errata.almalinux.org/9/ALSA-2024-2410.html", "https://errata.rockylinux.org/RLSA-2024:2410", "https://github.com/harfbuzz/harfbuzz/blob/2822b589bc837fae6f66233e2cf2eef0f6ce8470/src/hb-ot-layout-gsubgpos.hh", "https://github.com/harfbuzz/harfbuzz/commit/85be877925ddbf34f74a1229f3ca1716bb6170dc", "https://github.com/harfbuzz/harfbuzz/commit/85be877925ddbf34f74a1229f3ca1716bb6170dc%20%28reverted%29", "https://linux.oracle.com/cve/CVE-2023-25193.html", "https://linux.oracle.com/errata/ELSA-2024-2980.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWCHWSICWVZSAXP2YAXM65JC2GR53547/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YZ5M2GSAIHFPLHYJXUPQ2QDJCLWXUGO3/", "https://nvd.nist.gov/vuln/detail/CVE-2023-25193", "https://openjdk.org/groups/vulnerability/advisories/2023-07-18", "https://security.netapp.com/advisory/ntap-20230725-0006/", "https://ubuntu.com/security/notices/USN-6263-1", "https://ubuntu.com/security/notices/USN-6272-1", "https://ubuntu.com/security/notices/USN-7251-1", "https://www.cve.org/CVERecord?id=CVE-2023-25193", "https://www.oracle.com/security-alerts/cpujul2023.html" ], "PublishedDate": "2023-02-04T20:15:08.027Z", "LastModifiedDate": "2026-06-17T05:40:53.533Z" }, { "VulnerabilityID": "CVE-2026-22693", "PkgID": "libharfbuzz0b@6.0.0+dfsg-3", "PkgName": "libharfbuzz0b", "PkgIdentifier": { "PURL": "pkg:deb/debian/libharfbuzz0b@6.0.0%2Bdfsg-3?arch=amd64\u0026distro=debian-12.15", "UID": "da6f84dd706514a0" }, "InstalledVersion": "6.0.0+dfsg-3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-22693", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:68e5b6fa6c96951daaf688654107ec23e7ca9e738d87d31980cac6959475668d", "Title": "harfbuzz: Null Pointer Dereference in harfbuzz", "Description": "HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 2, "azure": 2, "julia": 2, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/01/11/1", "http://www.openwall.com/lists/oss-security/2026/01/12/1", "https://access.redhat.com/security/cve/CVE-2026-22693", "https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae", "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww", "https://nvd.nist.gov/vuln/detail/CVE-2026-22693", "https://www.cve.org/CVERecord?id=CVE-2026-22693" ], "PublishedDate": "2026-01-10T06:15:52.063Z", "LastModifiedDate": "2026-06-17T10:20:14.783Z" }, { "VulnerabilityID": "CVE-2017-9937", "PkgID": "libjbig0@2.1-6.1", "PkgName": "libjbig0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libjbig0@2.1-6.1?arch=amd64\u0026distro=debian-12.15", "UID": "1650131acc34570e" }, "InstalledVersion": "2.1-6.1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-9937", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:493b765fb80151804a28cc98b0f4592435fdbf0ac3f1e1ea6cfda92c854da540", "Title": "libtiff: memory malloc failure in tif_jbig.c could cause DOS.", "Description": "In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.", "Severity": "LOW", "CweIDs": [ "CWE-119" ], "VendorSeverity": { "debian": 1, "nvd": 2, "photon": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "http://bugzilla.maptools.org/show_bug.cgi?id=2707", "http://www.securityfocus.com/bid/99304", "https://access.redhat.com/security/cve/CVE-2017-9937", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2017-9937", "https://ubuntu.com/security/notices/USN-5742-1", "https://www.cve.org/CVERecord?id=CVE-2017-9937" ], "PublishedDate": "2017-06-26T12:29:00.25Z", "LastModifiedDate": "2026-06-17T01:29:14.76Z" }, { "VulnerabilityID": "CVE-2025-70103", "PkgID": "libjxl0.7@0.7.0-10+deb12u1", "PkgName": "libjxl0.7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libjxl0.7@0.7.0-10%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "bea4bb097438a61f" }, "InstalledVersion": "0.7.0-10+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-70103", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f040285934f99d3d524b2085a7af61db1289042823357e7d7aee3749c78c6d8f", "Title": "libjxl: libjxl: Arbitrary code execution via crafted PBM images", "Description": "Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/30/7", "https://access.redhat.com/security/cve/CVE-2025-70103", "https://github.com/libjxl/libjxl/issues/4337", "https://github.com/libjxl/libjxl/pull/4338", "https://github.com/sigdevel/pocs/blob/main/res/libjxl/2025/2", "https://infosec.exchange/@sigdevel/116642233929409910", "https://nvd.nist.gov/vuln/detail/CVE-2025-70103", "https://ubuntu.com/security/notices/USN-8397-1", "https://www.cve.org/CVERecord?id=CVE-2025-70103" ], "PublishedDate": "2026-05-27T15:16:24.783Z", "LastModifiedDate": "2026-06-17T10:03:08.83Z" }, { "VulnerabilityID": "CVE-2025-12474", "PkgID": "libjxl0.7@0.7.0-10+deb12u1", "PkgName": "libjxl0.7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libjxl0.7@0.7.0-10%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "bea4bb097438a61f" }, "InstalledVersion": "0.7.0-10+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-12474", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:560a4149899a289079d9ddc3bc6f9818359cdddedc39599044bacbdb3bf393f0", "Title": "libjxl: libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling", "Description": "A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.\n\nThis can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.", "Severity": "MEDIUM", "CweIDs": [ "CWE-908" ], "VendorSeverity": { "amazon": 3, "nvd": 2, "redhat": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "V3Score": 4.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-12474", "https://github.com/libjxl/libjxl/pull/4495", "https://nvd.nist.gov/vuln/detail/CVE-2025-12474", "https://www.cve.org/CVERecord?id=CVE-2025-12474" ], "PublishedDate": "2026-02-11T16:15:53.647Z", "LastModifiedDate": "2026-06-17T08:32:26.76Z" }, { "VulnerabilityID": "CVE-2026-52584", "PkgID": "libjxl0.7@0.7.0-10+deb12u1", "PkgName": "libjxl0.7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libjxl0.7@0.7.0-10%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "bea4bb097438a61f" }, "InstalledVersion": "0.7.0-10+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-52584", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0ef9d86ea9c63bcf1b305d3ff03ad454e40724d060b1c8b0faecc32df655d62d", "Title": "libjxl: libjxl: Information disclosure via Buffer Overflow in DecodeImageAPNG function", "Description": "Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function", "Severity": "MEDIUM", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-52584", "https://github.com/libjxl/libjxl/issues/4803", "https://github.com/libjxl/libjxl/pull/4804", "https://nvd.nist.gov/vuln/detail/CVE-2026-52584", "https://www.cve.org/CVERecord?id=CVE-2026-52584" ], "PublishedDate": "2026-07-17T21:17:07.723Z", "LastModifiedDate": "2026-07-23T18:28:35.28Z" }, { "VulnerabilityID": "CVE-2021-36691", "PkgID": "libjxl0.7@0.7.0-10+deb12u1", "PkgName": "libjxl0.7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libjxl0.7@0.7.0-10%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "bea4bb097438a61f" }, "InstalledVersion": "0.7.0-10+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-36691", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cb8e5b3f8a66606df0fcf9acddfc9cfc9d7c9f107b7e783edce002da040bd814", "Title": "libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image ...", "Description": "libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase(). When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service.", "Severity": "LOW", "CweIDs": [ "CWE-617" ], "VendorSeverity": { "debian": 1, "nvd": 3 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V2Score": 5, "V3Score": 7.5 } }, "References": [ "https://github.com/libjxl/libjxl/issues/422" ], "PublishedDate": "2021-08-30T20:15:07.47Z", "LastModifiedDate": "2026-06-17T03:59:00.553Z" }, { "VulnerabilityID": "CVE-2018-5709", "PkgID": "libk5crypto3@1.20.1-2+deb12u5", "PkgName": "libk5crypto3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "cc3d2951db5cce7a" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-5709", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:60e42b5acd27a963c27f00197404815a8036aeef3d8347d5a9417d9ecf30b69e", "Title": "krb5: integer overflow in dbentry-\u003en_key_data in kadmin/dbutil/dump.c", "Description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry-\u003en_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", "Severity": "LOW", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2018-5709", "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2018-5709", "https://www.cve.org/CVERecord?id=CVE-2018-5709" ], "PublishedDate": "2018-01-16T09:29:00.5Z", "LastModifiedDate": "2026-06-17T02:00:38.083Z" }, { "VulnerabilityID": "CVE-2024-26458", "PkgID": "libk5crypto3@1.20.1-2+deb12u5", "PkgName": "libk5crypto3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "cc3d2951db5cce7a" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4de848a3ac1893dc624f461d282fcdcf24b04eff91efec7abaa09009646b920f", "Title": "krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c", "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.", "Severity": "LOW", "CweIDs": [ "CWE-401" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 1, "rocky": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:9331", "https://access.redhat.com/security/cve/CVE-2024-26458", "https://bugzilla.redhat.com/2266731", "https://bugzilla.redhat.com/2266740", "https://bugzilla.redhat.com/2266742", "https://bugzilla.redhat.com/show_bug.cgi?id=2266731", "https://bugzilla.redhat.com/show_bug.cgi?id=2266740", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461", "https://errata.almalinux.org/9/ALSA-2024-9331.html", "https://errata.rockylinux.org/RLSA-2024:3268", "https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md", "https://linux.oracle.com/cve/CVE-2024-26458.html", "https://linux.oracle.com/errata/ELSA-2024-9331.html", "https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-26458", "https://security.netapp.com/advisory/ntap-20240415-0010/", "https://ubuntu.com/security/notices/USN-7314-1", "https://www.cve.org/CVERecord?id=CVE-2024-26458" ], "PublishedDate": "2024-02-29T01:44:18.78Z", "LastModifiedDate": "2026-06-17T07:17:40.823Z" }, { "VulnerabilityID": "CVE-2024-26461", "PkgID": "libk5crypto3@1.20.1-2+deb12u5", "PkgName": "libk5crypto3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "cc3d2951db5cce7a" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:552e58ab8f5567afae4d7d249fa5e7125cbce6674d20a9fc430b1c210713597b", "Title": "krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c", "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.", "Severity": "LOW", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 3, "cbl-mariner": 3, "debian": 1, "oracle-oval": 2, "photon": 3, "redhat": 1, "rocky": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:9331", "https://access.redhat.com/security/cve/CVE-2024-26461", "https://bugzilla.redhat.com/2266731", "https://bugzilla.redhat.com/2266740", "https://bugzilla.redhat.com/2266742", "https://bugzilla.redhat.com/show_bug.cgi?id=2266731", "https://bugzilla.redhat.com/show_bug.cgi?id=2266740", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461", "https://errata.almalinux.org/9/ALSA-2024-9331.html", "https://errata.rockylinux.org/RLSA-2024:3268", "https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md", "https://linux.oracle.com/cve/CVE-2024-26461.html", "https://linux.oracle.com/errata/ELSA-2024-9331.html", "https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-26461", "https://security.netapp.com/advisory/ntap-20240415-0011/", "https://ubuntu.com/security/notices/USN-7314-1", "https://www.cve.org/CVERecord?id=CVE-2024-26461" ], "PublishedDate": "2024-02-29T01:44:18.82Z", "LastModifiedDate": "2026-06-17T07:17:41.003Z" }, { "VulnerabilityID": "CVE-2026-11850", "PkgID": "libk5crypto3@1.20.1-2+deb12u5", "PkgName": "libk5crypto3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libk5crypto3@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "cc3d2951db5cce7a" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11850", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9193560639e96395ba05704adf0ad37bf7da1b484d8364e20badedcb43751433", "Title": "krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read", "Description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len \u003c 2, triggering the underflow when the KDC or kadmind reads principal data.", "Severity": "LOW", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "amazon": 2, "debian": 1, "photon": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25520", "https://access.redhat.com/security/cve/CVE-2026-11850", "https://bugzilla.redhat.com/show_bug.cgi?id=2459970", "https://nvd.nist.gov/vuln/detail/CVE-2026-11850", "https://ubuntu.com/security/notices/USN-8585-1", "https://www.cve.org/CVERecord?id=CVE-2026-11850" ], "PublishedDate": "2026-06-11T10:16:21.217Z", "LastModifiedDate": "2026-06-17T10:14:30.383Z" }, { "VulnerabilityID": "CVE-2018-5709", "PkgID": "libkrb5-3@1.20.1-2+deb12u5", "PkgName": "libkrb5-3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "bf111d136a9ec9cc" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-5709", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0e66a060b63ccac0d62b7a4704a0e9712fa8b534e7bd0d21d256f33a0d04493e", "Title": "krb5: integer overflow in dbentry-\u003en_key_data in kadmin/dbutil/dump.c", "Description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry-\u003en_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", "Severity": "LOW", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2018-5709", "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2018-5709", "https://www.cve.org/CVERecord?id=CVE-2018-5709" ], "PublishedDate": "2018-01-16T09:29:00.5Z", "LastModifiedDate": "2026-06-17T02:00:38.083Z" }, { "VulnerabilityID": "CVE-2024-26458", "PkgID": "libkrb5-3@1.20.1-2+deb12u5", "PkgName": "libkrb5-3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "bf111d136a9ec9cc" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f87a5de7e69106dd084dc959e6c71ff9d09e9e584b3dd9f028d980f7701de099", "Title": "krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c", "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.", "Severity": "LOW", "CweIDs": [ "CWE-401" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 1, "rocky": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:9331", "https://access.redhat.com/security/cve/CVE-2024-26458", "https://bugzilla.redhat.com/2266731", "https://bugzilla.redhat.com/2266740", "https://bugzilla.redhat.com/2266742", "https://bugzilla.redhat.com/show_bug.cgi?id=2266731", "https://bugzilla.redhat.com/show_bug.cgi?id=2266740", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461", "https://errata.almalinux.org/9/ALSA-2024-9331.html", "https://errata.rockylinux.org/RLSA-2024:3268", "https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md", "https://linux.oracle.com/cve/CVE-2024-26458.html", "https://linux.oracle.com/errata/ELSA-2024-9331.html", "https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-26458", "https://security.netapp.com/advisory/ntap-20240415-0010/", "https://ubuntu.com/security/notices/USN-7314-1", "https://www.cve.org/CVERecord?id=CVE-2024-26458" ], "PublishedDate": "2024-02-29T01:44:18.78Z", "LastModifiedDate": "2026-06-17T07:17:40.823Z" }, { "VulnerabilityID": "CVE-2024-26461", "PkgID": "libkrb5-3@1.20.1-2+deb12u5", "PkgName": "libkrb5-3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "bf111d136a9ec9cc" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a6c69842f82d64af81f309db2180f7bac092e49013101b07e82af3c825178485", "Title": "krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c", "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.", "Severity": "LOW", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 3, "cbl-mariner": 3, "debian": 1, "oracle-oval": 2, "photon": 3, "redhat": 1, "rocky": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:9331", "https://access.redhat.com/security/cve/CVE-2024-26461", "https://bugzilla.redhat.com/2266731", "https://bugzilla.redhat.com/2266740", "https://bugzilla.redhat.com/2266742", "https://bugzilla.redhat.com/show_bug.cgi?id=2266731", "https://bugzilla.redhat.com/show_bug.cgi?id=2266740", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461", "https://errata.almalinux.org/9/ALSA-2024-9331.html", "https://errata.rockylinux.org/RLSA-2024:3268", "https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md", "https://linux.oracle.com/cve/CVE-2024-26461.html", "https://linux.oracle.com/errata/ELSA-2024-9331.html", "https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-26461", "https://security.netapp.com/advisory/ntap-20240415-0011/", "https://ubuntu.com/security/notices/USN-7314-1", "https://www.cve.org/CVERecord?id=CVE-2024-26461" ], "PublishedDate": "2024-02-29T01:44:18.82Z", "LastModifiedDate": "2026-06-17T07:17:41.003Z" }, { "VulnerabilityID": "CVE-2026-11850", "PkgID": "libkrb5-3@1.20.1-2+deb12u5", "PkgName": "libkrb5-3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5-3@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "bf111d136a9ec9cc" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11850", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6ea784982c2f517063bb9aa9e0c905175e8d71552a05672b1477df6afbbb6a92", "Title": "krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read", "Description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len \u003c 2, triggering the underflow when the KDC or kadmind reads principal data.", "Severity": "LOW", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "amazon": 2, "debian": 1, "photon": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25520", "https://access.redhat.com/security/cve/CVE-2026-11850", "https://bugzilla.redhat.com/show_bug.cgi?id=2459970", "https://nvd.nist.gov/vuln/detail/CVE-2026-11850", "https://ubuntu.com/security/notices/USN-8585-1", "https://www.cve.org/CVERecord?id=CVE-2026-11850" ], "PublishedDate": "2026-06-11T10:16:21.217Z", "LastModifiedDate": "2026-06-17T10:14:30.383Z" }, { "VulnerabilityID": "CVE-2018-5709", "PkgID": "libkrb5support0@1.20.1-2+deb12u5", "PkgName": "libkrb5support0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "81ccec4ad369fa5d" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-5709", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:98364dc420a9ad603220fe98f24fac99b7972dbaa4346a252d67ab1470cfbaba", "Title": "krb5: integer overflow in dbentry-\u003en_key_data in kadmin/dbutil/dump.c", "Description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry-\u003en_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", "Severity": "LOW", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2018-5709", "https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2018-5709", "https://www.cve.org/CVERecord?id=CVE-2018-5709" ], "PublishedDate": "2018-01-16T09:29:00.5Z", "LastModifiedDate": "2026-06-17T02:00:38.083Z" }, { "VulnerabilityID": "CVE-2024-26458", "PkgID": "libkrb5support0@1.20.1-2+deb12u5", "PkgName": "libkrb5support0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "81ccec4ad369fa5d" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26458", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8b3823f19d211a48ea9b92bd0a87a3fe48f591c099aa6da7d1c010264ecbfd42", "Title": "krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c", "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.", "Severity": "LOW", "CweIDs": [ "CWE-401" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 1, "rocky": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:9331", "https://access.redhat.com/security/cve/CVE-2024-26458", "https://bugzilla.redhat.com/2266731", "https://bugzilla.redhat.com/2266740", "https://bugzilla.redhat.com/2266742", "https://bugzilla.redhat.com/show_bug.cgi?id=2266731", "https://bugzilla.redhat.com/show_bug.cgi?id=2266740", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461", "https://errata.almalinux.org/9/ALSA-2024-9331.html", "https://errata.rockylinux.org/RLSA-2024:3268", "https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md", "https://linux.oracle.com/cve/CVE-2024-26458.html", "https://linux.oracle.com/errata/ELSA-2024-9331.html", "https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-26458", "https://security.netapp.com/advisory/ntap-20240415-0010/", "https://ubuntu.com/security/notices/USN-7314-1", "https://www.cve.org/CVERecord?id=CVE-2024-26458" ], "PublishedDate": "2024-02-29T01:44:18.78Z", "LastModifiedDate": "2026-06-17T07:17:40.823Z" }, { "VulnerabilityID": "CVE-2024-26461", "PkgID": "libkrb5support0@1.20.1-2+deb12u5", "PkgName": "libkrb5support0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "81ccec4ad369fa5d" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-26461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:67e2995b565417a417ab33859218f31ff54a5f594e0d528fd26aefefdfb6663a", "Title": "krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c", "Description": "Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.", "Severity": "LOW", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 3, "cbl-mariner": 3, "debian": 1, "oracle-oval": 2, "photon": 3, "redhat": 1, "rocky": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:9331", "https://access.redhat.com/security/cve/CVE-2024-26461", "https://bugzilla.redhat.com/2266731", "https://bugzilla.redhat.com/2266740", "https://bugzilla.redhat.com/2266742", "https://bugzilla.redhat.com/show_bug.cgi?id=2266731", "https://bugzilla.redhat.com/show_bug.cgi?id=2266740", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26461", "https://errata.almalinux.org/9/ALSA-2024-9331.html", "https://errata.rockylinux.org/RLSA-2024:3268", "https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md", "https://linux.oracle.com/cve/CVE-2024-26461.html", "https://linux.oracle.com/errata/ELSA-2024-9331.html", "https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-26461", "https://security.netapp.com/advisory/ntap-20240415-0011/", "https://ubuntu.com/security/notices/USN-7314-1", "https://www.cve.org/CVERecord?id=CVE-2024-26461" ], "PublishedDate": "2024-02-29T01:44:18.82Z", "LastModifiedDate": "2026-06-17T07:17:41.003Z" }, { "VulnerabilityID": "CVE-2026-11850", "PkgID": "libkrb5support0@1.20.1-2+deb12u5", "PkgName": "libkrb5support0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libkrb5support0@1.20.1-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "81ccec4ad369fa5d" }, "InstalledVersion": "1.20.1-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11850", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c6d247a7fb8e71933c51a6f47a9e429b1c44842b13de9c6629045418d1b7ce87", "Title": "krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read", "Description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len \u003c 2, triggering the underflow when the KDC or kadmind reads principal data.", "Severity": "LOW", "CweIDs": [ "CWE-191" ], "VendorSeverity": { "amazon": 2, "debian": 1, "photon": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25520", "https://access.redhat.com/security/cve/CVE-2026-11850", "https://bugzilla.redhat.com/show_bug.cgi?id=2459970", "https://nvd.nist.gov/vuln/detail/CVE-2026-11850", "https://ubuntu.com/security/notices/USN-8585-1", "https://www.cve.org/CVERecord?id=CVE-2026-11850" ], "PublishedDate": "2026-06-11T10:16:21.217Z", "LastModifiedDate": "2026-06-17T10:14:30.383Z" }, { "VulnerabilityID": "CVE-2025-29070", "PkgID": "liblcms2-2@2.14-2+deb12u1", "PkgName": "liblcms2-2", "PkgIdentifier": { "PURL": "pkg:deb/debian/liblcms2-2@2.14-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "814522fd942f6aa8" }, "InstalledVersion": "2.14-2+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-29070", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cf51d2b2df9e27bf154336f87bc0e684496814ac0353bc626e7c8b1aa36a1aff", "Title": "A heap buffer overflow vulnerability has been identified in thesmooth2 ...", "Description": "A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because \"this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation.\"", "Severity": "LOW", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "amazon": 2, "debian": 1 }, "References": [ "https://github.com/mm2/Little-CMS/issues/475", "https://github.com/mm2/Little-CMS/issues/475#issuecomment-2696785063" ], "PublishedDate": "2025-04-01T21:15:44.023Z", "LastModifiedDate": "2026-06-17T09:05:06.7Z" }, { "VulnerabilityID": "CVE-2023-2953", "PkgID": "libldap-2.5-0@2.5.13+dfsg-5", "PkgName": "libldap-2.5-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.15", "UID": "1bdeeaa4bf6afd83" }, "InstalledVersion": "2.5.13+dfsg-5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-2953", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f0527760b090cddae2f160bd5f445d447439a5a971350dd3eed859a0a9249270", "Title": "openldap: null pointer dereference in ber_memalloc_x function", "Description": "A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 1, "amazon": 2, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 1, "photon": 3, "redhat": 1, "rocky": 1, "ubuntu": 1 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "V3Score": 7.1 } }, "References": [ "http://seclists.org/fulldisclosure/2023/Jul/47", "http://seclists.org/fulldisclosure/2023/Jul/48", "http://seclists.org/fulldisclosure/2023/Jul/52", "https://access.redhat.com/errata/RHSA-2024:4264", "https://access.redhat.com/security/cve/CVE-2023-2953", "https://bugs.openldap.org/show_bug.cgi?id=9904", "https://bugzilla.redhat.com/2210651", "https://bugzilla.redhat.com/show_bug.cgi?id=2210651", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2953", "https://errata.almalinux.org/8/ALSA-2024-4264.html", "https://errata.rockylinux.org/RLSA-2024:4264", "https://linux.oracle.com/cve/CVE-2023-2953.html", "https://linux.oracle.com/errata/ELSA-2024-4264.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-2953", "https://security.netapp.com/advisory/ntap-20230703-0005/", "https://support.apple.com/kb/HT213843", "https://support.apple.com/kb/HT213844", "https://support.apple.com/kb/HT213845", "https://ubuntu.com/security/notices/USN-6197-1", "https://ubuntu.com/security/notices/USN-6616-1", "https://www.cve.org/CVERecord?id=CVE-2023-2953" ], "PublishedDate": "2023-05-30T22:15:10.613Z", "LastModifiedDate": "2026-06-17T05:53:52.317Z" }, { "VulnerabilityID": "CVE-2015-3276", "PkgID": "libldap-2.5-0@2.5.13+dfsg-5", "PkgName": "libldap-2.5-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.15", "UID": "1bdeeaa4bf6afd83" }, "InstalledVersion": "2.5.13+dfsg-5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2015-3276", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ed833b81fdb939c6b37b4128d7dd79ab72515bd898d833f58a37a6c12a017bc4", "Title": "openldap: incorrect multi-keyword mode cipherstring parsing", "Description": "The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.", "Severity": "LOW", "VendorSeverity": { "amazon": 2, "cbl-mariner": 3, "debian": 1, "nvd": 3, "oracle-oval": 2, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "V2Score": 4.3 } }, "References": [ "http://rhn.redhat.com/errata/RHSA-2015-2131.html", "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html", "http://www.securitytracker.com/id/1034221", "https://access.redhat.com/security/cve/CVE-2015-3276", "https://bugzilla.redhat.com/show_bug.cgi?id=1238322", "https://linux.oracle.com/cve/CVE-2015-3276.html", "https://linux.oracle.com/errata/ELSA-2015-2131.html", "https://nvd.nist.gov/vuln/detail/CVE-2015-3276", "https://www.cve.org/CVERecord?id=CVE-2015-3276" ], "PublishedDate": "2015-12-07T20:59:03.023Z", "LastModifiedDate": "2026-05-06T22:30:45.22Z" }, { "VulnerabilityID": "CVE-2017-14159", "PkgID": "libldap-2.5-0@2.5.13+dfsg-5", "PkgName": "libldap-2.5-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.15", "UID": "1bdeeaa4bf6afd83" }, "InstalledVersion": "2.5.13+dfsg-5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-14159", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fcd92f2efab5bb242b0b554a387d7673d60358f1656a994eea74a8e2593c19e5", "Title": "openldap: Privilege escalation via PID file manipulation", "Description": "slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript.", "Severity": "LOW", "CweIDs": [ "CWE-665" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V2Score": 1.9, "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 4.4 } }, "References": [ "http://www.openldap.org/its/index.cgi?findid=8703", "https://access.redhat.com/security/cve/CVE-2017-14159", "https://nvd.nist.gov/vuln/detail/CVE-2017-14159", "https://www.cve.org/CVERecord?id=CVE-2017-14159", "https://www.oracle.com/security-alerts/cpuapr2022.html" ], "PublishedDate": "2017-09-05T18:29:00.133Z", "LastModifiedDate": "2026-06-17T01:05:41.863Z" }, { "VulnerabilityID": "CVE-2017-17740", "PkgID": "libldap-2.5-0@2.5.13+dfsg-5", "PkgName": "libldap-2.5-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.15", "UID": "1bdeeaa4bf6afd83" }, "InstalledVersion": "2.5.13+dfsg-5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-17740", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1069c5aa282d7dd3e867ec4108ff18df124f54c2e2e2a6472d5d1242a41a8c86", "Title": "openldap: contrib/slapd-modules/nops/nops.c attempts to free stack buffer allowing remote attackers to cause a denial of service", "Description": "contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.", "Severity": "LOW", "CweIDs": [ "CWE-119" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html", "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html", "http://www.openldap.org/its/index.cgi/Incoming?id=8759", "https://access.redhat.com/security/cve/CVE-2017-17740", "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365", "https://nvd.nist.gov/vuln/detail/CVE-2017-17740", "https://www.cve.org/CVERecord?id=CVE-2017-17740", "https://www.oracle.com/security-alerts/cpuapr2022.html" ], "PublishedDate": "2017-12-18T06:29:00.397Z", "LastModifiedDate": "2026-06-17T01:11:34.287Z" }, { "VulnerabilityID": "CVE-2020-15719", "PkgID": "libldap-2.5-0@2.5.13+dfsg-5", "PkgName": "libldap-2.5-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.15", "UID": "1bdeeaa4bf6afd83" }, "InstalledVersion": "2.5.13+dfsg-5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-15719", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f07cb7674644b9f342d313b60441ba3d0ddc79cd238698710f40e867bca7fc21", "Title": "openldap: Certificate validation incorrectly matches name against CN-ID", "Description": "libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.", "Severity": "LOW", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "bitnami": 2, "debian": 1, "nvd": 2, "redhat": 1 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "V3Score": 4.2 }, "nvd": { "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N", "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "V2Score": 4, "V3Score": 4.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "V3Score": 4.2 } }, "References": [ "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html", "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html", "https://access.redhat.com/errata/RHBA-2019:3674", "https://access.redhat.com/security/cve/CVE-2020-15719", "https://bugs.openldap.org/show_bug.cgi?id=9266", "https://bugzilla.redhat.com/show_bug.cgi?id=1740070", "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365", "https://nvd.nist.gov/vuln/detail/CVE-2020-15719", "https://www.cve.org/CVERecord?id=CVE-2020-15719", "https://www.oracle.com/security-alerts/cpuapr2022.html" ], "PublishedDate": "2020-07-14T14:15:17.667Z", "LastModifiedDate": "2026-06-17T02:57:07.147Z" }, { "VulnerabilityID": "CVE-2026-22185", "PkgID": "libldap-2.5-0@2.5.13+dfsg-5", "PkgName": "libldap-2.5-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libldap-2.5-0@2.5.13%2Bdfsg-5?arch=amd64\u0026distro=debian-12.15", "UID": "1bdeeaa4bf6afd83" }, "InstalledVersion": "2.5.13+dfsg-5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-22185", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d9936ace801a023dced83da6bb3465de0a822cbf4cca58dfe615b64d58cd066d", "Title": "OpenLDAP: OpenLDAP LMDB: Denial of Service and Information Disclosure via Heap Buffer Underflow", "Description": "OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.", "Severity": "LOW", "CweIDs": [ "CWE-125", "CWE-191" ], "VendorSeverity": { "debian": 1, "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-22185", "https://bugs.openldap.org/show_bug.cgi?id=10421", "https://nvd.nist.gov/vuln/detail/CVE-2026-22185", "https://seclists.org/fulldisclosure/2026/Jan/5", "https://seclists.org/fulldisclosure/2026/Jan/8", "https://www.cve.org/CVERecord?id=CVE-2026-22185", "https://www.openldap.org/", "https://www.vulncheck.com/advisories/openldap-lmdb-mdb-load-heap-buffer-underflow-in-readline" ], "PublishedDate": "2026-01-07T21:16:01.733Z", "LastModifiedDate": "2026-06-17T10:19:30.257Z" }, { "VulnerabilityID": "CVE-2023-26924", "PkgID": "libllvm15@1:15.0.6-4+b1", "PkgName": "libllvm15", "PkgIdentifier": { "PURL": "pkg:deb/debian/libllvm15@15.0.6-4%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f795a0fe0bc3db51" }, "InstalledVersion": "1:15.0.6-4+b1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-26924", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f4bd21fc28e6f13f32f5dc20f3206c1bfe4231bd40249a81f018c8b0cde846b5", "Title": "llvm: mlir:: outlineSingleBlockRegion crashes with segmentation fault", "Description": "LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. NOTE: third parties dispute this because the LLVM security policy excludes \"Language front-ends ... for which a malicious input file can cause undesirable behavior.\"", "Severity": "LOW", "CweIDs": [ "CWE-120" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-26924", "https://gist.github.com/Colloportus0/fc16d10d74aedf89d5d1d020ebb89c0c", "https://github.com/llvm/llvm-project/issues/60216", "https://llvm.org/docs/Security.html#what-is-considered-a-security-issue", "https://nvd.nist.gov/vuln/detail/CVE-2023-26924", "https://www.cve.org/CVERecord?id=CVE-2023-26924" ], "PublishedDate": "2023-03-27T22:15:21.967Z", "LastModifiedDate": "2026-06-17T05:43:57.84Z" }, { "VulnerabilityID": "CVE-2023-29932", "PkgID": "libllvm15@1:15.0.6-4+b1", "PkgName": "libllvm15", "PkgIdentifier": { "PURL": "pkg:deb/debian/libllvm15@15.0.6-4%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f795a0fe0bc3db51" }, "InstalledVersion": "1:15.0.6-4+b1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29932", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ee9e61b913ec47e08bdf9cf14a37d7781fb58eefd9802fec86c0cb356f29e893", "Title": "llvm: canonicalize pass crashed with segmentation fault", "Description": "llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand\u003cmlir::OpOperand.", "Severity": "LOW", "CweIDs": [ "CWE-119", "CWE-120" ], "VendorSeverity": { "cbl-mariner": 2, "debian": 1, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-29932", "https://github.com/llvm/llvm-project/commit/d35fcf0e97e7bb02381506a71e61ec282b292c50", "https://github.com/llvm/llvm-project/issues/58745", "https://nvd.nist.gov/vuln/detail/CVE-2023-29932", "https://ubuntu.com/security/notices/USN-6258-1", "https://www.cve.org/CVERecord?id=CVE-2023-29932" ], "PublishedDate": "2023-05-05T15:15:09.633Z", "LastModifiedDate": "2026-06-17T05:51:05.373Z" }, { "VulnerabilityID": "CVE-2023-29933", "PkgID": "libllvm15@1:15.0.6-4+b1", "PkgName": "libllvm15", "PkgIdentifier": { "PURL": "pkg:deb/debian/libllvm15@15.0.6-4%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f795a0fe0bc3db51" }, "InstalledVersion": "1:15.0.6-4+b1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29933", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b6ee5a971a6e311f6fb1d95b5360a5309d59439eb12b372c5582ec983c38cbeb", "Title": "llvm: one shot bufferize crashed with segmentation fault", "Description": "llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "cbl-mariner": 2, "debian": 1, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-29933", "https://github.com/llvm/llvm-project/issues/59442", "https://nvd.nist.gov/vuln/detail/CVE-2023-29933", "https://ubuntu.com/security/notices/USN-6258-1", "https://www.cve.org/CVERecord?id=CVE-2023-29933" ], "PublishedDate": "2023-05-05T15:15:09.683Z", "LastModifiedDate": "2026-06-17T05:51:05.567Z" }, { "VulnerabilityID": "CVE-2023-29934", "PkgID": "libllvm15@1:15.0.6-4+b1", "PkgName": "libllvm15", "PkgIdentifier": { "PURL": "pkg:deb/debian/libllvm15@15.0.6-4%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f795a0fe0bc3db51" }, "InstalledVersion": "1:15.0.6-4+b1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29934", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c347ecebbbe33dd14f23e8848c49f972a35b06eae72eaf4413691d7eb44b4a5e", "Title": "llvm: convert-scf-to-spirv Pass crashed with segmentation fault", "Description": "llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect().", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-29934", "https://github.com/llvm/llvm-project/commit/80d5400d924e543c5420f4e924f5818313605e99", "https://github.com/llvm/llvm-project/issues/59136", "https://nvd.nist.gov/vuln/detail/CVE-2023-29934", "https://ubuntu.com/security/notices/USN-6258-1", "https://www.cve.org/CVERecord?id=CVE-2023-29934" ], "PublishedDate": "2023-05-05T15:15:09.733Z", "LastModifiedDate": "2026-06-17T05:51:05.773Z" }, { "VulnerabilityID": "CVE-2023-29935", "PkgID": "libllvm15@1:15.0.6-4+b1", "PkgName": "libllvm15", "PkgIdentifier": { "PURL": "pkg:deb/debian/libllvm15@15.0.6-4%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f795a0fe0bc3db51" }, "InstalledVersion": "1:15.0.6-4+b1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29935", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9d173a7fdb70354ca34403144aace9c883feeb7049fa2b73c03ba3147c3664b2", "Title": "llvm: gpu-to-llvm Pass crashed with error message", "Description": "llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) \u0026\u0026 \"operation was already replaced.", "Severity": "LOW", "CweIDs": [ "CWE-617" ], "VendorSeverity": { "cbl-mariner": 2, "debian": 1, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-29935", "https://github.com/llvm/llvm-project/issues/59182", "https://nvd.nist.gov/vuln/detail/CVE-2023-29935", "https://www.cve.org/CVERecord?id=CVE-2023-29935" ], "PublishedDate": "2023-05-05T15:15:09.783Z", "LastModifiedDate": "2026-06-17T05:51:05.973Z" }, { "VulnerabilityID": "CVE-2023-29939", "PkgID": "libllvm15@1:15.0.6-4+b1", "PkgName": "libllvm15", "PkgIdentifier": { "PURL": "pkg:deb/debian/libllvm15@15.0.6-4%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f795a0fe0bc3db51" }, "InstalledVersion": "1:15.0.6-4+b1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29939", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e5aad1a92d406e061cbbd85765264e8a2768a76d95fb244ebcc4ecd8c6f60458", "Title": "llvm-project commit a0138390 was discovered to contain a segmentation ...", "Description": "llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::TargetEnv(mlir::spirv::TargetEnvAttr).", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "debian": 1, "nvd": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://github.com/llvm/llvm-project/commit/466aa585c6dfb096bf9a7ad9bcbc6ce8cc7abff1", "https://github.com/llvm/llvm-project/issues/59983", "https://ubuntu.com/security/notices/USN-6258-1", "https://www.cve.org/CVERecord?id=CVE-2023-29939" ], "PublishedDate": "2023-05-05T15:15:09.85Z", "LastModifiedDate": "2026-06-17T05:51:06.17Z" }, { "VulnerabilityID": "CVE-2023-29941", "PkgID": "libllvm15@1:15.0.6-4+b1", "PkgName": "libllvm15", "PkgIdentifier": { "PURL": "pkg:deb/debian/libllvm15@15.0.6-4%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f795a0fe0bc3db51" }, "InstalledVersion": "1:15.0.6-4+b1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29941", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:971f79c802200b2d8eb45534a7bcb4d2ff0abde7fa04d96105c172ca413e28f4", "Title": "llvm: sparse-buffer-rewrite pass crashes with Segmentation fault", "Description": "llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp\u003cmlir::sparse_tensor::SortOp\u003e(mlir::sparse_tensor::SortOp.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "cbl-mariner": 2, "debian": 1, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-29941", "https://github.com/llvm/llvm-project/issues/59988", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWCCXDZP7H2JNFULSZZWXGAZHZUPN5DS/", "https://nvd.nist.gov/vuln/detail/CVE-2023-29941", "https://www.cve.org/CVERecord?id=CVE-2023-29941" ], "PublishedDate": "2023-05-05T15:15:09.917Z", "LastModifiedDate": "2026-06-17T05:51:06.37Z" }, { "VulnerabilityID": "CVE-2023-29942", "PkgID": "libllvm15@1:15.0.6-4+b1", "PkgName": "libllvm15", "PkgIdentifier": { "PURL": "pkg:deb/debian/libllvm15@15.0.6-4%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f795a0fe0bc3db51" }, "InstalledVersion": "1:15.0.6-4+b1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29942", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d59052655596c8747f9da65d22249f170c8d4ec7a817c40c397dfa2620610c2a", "Title": "llvm: convert-spirv-to-llvm Pass trigger Segmentation fault in LLVMStructType verifier", "Description": "llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa\u003cmlir::LLVM::LLVMVoidType.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "cbl-mariner": 2, "debian": 1, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-29942", "https://github.com/llvm/llvm-project/issues/59990", "https://nvd.nist.gov/vuln/detail/CVE-2023-29942", "https://www.cve.org/CVERecord?id=CVE-2023-29942" ], "PublishedDate": "2023-05-05T15:15:09.97Z", "LastModifiedDate": "2026-06-17T05:51:06.567Z" }, { "VulnerabilityID": "CVE-2024-31852", "PkgID": "libllvm15@1:15.0.6-4+b1", "PkgName": "libllvm15", "PkgIdentifier": { "PURL": "pkg:deb/debian/libllvm15@15.0.6-4%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f795a0fe0bc3db51" }, "InstalledVersion": "1:15.0.6-4+b1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-31852", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b0d062cce0863859f23f205fe54c54a2e7664f9a2ba4faee8c333a6c6b7d5d4e", "Title": "llvm: LR register can be overwritten without data being saved to the stack on ARM", "Description": "LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is \"we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production.\"", "Severity": "LOW", "VendorSeverity": { "azure": 2, "cbl-mariner": 2, "debian": 1, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "V3Score": 4.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-31852", "https://bugs.chromium.org/p/llvm/issues/detail?id=69", "https://github.com/llvm/llvm-project/issues/80287", "https://github.com/llvmbot/llvm-project/commit/0e16af8e4cf3a66ad5d078d52744ae2776f9c4b2", "https://llvm.org/docs/Security.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-31852", "https://www.cve.org/CVERecord?id=CVE-2024-31852" ], "PublishedDate": "2024-04-05T15:15:08.27Z", "LastModifiedDate": "2026-06-17T07:28:50.233Z" }, { "VulnerabilityID": "CVE-2024-7883", "PkgID": "libllvm15@1:15.0.6-4+b1", "PkgName": "libllvm15", "PkgIdentifier": { "PURL": "pkg:deb/debian/libllvm15@15.0.6-4%2Bb1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "f795a0fe0bc3db51" }, "InstalledVersion": "1:15.0.6-4+b1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-7883", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1e80fd1a54dafaf73d79c96f648ea67bbcd97d6685929220f6c39fdc375e32f1", "Title": "clang: CMSE secure state may leak from stack to floating-point registers", "Description": "When using Arm Cortex-M Security Extensions (CMSE), Secure stack \ncontents can be leaked to Non-secure state via floating-point registers \nwhen a Secure to Non-secure function call is made that returns a \nfloating-point value and when this is the first use of floating-point \nsince entering Secure state. This allows an attacker to read a limited \nquantity of Secure stack contents with an impact on confidentiality. \nThis issue is specific to code generated using LLVM-based compilers.", "Severity": "LOW", "CweIDs": [ "CWE-226" ], "VendorSeverity": { "azure": 1, "redhat": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-7883", "https://developer.arm.com/Arm%20Security%20Center/Cortex-M%20Security%20Extensions%20Vulnerability", "https://github.com/llvm/llvm-project/pull/114433", "https://nvd.nist.gov/vuln/detail/CVE-2024-7883", "https://www.cve.org/CVERecord?id=CVE-2024-7883" ], "PublishedDate": "2024-10-31T17:15:14.013Z", "LastModifiedDate": "2026-06-17T08:21:06.623Z" }, { "VulnerabilityID": "CVE-2025-47917", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-47917", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3763cd6fc03f9debb27e95b409371a97f5836822d426ff00b6ce28d96792ef7d", "Title": "Mbed TLS before 3.6.4 allows a use-after-free in certain situations of ...", "Description": "Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).", "Severity": "CRITICAL", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "julia": 4, "nvd": 4, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-7.md", "https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html", "https://lists.debian.org/debian-lts-announce/2025/08/msg00025.html", "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/", "https://ubuntu.com/security/notices/USN-8123-1", "https://www.cve.org/CVERecord?id=CVE-2025-47917" ], "PublishedDate": "2025-07-20T19:15:23.847Z", "LastModifiedDate": "2026-06-17T09:28:50.79Z" }, { "VulnerabilityID": "CVE-2026-34873", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34873", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dc3f45c6ec6bcd02c23aa25fde700b05ef65141e3773bb18789ad56178ac384c", "Title": "mbedtls: Mbed TLS: Client impersonation during TLS 1.3 session resumption", "Description": "An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client impersonation can occur while resuming a TLS 1.3 session.", "Severity": "CRITICAL", "CweIDs": [ "CWE-287" ], "VendorSeverity": { "redhat": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "V3Score": 10 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-34873", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-client-impersonation-while-resuming-tls13-session/", "https://nvd.nist.gov/vuln/detail/CVE-2026-34873", "https://www.cve.org/CVERecord?id=CVE-2026-34873" ], "PublishedDate": "2026-04-01T21:17:01.99Z", "LastModifiedDate": "2026-06-17T10:39:46.21Z" }, { "VulnerabilityID": "CVE-2026-34875", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34875", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c9094480200bc321e84bba3d24ade3abdd926f192e3fef285883c3293c16ab38", "Title": "mbedtls: Mbed TLS and TF-PSA-Crypto: Arbitrary code execution due to buffer overflow in FFDH key export", "Description": "An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto 1.0.0. A buffer overflow can occur in public key export for FFDH keys.", "Severity": "CRITICAL", "CweIDs": [ "CWE-120" ], "VendorSeverity": { "redhat": 4 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-34875", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ffdh-buffer-overflow/", "https://nvd.nist.gov/vuln/detail/CVE-2026-34875", "https://www.cve.org/CVERecord?id=CVE-2026-34875" ], "PublishedDate": "2026-04-01T18:16:31.433Z", "LastModifiedDate": "2026-06-17T10:39:46.523Z" }, { "VulnerabilityID": "CVE-2024-23775", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-23775", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c07c76ca1d5a763ca283df54c9b9768a727f1714864a05da1d1d1ddc2cce117f", "Title": "Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x b ...", "Description": "Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "cbl-mariner": 3, "julia": 3, "nvd": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2/", "https://nvd.nist.gov/vuln/detail/CVE-2024-23775", "https://ubuntu.com/security/notices/USN-8123-1", "https://www.cve.org/CVERecord?id=CVE-2024-23775" ], "PublishedDate": "2024-01-31T08:15:42.267Z", "LastModifiedDate": "2026-06-17T07:13:34.953Z" }, { "VulnerabilityID": "CVE-2025-48965", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-48965", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2d1d3301ff5b92a3371b5cd5653e2b10e7bc28d93c5fb08ab9d38f2896592520", "Title": "Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_a ...", "Description": "Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.", "Severity": "HIGH", "CweIDs": [ "CWE-696", "CWE-476" ], "VendorSeverity": { "julia": 3, "nvd": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-6.md", "https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html", "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/", "https://ubuntu.com/security/notices/USN-8123-1", "https://www.cve.org/CVERecord?id=CVE-2025-48965" ], "PublishedDate": "2025-07-20T18:15:22.95Z", "LastModifiedDate": "2026-06-17T09:30:35.387Z" }, { "VulnerabilityID": "CVE-2025-52496", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-52496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0d54954f6841145a480126cdc835a96f7a8246228395952c2e722f967a17c943", "Title": "Mbed TLS before 3.6.4 has a race condition in AESNI detection if certa ...", "Description": "Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.", "Severity": "HIGH", "CweIDs": [ "CWE-733" ], "VendorSeverity": { "julia": 3, "nvd": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "V3Score": 7.8 } }, "References": [ "https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-1.md", "https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html", "https://ubuntu.com/security/notices/USN-8123-1", "https://www.cve.org/CVERecord?id=CVE-2025-52496" ], "PublishedDate": "2025-07-04T15:15:22.633Z", "LastModifiedDate": "2026-06-17T09:36:36.13Z" }, { "VulnerabilityID": "CVE-2026-25835", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c94c9386b5c01b5ee11a01fa4a7dfc071fbf4eb784af857ee867e986302da11e", "Title": "Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a ...", "Description": "Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).", "Severity": "HIGH", "CweIDs": [ "CWE-335" ], "VendorSeverity": { "julia": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.7 } }, "References": [ "https://mbed-tls.readthedocs.io/en/latest/security-advisories/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-rng-cloning/" ], "PublishedDate": "2026-04-01T19:16:28.663Z", "LastModifiedDate": "2026-06-17T10:25:18.663Z" }, { "VulnerabilityID": "CVE-2026-34872", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34872", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fd6f4e55af272789b09e357ed177c59a84d860a1cbccb33897cface00f8ccfae", "Title": "mbedtls: Mbed TLS and TF-PSA-Crypto: Shared secret manipulation via improper FFDH input validation", "Description": "An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH due to improper input validation. Using finite-field Diffie-Hellman, the other party can force the shared secret into a small set of values (lack of contributory behavior). This is a problem for protocols that depend on contributory behavior (which is not the case for TLS). The attack can be carried by the peer, or depending on the protocol by an active network attacker (person in the middle).", "Severity": "HIGH", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "julia": 4, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-34872", "https://github.com/advisories/GHSA-347r-37hj-5jc9", "https://mbed-tls.readthedocs.io/en/latest/security-advisories", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ffdh-peerkey-checks", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ffdh-peerkey-checks/", "https://nvd.nist.gov/vuln/detail/CVE-2026-34872", "https://www.cve.org/CVERecord?id=CVE-2026-34872" ], "PublishedDate": "2026-04-01T20:16:27.493Z", "LastModifiedDate": "2026-06-17T10:39:46.057Z" }, { "VulnerabilityID": "CVE-2024-23170", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-23170", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:422f777ed5d88b70b1e85ad823ec56f6f3ef79f0b8e5bc69f72bb98f57aa5b27", "Title": "An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3 ...", "Description": "An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in \"Everlasting ROBOT: the Marvin Attack\" by Hubert Kario.", "Severity": "MEDIUM", "CweIDs": [ "CWE-203", "CWE-385" ], "VendorSeverity": { "cbl-mariner": 2, "julia": 2, "nvd": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 } }, "References": [ "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1/", "https://nvd.nist.gov/vuln/detail/CVE-2024-23170", "https://www.cve.org/CVERecord?id=CVE-2024-23170" ], "PublishedDate": "2024-01-31T08:15:42.22Z", "LastModifiedDate": "2026-06-17T07:12:13.457Z" }, { "VulnerabilityID": "CVE-2024-28960", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-28960", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1de81cab3c2df0b5481452970681519b8abf1c0866f8ae556e4152dab6215534", "Title": "mbedtls: Insecure handling of shared memory in PSA Crypto APIs", "Description": "An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory.", "Severity": "MEDIUM", "CweIDs": [ "CWE-284" ], "VendorSeverity": { "cbl-mariner": 3, "julia": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-28960", "https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2024-03.md", "https://github.com/Mbed-TLS/mbedtls/issues/3266", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5YE3QRREGJC6K34JD4LZ5P3IALNX4QYY/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6UZNBMKYEV2J5DI7R4BQGL472V7X3WJY/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NCDU52ZDA7TX3HC5JCU6ZZIJQOPTNBK6/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-03/", "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/", "https://nvd.nist.gov/vuln/detail/CVE-2024-28960", "https://www.cve.org/CVERecord?id=CVE-2024-28960" ], "PublishedDate": "2024-03-29T06:15:07.27Z", "LastModifiedDate": "2026-06-17T07:22:09.543Z" }, { "VulnerabilityID": "CVE-2025-27809", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-27809", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:656d33b488831abb732f3f3afdf34eec19e5ebc26334615b8a3e96dcbe64a09f", "Title": "Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, acce ...", "Description": "Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.", "Severity": "MEDIUM", "CweIDs": [ "CWE-1188" ], "VendorSeverity": { "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "V3Score": 5.4 } }, "References": [ "https://github.com/Mbed-TLS/mbedtls/issues/466", "https://github.com/Mbed-TLS/mbedtls/releases", "https://mastodon.social/@bagder/114219540623402700", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-1/" ], "PublishedDate": "2025-03-25T06:15:41Z", "LastModifiedDate": "2026-06-17T09:04:15.59Z" }, { "VulnerabilityID": "CVE-2025-27810", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-27810", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8d7fea91c24d34aa5bfa82879b0073a0042634f2864a9ec32394130352844c10", "Title": "Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed ...", "Description": "Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.", "Severity": "MEDIUM", "CweIDs": [ "CWE-908" ], "VendorSeverity": { "julia": 2, "nvd": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 4.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 4.8 } }, "References": [ "https://github.com/Mbed-TLS/mbedtls/releases", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2/", "https://ubuntu.com/security/notices/USN-8123-1", "https://www.cve.org/CVERecord?id=CVE-2025-27810" ], "PublishedDate": "2025-03-25T06:15:41.18Z", "LastModifiedDate": "2026-06-17T09:04:15.71Z" }, { "VulnerabilityID": "CVE-2025-52497", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-52497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a0155e4ecb781a15ba47bcfe0c2a2b9a5acba483a851082a0b6c9a19cca7a9cb", "Title": "Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer und ...", "Description": "Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.", "Severity": "MEDIUM", "CweIDs": [ "CWE-193" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "V3Score": 4.8 } }, "References": [ "https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-2.md", "https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html", "https://ubuntu.com/security/notices/USN-8123-1", "https://www.cve.org/CVERecord?id=CVE-2025-52497" ], "PublishedDate": "2025-07-04T15:15:22.787Z", "LastModifiedDate": "2026-06-17T09:36:36.253Z" }, { "VulnerabilityID": "CVE-2025-54764", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-54764", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:53a9792e68dc523e81ffcbcd3fa0a9de8aca762d1b443d1781e0acc6beb409fb", "Title": "Mbed TLS before 3.6.5 allows a local timing attack against certain RSA ...", "Description": "Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.", "Severity": "MEDIUM", "CweIDs": [ "CWE-208" ], "VendorSeverity": { "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 6.2 } }, "References": [ "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-10-ssbleed-mstep/", "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/" ], "PublishedDate": "2025-10-20T22:15:37.06Z", "LastModifiedDate": "2026-06-17T09:40:40.06Z" }, { "VulnerabilityID": "CVE-2025-59438", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-59438", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6df1b4e54ea8be8f4c3aca5677010126ea9c986b91bb538187119c66bbe8031b", "Title": "Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.", "Description": "Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.", "Severity": "MEDIUM", "CweIDs": [ "CWE-208" ], "VendorSeverity": { "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 } }, "References": [ "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-10-invalid-padding-error/", "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/" ], "PublishedDate": "2025-10-21T15:15:39.103Z", "LastModifiedDate": "2026-06-17T09:46:10.03Z" }, { "VulnerabilityID": "CVE-2018-1000520", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-1000520", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0e8301c4c510a344e00ace5312d59ab5b02137fc74d03af33e138219fb71f433", "Title": "ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows In ...", "Description": "ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls_ssl_get_verify_result() that can result in ECDSA-signed certificates are accepted, when only RSA-signed ones should be.. This attack appear to be exploitable via Peers negotiate a TLS-ECDH-RSA-* ciphersuite. Any of the peers can then provide an ECDSA-signed certificate, when only an RSA-signed one should be accepted..", "Severity": "LOW", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "debian": 1, "nvd": 3, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V2Score": 5, "V3Score": 7.5 } }, "References": [ "https://github.com/ARMmbed/mbedtls/issues/1561", "https://www.cve.org/CVERecord?id=CVE-2018-1000520" ], "PublishedDate": "2018-06-26T16:29:01.353Z", "LastModifiedDate": "2026-06-17T01:32:49.94Z" }, { "VulnerabilityID": "CVE-2023-43615", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-43615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a96030b42d8178d8083618ca6318dfe32c23ccced9d8b723bf7618ca4b104a0f", "Title": "Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow.", "Description": "Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow.", "Severity": "LOW", "CweIDs": [ "CWE-120" ], "VendorSeverity": { "debian": 1, "julia": 3, "nvd": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BDSHAANRULB57GVS5B3DZHXL5KCC7OWQ/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GGRB5MO2KUJKYPMGXMIZH2WRH6QR5UZS/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7SB7L6A56QZALDTOZ6O4X7PTC4I647R/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2023-10-1/", "https://www.cve.org/CVERecord?id=CVE-2023-43615" ], "PublishedDate": "2023-10-07T01:15:10.783Z", "LastModifiedDate": "2026-06-17T06:26:04.34Z" }, { "VulnerabilityID": "CVE-2024-45157", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-45157", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8c7291b8b54f62f3ea6b53b5d2b64430b22101fb5e90e9ceb8539c134237d2b4", "Title": "An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1 ...", "Description": "An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not cause the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are disabled.", "Severity": "LOW", "CweIDs": [ "CWE-696" ], "VendorSeverity": { "debian": 1, "julia": 2, "nvd": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.1 } }, "References": [ "https://github.com/Mbed-TLS/mbedtls/releases/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-08-1/", "https://www.cve.org/CVERecord?id=CVE-2024-45157" ], "PublishedDate": "2024-09-05T19:15:12.96Z", "LastModifiedDate": "2026-06-17T07:53:40.82Z" }, { "VulnerabilityID": "CVE-2025-66442", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-66442", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9da58fc91a467e2ecf0c09556915bbc7e7506ca4c6b0ce06f3745daca1fb089d", "Title": "mbedtls: Mbed TLS and TF-PSA-Crypto: Information disclosure via compiler-induced timing side channel", "Description": "In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.", "Severity": "LOW", "CweIDs": [ "CWE-385" ], "VendorSeverity": { "debian": 1, "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-66442", "https://github.com/Mbed-TLS/TF-PSA-Crypto/releases", "https://github.com/Mbed-TLS/mbedtls/releases", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/", "https://nvd.nist.gov/vuln/detail/CVE-2025-66442", "https://www.cve.org/CVERecord?id=CVE-2025-66442" ], "PublishedDate": "2026-04-01T20:16:22.107Z", "LastModifiedDate": "2026-06-17T09:56:51.053Z" }, { "VulnerabilityID": "CVE-2026-25833", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:567eec45e673747fec88ebcb081f94a9f8afc2fe62fe80a5f53410232bef4d4e", "Title": "Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow ...", "Description": "Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function", "Severity": "LOW", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "debian": 1 }, "References": [ "https://mbed-tls.readthedocs.io/en/latest/security-advisories/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-inet-pton/" ], "PublishedDate": "2026-04-01T19:16:28.53Z", "LastModifiedDate": "2026-06-17T10:25:18.36Z" }, { "VulnerabilityID": "CVE-2026-34871", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34871", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d54b28157d2d2f44812aff1c963a33490744e43177a29c8cdf2cca6e38e6a0c9", "Title": "An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 ...", "Description": "An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).", "Severity": "LOW", "CweIDs": [ "CWE-338" ], "VendorSeverity": { "debian": 1, "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 6.7 } }, "References": [ "https://github.com/advisories/GHSA-rjq9-c3rf-c638", "https://mbed-tls.readthedocs.io/en/latest/security-advisories", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-dev-random", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-dev-random/", "https://nvd.nist.gov/vuln/detail/CVE-2026-34871" ], "PublishedDate": "2026-04-01T19:16:33.267Z", "LastModifiedDate": "2026-06-17T10:39:45.903Z" }, { "VulnerabilityID": "CVE-2026-34877", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34877", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4e2e36ffce8ccf50b0018323ab6a4e3aa366cea87de38eeb28110e92a02d61a5", "Title": "An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, ...", "Description": "An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs.", "Severity": "LOW", "CweIDs": [ "CWE-250", "CWE-502" ], "VendorSeverity": { "debian": 1, "julia": 4 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://mbed-tls.readthedocs.io/en/latest/security-advisories/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-serialized-data/" ], "PublishedDate": "2026-04-02T17:16:26.927Z", "LastModifiedDate": "2026-07-24T21:10:00.143Z" }, { "VulnerabilityID": "CVE-2024-28755", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-28755", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:845c02ffff15f3b7e14d7241fafca7bc08aec77b7984664eeebe19329a09b3de", "Title": "An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL co ...", "Description": "An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-326" ], "References": [ "https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0", "https://github.com/hey3e", "https://hey3e.github.io", "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/" ], "PublishedDate": "2024-04-03T03:15:10.14Z", "LastModifiedDate": "2026-06-17T07:21:44.857Z" }, { "VulnerabilityID": "CVE-2026-25832", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a3b7856bc749c8a17e73693e6cdc207a2eb85ded1ecc7a1ba6f0dba08d6ba5a6", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-34874", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34874", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a272a8cec989d938a1fdbf44098c6ce238dbfea5851158235ceec738b7557430", "Title": "An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0. ...", "Description": "An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-476" ], "References": [ "https://mbed-tls.readthedocs.io/en/latest/security-advisories/", "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-null-pointer-dereference-x509/" ], "PublishedDate": "2026-04-01T19:16:33.39Z", "LastModifiedDate": "2026-06-17T10:39:46.363Z" }, { "VulnerabilityID": "CVE-2026-34876", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34876", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bf214dbed9d82767c9178e504b0bd313d175a409682189de6b0cfbd42b88915e", "Title": "An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds ...", "Description": "An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain adjacent CCM context data via invocation of the multipart CCM API with an oversized tag_len parameter. This is caused by missing validation of the tag_len parameter against the size of the internal 16-byte authentication buffer. The issue affects the public multipart CCM API in Mbed TLS 3.x, where mbedtls_ccm_finish() can be invoked directly by applications. In Mbed TLS 4.x versions prior to the fix, the same missing validation exists in the internal implementation; however, the function is not exposed as part of the public API. Exploitation requires application-level invocation of the multipart CCM API.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-ccm-finish-boundary-check/", "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/" ], "PublishedDate": "2026-04-02T16:16:26.18Z", "LastModifiedDate": "2026-07-24T21:10:00.143Z" }, { "VulnerabilityID": "CVE-2026-35336", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-35336", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:31a59104b50c1604550de92422597d8bbb03f208313312bd708681636115dde1", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-49300", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-49300", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:60a493a0496aa0b3063f9b1ac2b8d8f6567ce95946d8f37b29ab9793cc4c738b", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-50579", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50579", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2168e3e998fec871211b4207c6b91b1fd2668fd70e615c73c959a244e5bdd94e", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-50580", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50580", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4e527b5bfbcf5b124957d44e7a25e4c2fbce9a27c40761f8c05433baea7e9c1b", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-50581", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50581", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f4d644669c07cc798e0aeeda2aaae4805e395c7bc87488d7786a31c1f6434ab1", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-50583", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50583", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1e717116763ff87e729cc31d1d4e50fcb73ac75fcead105cb83e342f91831c2a", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-50584", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50584", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:656df2fe840aa8fcd946756e5342c8cda09414d4c9913e4700a07b806be6c668", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-50585", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50585", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:900a9e9fae2fe6c4b6e3c04676ad2f656e56131719080dfebf52c9cf9f8536ac", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-50586", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50586", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:472a86d099222e839a116cf3e0a9953ba962e40f7d296c4c4be84c9de92d0917", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-50587", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50587", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7f43c123c1cd687fb79b142cde71d2f3d557c9c948811138174ee5849e6a964f", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-50588", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50588", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd7b96eadf816762be7c44b5d49632fbbf7e2d0ee076d06de7a0ed5ed3f3fdcd", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-50640", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50640", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bd314777b895be77edac8eddfedeb20b326e9294c6e598624c076b9a6d827c7e", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-50713", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50713", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:779ff9df3fc1f89f82be9b3b4739f2e63e49cc6789e452b61f8b23968f1839b6", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-54435", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54435", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7c25f27198dc421c6f860d7229167cb6867733b71a1c502d1be0ba1f96ba1e73", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-54441", "PkgID": "libmbedcrypto7@2.28.3-1", "PkgName": "libmbedcrypto7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmbedcrypto7@2.28.3-1?arch=amd64\u0026distro=debian-12.15", "UID": "f0ef0978bb49b49e" }, "InstalledVersion": "2.28.3-1", "Status": "end_of_life", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54441", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5208a905a06a4f3c942d522b87686cd480f6f2b2c77ece33e2f2a8d3d995fb3d", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2023-45221", "PkgID": "libmfx1@22.5.4-1", "PkgName": "libmfx1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmfx1@22.5.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "1a3c53149a5498ca" }, "InstalledVersion": "22.5.4-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:03588633108d1be475ac1d2f0998b88527777adc667b1f09d3bd5fbd209c719a", "Title": "Improper buffer restrictions in Intel(R) Media SDK all versions may al ...", "Description": "Improper buffer restrictions in Intel(R) Media SDK all versions may allow an authenticated user to potentially enable escalation of privilege via local access.", "Severity": "HIGH", "CweIDs": [ "CWE-119" ], "VendorSeverity": { "nvd": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://www.cve.org/CVERecord?id=CVE-2023-45221", "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html" ], "PublishedDate": "2024-05-16T21:15:57.2Z", "LastModifiedDate": "2026-06-17T06:28:28.423Z" }, { "VulnerabilityID": "CVE-2023-47169", "PkgID": "libmfx1@22.5.4-1", "PkgName": "libmfx1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmfx1@22.5.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "1a3c53149a5498ca" }, "InstalledVersion": "22.5.4-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-47169", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c478b052e70169563783d5a486fa547b88a188f3aa00c79deda2ac63859e3531", "Title": "Improper buffer restrictions in Intel(R) Media SDK software all versio ...", "Description": "Improper buffer restrictions in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access.", "Severity": "MEDIUM", "CweIDs": [ "CWE-92", "CWE-119" ], "VendorSeverity": { "nvd": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://www.cve.org/CVERecord?id=CVE-2023-47169", "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html" ], "PublishedDate": "2024-05-16T21:16:00.01Z", "LastModifiedDate": "2026-06-17T06:32:16.69Z" }, { "VulnerabilityID": "CVE-2023-48368", "PkgID": "libmfx1@22.5.4-1", "PkgName": "libmfx1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmfx1@22.5.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "1a3c53149a5498ca" }, "InstalledVersion": "22.5.4-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-48368", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f81b24586299e2d3e737988f01313ade8b00c1b4c357d556bf3610dc67282e2d", "Title": "Improper input validation in Intel(R) Media SDK software all versions ...", "Description": "Improper input validation in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access.", "Severity": "MEDIUM", "CweIDs": [ "CWE-20", "CWE-119" ], "VendorSeverity": { "nvd": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://www.cve.org/CVERecord?id=CVE-2023-48368", "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html" ], "PublishedDate": "2024-05-16T21:16:01.077Z", "LastModifiedDate": "2026-06-17T06:34:07.19Z" }, { "VulnerabilityID": "CVE-2023-22656", "PkgID": "libmfx1@22.5.4-1", "PkgName": "libmfx1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmfx1@22.5.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "1a3c53149a5498ca" }, "InstalledVersion": "22.5.4-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-22656", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c4988354bc07efc4070e912e0feb7856a3f928e884e96b46e113eff936e533e7", "Title": "Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL soft ...", "Description": "Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "ubuntu": 1 }, "References": [ "https://www.cve.org/CVERecord?id=CVE-2023-22656", "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html" ], "PublishedDate": "2024-05-16T21:15:50.353Z", "LastModifiedDate": "2026-06-17T05:35:52.17Z" }, { "VulnerabilityID": "CVE-2023-47282", "PkgID": "libmfx1@22.5.4-1", "PkgName": "libmfx1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmfx1@22.5.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "1a3c53149a5498ca" }, "InstalledVersion": "22.5.4-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-47282", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7f7b04c8f55d091953f259877b80c76e71b2fd2e5d7977c85ffaeeeac796554a", "Title": "Out-of-bounds write in Intel(R) Media SDK all versions and some Intel( ...", "Description": "Out-of-bounds write in Intel(R) Media SDK all versions and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access.", "Severity": "LOW", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "ubuntu": 1 }, "References": [ "https://www.cve.org/CVERecord?id=CVE-2023-47282", "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html" ], "PublishedDate": "2024-05-16T21:16:00.423Z", "LastModifiedDate": "2026-06-17T06:32:32.73Z" }, { "VulnerabilityID": "CVE-2023-48727", "PkgID": "libmfx1@22.5.4-1", "PkgName": "libmfx1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmfx1@22.5.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "1a3c53149a5498ca" }, "InstalledVersion": "22.5.4-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-48727", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b656ffd254fc173a04538fbb4712ac3996e34b7313f3cd66033b8a92f0bfdd3a", "Title": "NULL pointer dereference in some Intel(R) oneVPL software before versi ...", "Description": "NULL pointer dereference in some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable information disclosure via local access.", "Severity": "LOW", "CweIDs": [ "CWE-395" ], "VendorSeverity": { "ubuntu": 1 }, "References": [ "https://www.cve.org/CVERecord?id=CVE-2023-48727", "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00935.html" ], "PublishedDate": "2024-05-16T21:16:01.433Z", "LastModifiedDate": "2026-06-17T06:34:50.983Z" }, { "VulnerabilityID": "CVE-2024-21783", "PkgID": "libmfx1@22.5.4-1", "PkgName": "libmfx1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmfx1@22.5.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "1a3c53149a5498ca" }, "InstalledVersion": "22.5.4-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-21783", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d14e0c0251db07d7d438e4d8681eaf350b2f99019dcbe33df9fabef627f303d0", "Title": "Integer overflow for some Intel(R) VPL software before version 24.1.4 ...", "Description": "Integer overflow for some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escalation of privilege via local access.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-190" ], "References": [ "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01131.html" ], "PublishedDate": "2024-11-13T21:15:08.89Z", "LastModifiedDate": "2026-06-17T07:10:09.397Z" }, { "VulnerabilityID": "CVE-2024-21808", "PkgID": "libmfx1@22.5.4-1", "PkgName": "libmfx1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmfx1@22.5.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "1a3c53149a5498ca" }, "InstalledVersion": "22.5.4-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-21808", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:493b6e62e929dc09f6959ba884585ade1aa07e46a1c26385478d14aceb9a1df5", "Title": "Improper buffer restrictions in some Intel(R) VPL software before vers ...", "Description": "Improper buffer restrictions in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escalation of privilege via local access.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-92" ], "References": [ "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01131.html" ], "PublishedDate": "2024-11-13T21:15:09.403Z", "LastModifiedDate": "2026-06-17T07:10:12.26Z" }, { "VulnerabilityID": "CVE-2024-28030", "PkgID": "libmfx1@22.5.4-1", "PkgName": "libmfx1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmfx1@22.5.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "1a3c53149a5498ca" }, "InstalledVersion": "22.5.4-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-28030", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c273095d8cf0e35fb5fc06f4d45c6a326edf4cecc6d25591f4eb9d120e857a78", "Title": "NULL pointer dereference in some Intel(R) VPL software before version ...", "Description": "NULL pointer dereference in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable denial of service via local access.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-395" ], "References": [ "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01131.html" ], "PublishedDate": "2024-11-13T21:15:13.65Z", "LastModifiedDate": "2026-06-17T07:20:50.49Z" }, { "VulnerabilityID": "CVE-2024-28051", "PkgID": "libmfx1@22.5.4-1", "PkgName": "libmfx1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmfx1@22.5.4-1?arch=amd64\u0026distro=debian-12.15", "UID": "1a3c53149a5498ca" }, "InstalledVersion": "22.5.4-1", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-28051", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1f1607ee360dcf470a19c1f5d800b2c5c49eb7e96e1a8bfccbde73baa9010c85", "Title": "Out-of-bounds read in some Intel(R) VPL software before version 24.1.4 ...", "Description": "Out-of-bounds read in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable information disclosure via local access.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01131.html" ], "PublishedDate": "2024-11-13T21:15:14.123Z", "LastModifiedDate": "2026-06-17T07:20:52.507Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libmount1@2.38.1-5+deb12u3", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "1c28517f3a673db4" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a614eef6862d24f17076b0916932bd2901c45730cee8c0e93e9c84f75a94a622", "Title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "Description": "Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:\nCVE-2026-53615:\n\tInteger Overflow or Wraparound in libblkid/src/partitions/dos.c\n", "Severity": "HIGH", "VendorSeverity": { "amazon": 3 } }, { "VulnerabilityID": "CVE-2026-13595", "PkgID": "libmount1@2.38.1-5+deb12u3", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "1c28517f3a673db4" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13595", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:23d5958b798e2f5461a5df05eceae6034d0d23676fb37736ba22e6f8c9a5f9c0", "Title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "Description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26573", "https://access.redhat.com/security/cve/CVE-2026-13595", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c", "https://nvd.nist.gov/vuln/detail/CVE-2026-13595", "https://www.cve.org/CVERecord?id=CVE-2026-13595" ], "PublishedDate": "2026-06-29T09:16:28.303Z", "LastModifiedDate": "2026-07-08T03:37:21.637Z" }, { "VulnerabilityID": "CVE-2026-27456", "PkgID": "libmount1@2.38.1-5+deb12u3", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "1c28517f3a673db4" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:32a901c6e5f696ac463184a2cbd52e093646a023b7f07c73427f7e810f928d27", "Title": "util-linux: TOCTOU in the mount program when setting up loop devices", "Description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "Severity": "MEDIUM", "CweIDs": [ "CWE-59", "CWE-269", "CWE-367" ], "VendorSeverity": { "azure": 2, "bottlerocket": 2, "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://access.redhat.com/security/cve/CVE-2026-27456", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-jgcxwcxt3sxd.toml", "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g", "https://nvd.nist.gov/vuln/detail/CVE-2026-27456", "https://www.cve.org/CVERecord?id=CVE-2026-27456" ], "PublishedDate": "2026-04-03T22:16:25.4Z", "LastModifiedDate": "2026-07-24T22:10:00.14Z" }, { "VulnerabilityID": "CVE-2026-3184", "PkgID": "libmount1@2.38.1-5+deb12u3", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "1c28517f3a673db4" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-3184", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:468bff575c0b884be2835bc06f7e86661e235a1b41759cfeece50c5a5ace8727", "Title": "util-linux: util-linux: Access control bypass due to improper hostname canonicalization", "Description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "Severity": "MEDIUM", "CweIDs": [ "CWE-289" ], "VendorSeverity": { "azure": 1, "nvd": 2, "photon": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2026-3184", "https://bugzilla.redhat.com/show_bug.cgi?id=2442570", "https://nvd.nist.gov/vuln/detail/CVE-2026-3184", "https://www.cve.org/CVERecord?id=CVE-2026-3184" ], "PublishedDate": "2026-04-03T19:17:23.377Z", "LastModifiedDate": "2026-07-21T19:10:00.107Z" }, { "VulnerabilityID": "CVE-2022-0563", "PkgID": "libmount1@2.38.1-5+deb12u3", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "1c28517f3a673db4" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e9e1b702c54f5836913b66cb09a23d4d654b70c8a2f2be5cdc6353e51a1d1a88", "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", "Severity": "LOW", "CweIDs": [ "CWE-209" ], "VendorSeverity": { "amazon": 2, "bottlerocket": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 }, "nvd": { "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V2Score": 1.9, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0563", "https://access.redhat.com/security/cve/CVE-2022-0563", "https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-mv4q-wq4c-5xmg", "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", "https://security.gentoo.org/glsa/202401-08", "https://security.netapp.com/advisory/ntap-20220331-0002/", "https://www.cve.org/CVERecord?id=CVE-2022-0563" ], "PublishedDate": "2022-02-21T19:15:08.393Z", "LastModifiedDate": "2026-06-17T04:20:51.053Z" }, { "VulnerabilityID": "CVE-2025-14104", "PkgID": "libmount1@2.38.1-5+deb12u3", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "1c28517f3a673db4" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-14104", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4d450f9e3c22eb813149398f9801269e62d9d8d1da449908640a54c1136ff79c", "Title": "util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames", "Description": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1696", "https://access.redhat.com/errata/RHSA-2026:1852", "https://access.redhat.com/errata/RHSA-2026:1913", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2737", "https://access.redhat.com/errata/RHSA-2026:2800", "https://access.redhat.com/errata/RHSA-2026:3406", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2025-14104", "https://bugzilla.redhat.com/2419369", "https://bugzilla.redhat.com/show_bug.cgi?id=2419369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14104", "https://errata.almalinux.org/9/ALSA-2026-1913.html", "https://errata.rockylinux.org/RLSA-2026:1913", "https://linux.oracle.com/cve/CVE-2025-14104.html", "https://linux.oracle.com/errata/ELSA-2026-1913.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-14104", "https://www.cve.org/CVERecord?id=CVE-2025-14104" ], "PublishedDate": "2025-12-05T17:16:03.117Z", "LastModifiedDate": "2026-06-30T00:16:53.04Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "libmount1@2.38.1-5+deb12u3", "PkgName": "libmount1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "1c28517f3a673db4" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d702a36e749ee6f151504865353ed0f09b84d46b2834d567bc572522d62ca6a2", "Title": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "libncursesw6@6.4-4", "PkgName": "libncursesw6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libncursesw6@6.4-4?arch=amd64\u0026distro=debian-12.15", "UID": "5834ee5318950104" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a5a532e13e6058503ebbd8b71c258e32827e695fb331ff8d5bfa1a08ecd81cc1", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2023-50495", "PkgID": "libncursesw6@6.4-4", "PkgName": "libncursesw6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libncursesw6@6.4-4?arch=amd64\u0026distro=debian-12.15", "UID": "5834ee5318950104" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-50495", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:14344d02f70a91dbdbfa0cbc9fa973c3a84042432bc984c436ba3833e2a3558e", "Title": "ncurses: segmentation fault via _nc_wrap_entry()", "Description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().", "Severity": "MEDIUM", "VendorSeverity": { "amazon": 2, "cbl-mariner": 2, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-50495", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/", "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html", "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-50495", "https://security.netapp.com/advisory/ntap-20240119-0008/", "https://ubuntu.com/security/notices/USN-6684-1", "https://www.cve.org/CVERecord?id=CVE-2023-50495" ], "PublishedDate": "2023-12-12T15:15:07.867Z", "LastModifiedDate": "2026-06-17T06:39:44.053Z" }, { "VulnerabilityID": "CVE-2025-6141", "PkgID": "libncursesw6@6.4-4", "PkgName": "libncursesw6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libncursesw6@6.4-4?arch=amd64\u0026distro=debian-12.15", "UID": "5834ee5318950104" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-6141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6461627b6f599bf4ebcf91ea298183b7a36dbdc2fb5ab372ce911a6c0f812ca1", "Title": "gnu-ncurses: ncurses Stack Buffer Overflow", "Description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "Severity": "LOW", "CweIDs": [ "CWE-119", "CWE-121" ], "VendorSeverity": { "azure": 2, "julia": 2, "photon": 1, "redhat": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "V3Score": 3.3, "V40Score": 4.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-6141", "https://cert-portal.siemens.com/productcert/html/ssa-089022.html", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://github.com/advisories/GHSA-wfwf-ggr2-rpjf", "https://invisible-island.net/ncurses/NEWS.html#index-t20250329", "https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html", "https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html", "https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00114.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-6141", "https://vuldb.com/?ctiid.312610", "https://vuldb.com/?id.312610", "https://vuldb.com/?submit.593000", "https://www.cve.org/CVERecord?id=CVE-2025-6141", "https://www.gnu.org", "https://www.gnu.org/" ], "PublishedDate": "2025-06-16T22:16:41.527Z", "LastModifiedDate": "2026-06-17T10:01:15.04Z" }, { "VulnerabilityID": "CVE-2023-39328", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-39328", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ad34eae4f3426de417a385647be09c758d585fdf5d99bffadb9ccf9dea442c03", "Title": "openjpeg: denail of service via crafted image file", "Description": "A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.", "Severity": "MEDIUM", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "amazon": 2, "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-39328", "https://bugzilla.redhat.com/show_bug.cgi?id=2219236", "https://github.com/uclouvain/openjpeg/issues/1476", "https://github.com/uclouvain/openjpeg/pull/1470", "https://github.com/uclouvain/openjpeg/pull/1471", "https://nvd.nist.gov/vuln/detail/CVE-2023-39328", "https://www.cve.org/CVERecord?id=CVE-2023-39328" ], "PublishedDate": "2024-07-09T14:15:03.4Z", "LastModifiedDate": "2026-06-26T10:16:20.56Z" }, { "VulnerabilityID": "CVE-2023-39329", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-39329", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7492ed0160cb9ac41e69e2657f11b47b494306ef58d76ce4caa11374ed2052c6", "Title": "openjpeg: Resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c", "Description": "A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:4128", "https://access.redhat.com/security/cve/CVE-2023-39329", "https://bugzilla.redhat.com/show_bug.cgi?id=2295816", "https://nvd.nist.gov/vuln/detail/CVE-2023-39329", "https://www.cve.org/CVERecord?id=CVE-2023-39329" ], "PublishedDate": "2024-07-13T03:15:09.597Z", "LastModifiedDate": "2026-06-17T06:12:02.91Z" }, { "VulnerabilityID": "CVE-2016-10505", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-10505", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e117b0021ee06d896f04e653977f09770d2655421ee7a9b6ffb49574a2b6a7cf", "Title": "openjpeg: NULL pointer dereference in imagetopnm function in convert.c", "Description": "NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2016-10505", "https://github.com/uclouvain/openjpeg/issues/776", "https://github.com/uclouvain/openjpeg/issues/784", "https://github.com/uclouvain/openjpeg/issues/785", "https://github.com/uclouvain/openjpeg/issues/792", "https://nvd.nist.gov/vuln/detail/CVE-2016-10505", "https://security.gentoo.org/glsa/201710-26", "https://www.cve.org/CVERecord?id=CVE-2016-10505" ], "PublishedDate": "2017-08-30T09:29:00.293Z", "LastModifiedDate": "2026-06-17T00:39:48.733Z" }, { "VulnerabilityID": "CVE-2016-9113", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-9113", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:494d6de8d019443fb17135247680bc7fe5f24cebb6ef4ccbeed441ef185534c7", "Title": "openjpeg2: Multiple security issues", "Description": "There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image-\u003ecomps[0].data is not assigned a value after initialization(NULL). Impact is Denial of Service.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.6 } }, "References": [ "http://www.securityfocus.com/bid/93980", "https://access.redhat.com/security/cve/CVE-2016-9113", "https://github.com/uclouvain/openjpeg/issues/856", "https://nvd.nist.gov/vuln/detail/CVE-2016-9113", "https://security.gentoo.org/glsa/201710-26", "https://www.cve.org/CVERecord?id=CVE-2016-9113" ], "PublishedDate": "2016-10-30T22:59:00.18Z", "LastModifiedDate": "2026-06-17T00:55:32.317Z" }, { "VulnerabilityID": "CVE-2016-9114", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-9114", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:60ddab57af6f56cda5474b76a7508addcdf668cc3bb03503ff1f2ae36b460b41", "Title": "openjpeg2: Multiple security issues", "Description": "There is a NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) of OpenJPEG 2.1.2. image-\u003ecomps[compno].data is not assigned a value after initialization(NULL). Impact is Denial of Service.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.6 } }, "References": [ "http://www.securityfocus.com/bid/93979", "https://access.redhat.com/security/cve/CVE-2016-9114", "https://github.com/uclouvain/openjpeg/issues/857", "https://nvd.nist.gov/vuln/detail/CVE-2016-9114", "https://security.gentoo.org/glsa/201710-26", "https://www.cve.org/CVERecord?id=CVE-2016-9114" ], "PublishedDate": "2016-10-30T22:59:02.227Z", "LastModifiedDate": "2026-06-17T00:55:32.433Z" }, { "VulnerabilityID": "CVE-2016-9115", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-9115", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e2fa67ecc239b5b4abeb8e42ffb9b2af37c4f019a795620e8dee83497b62244e", "Title": "openjpeg2: Multiple security issues", "Description": "Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.", "Severity": "LOW", "CweIDs": [ "CWE-119" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.6 } }, "References": [ "http://www.securityfocus.com/bid/93977", "https://access.redhat.com/security/cve/CVE-2016-9115", "https://github.com/uclouvain/openjpeg/issues/858", "https://nvd.nist.gov/vuln/detail/CVE-2016-9115", "https://security.gentoo.org/glsa/201710-26", "https://www.cve.org/CVERecord?id=CVE-2016-9115" ], "PublishedDate": "2016-10-30T22:59:03.947Z", "LastModifiedDate": "2026-06-17T00:55:32.547Z" }, { "VulnerabilityID": "CVE-2016-9116", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-9116", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:492b258d4e793cb88a17599d2e8ba5918147b175abef333a371ec8ba54b41016", "Title": "openjpeg2: Multiple security issues", "Description": "NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.6 } }, "References": [ "http://www.securityfocus.com/bid/93975", "https://access.redhat.com/security/cve/CVE-2016-9116", "https://github.com/uclouvain/openjpeg/issues/859", "https://nvd.nist.gov/vuln/detail/CVE-2016-9116", "https://security.gentoo.org/glsa/201710-26", "https://www.cve.org/CVERecord?id=CVE-2016-9116" ], "PublishedDate": "2016-10-30T22:59:05.667Z", "LastModifiedDate": "2026-06-17T00:55:32.657Z" }, { "VulnerabilityID": "CVE-2016-9117", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-9117", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:08e5b02a237d0ad61383d9af2b5a217f2e21a6ce263eaf56ecf5c0b2820a006a", "Title": "openjpeg2: Multiple security issues", "Description": "NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.6 } }, "References": [ "http://www.securityfocus.com/bid/93783", "https://access.redhat.com/security/cve/CVE-2016-9117", "https://github.com/uclouvain/openjpeg/issues/860", "https://nvd.nist.gov/vuln/detail/CVE-2016-9117", "https://security.gentoo.org/glsa/201710-26", "https://www.cve.org/CVERecord?id=CVE-2016-9117" ], "PublishedDate": "2016-10-30T22:59:07.167Z", "LastModifiedDate": "2026-06-17T00:55:32.767Z" }, { "VulnerabilityID": "CVE-2016-9580", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-9580", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:63ead3491646ad57264a99babd705893e28e93c29caa924ce65a24db35c01952", "Title": "openjpeg2: Integer overflow in tiftoimage causes heap buffer overflow", "Description": "An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.", "Severity": "LOW", "CweIDs": [ "CWE-122", "CWE-190" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V2Score": 6.8, "V3Score": 8.8 }, "redhat": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V2Score": 4.3, "V3Score": 3.3 } }, "References": [ "http://www.securityfocus.com/bid/94822", "https://access.redhat.com/security/cve/CVE-2016-9580", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9580", "https://github.com/szukw000/openjpeg/commit/cadff5fb6e73398de26a92e96d3d7cac893af255", "https://github.com/uclouvain/openjpeg/issues/871", "https://nvd.nist.gov/vuln/detail/CVE-2016-9580", "https://security.gentoo.org/glsa/201710-26", "https://www.cve.org/CVERecord?id=CVE-2016-9580" ], "PublishedDate": "2018-08-01T16:29:00.477Z", "LastModifiedDate": "2026-06-17T00:56:16.92Z" }, { "VulnerabilityID": "CVE-2016-9581", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-9581", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:310d118692f0a5a5cec5e57d76da4779b2c2e2c8a04f2a79e61779686dd06ea4", "Title": "openjpeg2: Infinite loop in tiftoimage resulting into heap buffer overflow in convert_32s_C1P1", "Description": "An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.", "Severity": "LOW", "CweIDs": [ "CWE-122", "CWE-835", "CWE-119" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V2Score": 6.8, "V3Score": 8.8 }, "redhat": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V2Score": 4.3, "V3Score": 3.3 } }, "References": [ "http://www.securityfocus.com/bid/94822", "https://access.redhat.com/security/cve/CVE-2016-9581", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9581", "https://github.com/szukw000/openjpeg/commit/cadff5fb6e73398de26a92e96d3d7cac893af255", "https://github.com/uclouvain/openjpeg/issues/872", "https://nvd.nist.gov/vuln/detail/CVE-2016-9581", "https://security.gentoo.org/glsa/201710-26", "https://www.cve.org/CVERecord?id=CVE-2016-9581" ], "PublishedDate": "2018-08-01T14:29:00.393Z", "LastModifiedDate": "2026-06-17T00:56:17.04Z" }, { "VulnerabilityID": "CVE-2018-16376", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-16376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:37bd62314ff9aad180e2babd9602772b917bbc44c06a3789d4e10904176921b0", "Title": "openjpeg: Heap-based buffer overflow in function t2_encode_packet in src/lib/openmj2/t2.c", "Description": "An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.", "Severity": "LOW", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V2Score": 6.8, "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "http://www.securityfocus.com/bid/105262", "https://access.redhat.com/security/cve/CVE-2018-16376", "https://github.com/uclouvain/openjpeg/issues/1127", "https://nvd.nist.gov/vuln/detail/CVE-2018-16376", "https://www.cve.org/CVERecord?id=CVE-2018-16376" ], "PublishedDate": "2018-09-03T00:29:01.217Z", "LastModifiedDate": "2026-06-17T01:44:11.1Z" }, { "VulnerabilityID": "CVE-2019-6988", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-6988", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:328753ac04dbd6a6370d39757aef2b6c105491562b6772f52ac65d02c9210a60", "Title": "openjpeg: DoS via memory exhaustion in opj_decompress", "Description": "An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.", "Severity": "LOW", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "debian": 1, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.5 } }, "References": [ "http://www.securityfocus.com/bid/106785", "https://access.redhat.com/security/cve/CVE-2019-6988", "https://github.com/uclouvain/openjpeg/issues/1178", "https://github.com/uclouvain/openjpeg/issues/1178#issuecomment-1789970548", "https://nvd.nist.gov/vuln/detail/CVE-2019-6988", "https://www.cve.org/CVERecord?id=CVE-2019-6988" ], "PublishedDate": "2019-01-28T16:29:00.213Z", "LastModifiedDate": "2026-06-17T02:39:52.953Z" }, { "VulnerabilityID": "CVE-2023-39327", "PkgID": "libopenjp2-7@2.5.0-2+deb12u3", "PkgName": "libopenjp2-7", "PkgIdentifier": { "PURL": "pkg:deb/debian/libopenjp2-7@2.5.0-2%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d7218e2978e32065" }, "InstalledVersion": "2.5.0-2+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-39327", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:94fdafcb6d8b3d3caef3d35627f62cc134fc6d82f954b4a13e04b17f83fca748", "Title": "openjpeg: Malicious files can cause the program to enter a large loop", "Description": "A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.", "Severity": "LOW", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "julia": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 4.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 4.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:4128", "https://access.redhat.com/security/cve/CVE-2023-39327", "https://bugzilla.redhat.com/show_bug.cgi?id=2295812", "https://nvd.nist.gov/vuln/detail/CVE-2023-39327", "https://ubuntu.com/security/notices/USN-7037-1", "https://ubuntu.com/security/notices/USN-7623-1", "https://www.cve.org/CVERecord?id=CVE-2023-39327" ], "PublishedDate": "2024-07-13T03:15:09.347Z", "LastModifiedDate": "2026-06-17T06:12:02.583Z" }, { "VulnerabilityID": "CVE-2026-13757", "PkgID": "libp11-kit0@0.24.1-2", "PkgName": "libp11-kit0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libp11-kit0@0.24.1-2?arch=amd64\u0026distro=debian-12.15", "UID": "8ad8fe8135cab155" }, "InstalledVersion": "0.24.1-2", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13757", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d7987183bd4c8d6bf37543f970da09997e145fcdd63eed76ec54b60ddf82b0e9", "Title": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing", "Description": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.", "Severity": "MEDIUM", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:37469", "https://access.redhat.com/errata/RHSA-2026:38342", "https://access.redhat.com/security/cve/CVE-2026-13757", "https://bugzilla.redhat.com/show_bug.cgi?id=2494556", "https://github.com/advisories/GHSA-p2wm-69qx-x25w", "https://nvd.nist.gov/vuln/detail/CVE-2026-13757", "https://www.cve.org/CVERecord?id=CVE-2026-13757" ], "PublishedDate": "2026-06-29T19:16:40.907Z", "LastModifiedDate": "2026-07-13T06:16:24.863Z" }, { "VulnerabilityID": "CVE-2024-10041", "PkgID": "libpam-modules@1.5.2-6+deb12u2", "PkgName": "libpam-modules", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpam-modules@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "1c34e641d558b279" }, "InstalledVersion": "1.5.2-6+deb12u2", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-10041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:24a00a64e3ca751294806dfe234a759f73f7408855c6c792f3a5f73a37585f25", "Title": "pam: libpam: Libpam vulnerable to read hashed password", "Description": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.", "Severity": "MEDIUM", "CweIDs": [ "CWE-922" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "cbl-mariner": 2, "oracle-oval": 2, "redhat": 2, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:10379", "https://access.redhat.com/errata/RHSA-2024:11250", "https://access.redhat.com/errata/RHSA-2024:9941", "https://access.redhat.com/security/cve/CVE-2024-10041", "https://bugzilla.redhat.com/2319212", "https://bugzilla.redhat.com/show_bug.cgi?id=2319212", "https://bugzilla.redhat.com/show_bug.cgi?id=2324291", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10041", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10963", "https://errata.almalinux.org/9/ALSA-2024-11250.html", "https://errata.rockylinux.org/RLSA-2024:10379", "https://linux.oracle.com/cve/CVE-2024-10041.html", "https://linux.oracle.com/errata/ELSA-2024-11250.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-10041", "https://www.cve.org/CVERecord?id=CVE-2024-10041" ], "PublishedDate": "2024-10-23T14:15:03.97Z", "LastModifiedDate": "2026-06-30T00:16:47.39Z" }, { "VulnerabilityID": "CVE-2026-54411", "PkgID": "libpam-modules@1.5.2-6+deb12u2", "PkgName": "libpam-modules", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpam-modules@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "1c34e641d558b279" }, "InstalledVersion": "1.5.2-6+deb12u2", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54411", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6de7aebb10f9eb2ec9cd8837ef932f7211308f8fa6a7145364f8697758ccb38e", "Title": "linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module", "Description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "Severity": "MEDIUM", "CweIDs": [ "CWE-208" ], "VendorSeverity": { "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-54411", "https://cwe.mitre.org/data/definitions/208.html", "https://github.com/linux-pam/linux-pam", "https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h", "https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327", "https://nvd.nist.gov/vuln/detail/CVE-2026-54411", "https://ubuntu.com/security/notices/USN-8601-1", "https://www.cve.org/CVERecord?id=CVE-2026-54411" ], "PublishedDate": "2026-06-14T18:17:20.587Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2024-10041", "PkgID": "libpam-modules-bin@1.5.2-6+deb12u2", "PkgName": "libpam-modules-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpam-modules-bin@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "9719a4713ae6c4fa" }, "InstalledVersion": "1.5.2-6+deb12u2", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-10041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8062f0e33579cf9d3e7e8b1af854668821fe9671b28533171f97a70f3371fc1c", "Title": "pam: libpam: Libpam vulnerable to read hashed password", "Description": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.", "Severity": "MEDIUM", "CweIDs": [ "CWE-922" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "cbl-mariner": 2, "oracle-oval": 2, "redhat": 2, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:10379", "https://access.redhat.com/errata/RHSA-2024:11250", "https://access.redhat.com/errata/RHSA-2024:9941", "https://access.redhat.com/security/cve/CVE-2024-10041", "https://bugzilla.redhat.com/2319212", "https://bugzilla.redhat.com/show_bug.cgi?id=2319212", "https://bugzilla.redhat.com/show_bug.cgi?id=2324291", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10041", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10963", "https://errata.almalinux.org/9/ALSA-2024-11250.html", "https://errata.rockylinux.org/RLSA-2024:10379", "https://linux.oracle.com/cve/CVE-2024-10041.html", "https://linux.oracle.com/errata/ELSA-2024-11250.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-10041", "https://www.cve.org/CVERecord?id=CVE-2024-10041" ], "PublishedDate": "2024-10-23T14:15:03.97Z", "LastModifiedDate": "2026-06-30T00:16:47.39Z" }, { "VulnerabilityID": "CVE-2026-54411", "PkgID": "libpam-modules-bin@1.5.2-6+deb12u2", "PkgName": "libpam-modules-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpam-modules-bin@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "9719a4713ae6c4fa" }, "InstalledVersion": "1.5.2-6+deb12u2", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54411", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1cd409ba16b981122737befbb5e24e48d75e4fb60c41748426eab9b6a3c300ed", "Title": "linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module", "Description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "Severity": "MEDIUM", "CweIDs": [ "CWE-208" ], "VendorSeverity": { "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-54411", "https://cwe.mitre.org/data/definitions/208.html", "https://github.com/linux-pam/linux-pam", "https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h", "https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327", "https://nvd.nist.gov/vuln/detail/CVE-2026-54411", "https://ubuntu.com/security/notices/USN-8601-1", "https://www.cve.org/CVERecord?id=CVE-2026-54411" ], "PublishedDate": "2026-06-14T18:17:20.587Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2024-10041", "PkgID": "libpam-runtime@1.5.2-6+deb12u2", "PkgName": "libpam-runtime", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpam-runtime@1.5.2-6%2Bdeb12u2?arch=all\u0026distro=debian-12.15", "UID": "47e594e0f52955ae" }, "InstalledVersion": "1.5.2-6+deb12u2", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-10041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8bebe168b26861dba4693cbded7ea1e1ae34746a7cafeaea9eedf8e288824e66", "Title": "pam: libpam: Libpam vulnerable to read hashed password", "Description": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.", "Severity": "MEDIUM", "CweIDs": [ "CWE-922" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "cbl-mariner": 2, "oracle-oval": 2, "redhat": 2, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:10379", "https://access.redhat.com/errata/RHSA-2024:11250", "https://access.redhat.com/errata/RHSA-2024:9941", "https://access.redhat.com/security/cve/CVE-2024-10041", "https://bugzilla.redhat.com/2319212", "https://bugzilla.redhat.com/show_bug.cgi?id=2319212", "https://bugzilla.redhat.com/show_bug.cgi?id=2324291", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10041", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10963", "https://errata.almalinux.org/9/ALSA-2024-11250.html", "https://errata.rockylinux.org/RLSA-2024:10379", "https://linux.oracle.com/cve/CVE-2024-10041.html", "https://linux.oracle.com/errata/ELSA-2024-11250.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-10041", "https://www.cve.org/CVERecord?id=CVE-2024-10041" ], "PublishedDate": "2024-10-23T14:15:03.97Z", "LastModifiedDate": "2026-06-30T00:16:47.39Z" }, { "VulnerabilityID": "CVE-2026-54411", "PkgID": "libpam-runtime@1.5.2-6+deb12u2", "PkgName": "libpam-runtime", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpam-runtime@1.5.2-6%2Bdeb12u2?arch=all\u0026distro=debian-12.15", "UID": "47e594e0f52955ae" }, "InstalledVersion": "1.5.2-6+deb12u2", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54411", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0f57edc85a3a5b977a2103d494fc585f068f819ca388c81b37baf41bb64ecc25", "Title": "linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module", "Description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "Severity": "MEDIUM", "CweIDs": [ "CWE-208" ], "VendorSeverity": { "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-54411", "https://cwe.mitre.org/data/definitions/208.html", "https://github.com/linux-pam/linux-pam", "https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h", "https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327", "https://nvd.nist.gov/vuln/detail/CVE-2026-54411", "https://ubuntu.com/security/notices/USN-8601-1", "https://www.cve.org/CVERecord?id=CVE-2026-54411" ], "PublishedDate": "2026-06-14T18:17:20.587Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2024-10041", "PkgID": "libpam0g@1.5.2-6+deb12u2", "PkgName": "libpam0g", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpam0g@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "7ae56a42d59eaaac" }, "InstalledVersion": "1.5.2-6+deb12u2", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-10041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:28ef8e30925db3f7e1bfe9ff19e25c317d4e3cb127fa13cfb2f0ad6ce26937e5", "Title": "pam: libpam: Libpam vulnerable to read hashed password", "Description": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.", "Severity": "MEDIUM", "CweIDs": [ "CWE-922" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "cbl-mariner": 2, "oracle-oval": 2, "redhat": 2, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:10379", "https://access.redhat.com/errata/RHSA-2024:11250", "https://access.redhat.com/errata/RHSA-2024:9941", "https://access.redhat.com/security/cve/CVE-2024-10041", "https://bugzilla.redhat.com/2319212", "https://bugzilla.redhat.com/show_bug.cgi?id=2319212", "https://bugzilla.redhat.com/show_bug.cgi?id=2324291", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10041", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10963", "https://errata.almalinux.org/9/ALSA-2024-11250.html", "https://errata.rockylinux.org/RLSA-2024:10379", "https://linux.oracle.com/cve/CVE-2024-10041.html", "https://linux.oracle.com/errata/ELSA-2024-11250.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-10041", "https://www.cve.org/CVERecord?id=CVE-2024-10041" ], "PublishedDate": "2024-10-23T14:15:03.97Z", "LastModifiedDate": "2026-06-30T00:16:47.39Z" }, { "VulnerabilityID": "CVE-2026-54411", "PkgID": "libpam0g@1.5.2-6+deb12u2", "PkgName": "libpam0g", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpam0g@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "7ae56a42d59eaaac" }, "InstalledVersion": "1.5.2-6+deb12u2", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54411", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5c83990b29090df1b94bdde38db8485f390b3a9031afe028abd874ce2936e34e", "Title": "linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module", "Description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.", "Severity": "MEDIUM", "CweIDs": [ "CWE-208" ], "VendorSeverity": { "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-54411", "https://cwe.mitre.org/data/definitions/208.html", "https://github.com/linux-pam/linux-pam", "https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h", "https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327", "https://nvd.nist.gov/vuln/detail/CVE-2026-54411", "https://ubuntu.com/security/notices/USN-8601-1", "https://www.cve.org/CVERecord?id=CVE-2026-54411" ], "PublishedDate": "2026-06-14T18:17:20.587Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-13221", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:55fa49d231cdc56761b7ab54a8a9689d8df97b1d611d449b83b7b6f83c090a23", "Title": "Perl versions through 5.43.9 produce silently incorrect regular expres ...", "Description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "azure": 2, "nvd": 4 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-07-14T18:15:18.85Z" }, { "VulnerabilityID": "CVE-2026-42496", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ccb18aaf15a85ac78677a9d00434866ed31ce9a8167a651392f4053acdf3ab1f", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-57433", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3cca6f6d177ee10774133bb2fce2dba522d6ceb6fa5515fc20210c43031eebee", "Title": "Storable versions before 3.41 for Perl have a signed integer overflow ...", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "azure": 4 }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-07-14T17:47:20.473Z" }, { "VulnerabilityID": "CVE-2026-8376", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d78638a3c3345f52eed6f9de4cce9e19895f5a1a87c91c11d655539a87214df7", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-42497", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:97547b777c7d43f175bb39a8db55a60885547fc9c9cfb1d43ccf584f81cb874a", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0d757955db68fc74148461f30fcd7004dbd9702aad78ea1058e02adfc167e286", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57432", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:89e927aca696194ba5e5c27cef4b6c0962443fb627e53d4d9fdac8427b09e2ba", "Title": "Perl versions through 5.43.10 have an integer overflow in S_measure_st ...", "Description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "azure": 3, "nvd": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-07-14T18:04:48.367Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b9ee7dfdc70509d48407f3e7002d177d5cf62fa2dd8b1ad97999f10741980fa4", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2025-15649", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-15649", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fe9f940f2c9f5eb8b533ddc972b53a64e838c4ad980e693a6c76e1b84e2a94de", "Title": "perl-IO-Compress: perl-IO-Compress: Denial of Service via malformed DOS date in zip header", "Description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.\n\n_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.\n\nThe exception propagates out of IO::Uncompress::Unzip-\u003enew($file) where callers expect undef plus $UnzipError.", "Severity": "MEDIUM", "CweIDs": [ "CWE-248" ], "VendorSeverity": { "azure": 2, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/1", "https://access.redhat.com/security/cve/CVE-2025-15649", "https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch", "https://github.com/pmqs/IO-Compress/issues/65", "https://metacpan.org/release/PMQS/IO-Compress-2.215/changes", "https://nvd.nist.gov/vuln/detail/CVE-2025-15649", "https://www.cve.org/CVERecord?id=CVE-2025-15649" ], "PublishedDate": "2026-05-27T04:16:23.873Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-12087", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12087", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f78de6a65fd71577e9f669f224562b2554982020fd39362982e94969cbf8a311", "Title": "perl-Socket: perl-Socket: Information Disclosure due to Out-of-Bounds Read", "Description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "Severity": "MEDIUM", "CweIDs": [ "CWE-125", "CWE-805" ], "VendorSeverity": { "azure": 3, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/06/15/10", "https://access.redhat.com/security/cve/CVE-2026-12087", "https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch", "https://metacpan.org/release/PEVANS/Socket-2.041/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-12087", "https://www.cve.org/CVERecord?id=CVE-2026-12087" ], "PublishedDate": "2026-06-15T22:16:16.197Z", "LastModifiedDate": "2026-06-17T10:14:37.383Z" }, { "VulnerabilityID": "CVE-2026-48959", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48959", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dc48585d87d4ec419faaee89ab8fc3adb191b9d8817d0e241ab67014485fb953", "Title": "perl-IO-Compress: perl-IO-Compress: CPU exhaustion via per-byte read loop in fastForward", "Description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip-\u003enew($zip, Name =\u003e $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "Severity": "MEDIUM", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "amazon": 3, "azure": 3, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/2", "https://access.redhat.com/security/cve/CVE-2026-48959", "https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48959", "https://www.cve.org/CVERecord?id=CVE-2026-48959" ], "PublishedDate": "2026-05-27T04:16:31.093Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-48961", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48961", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1f0f79749c679b9bfebbf3aaf86ea0d6af782f9e1fec77f7abcb5e4f646b47a4", "Title": "perl-IO-Compress: IO::Compress: Denial of Service in zipdetails CLI tool via malformed Info-ZIP Unix Extra Field", "Description": "IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.", "Severity": "MEDIUM", "CweIDs": [ "CWE-755" ], "VendorSeverity": { "amazon": 3, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/3", "https://access.redhat.com/security/cve/CVE-2026-48961", "https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48961", "https://www.cve.org/CVERecord?id=CVE-2026-48961" ], "PublishedDate": "2026-05-27T04:16:31.21Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-7010", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-7010", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8af95601aa52cbdda7f62a9693a2615fc82590053fd4eb8692d68e8b15a09ce5", "Title": "HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP ...", "Description": "HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.\n\nThe unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values.\n\nAn attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.", "Severity": "MEDIUM", "CweIDs": [ "CWE-113" ], "VendorSeverity": { "amazon": 2 }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/11/17", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/d73c7651e82ace02693842df55928b6c3ae7c38d.patch", "https://metacpan.org/release/HAARG/HTTP-Tiny-0.093-TRIAL/changes" ], "PublishedDate": "2026-05-11T22:22:14.75Z", "LastModifiedDate": "2026-06-17T11:01:37.993Z" }, { "VulnerabilityID": "CVE-2011-4116", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-4116", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:17ca36e2428ffb1197404f662fd50ff75d8cfef2dbf21977980d46b5943f78d5", "Title": "perl: File:: Temp insecure temporary file handling", "Description": "_is_safe in the File::Temp module for Perl does not properly handle symlinks.", "Severity": "LOW", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "debian": 1, "nvd": 1, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:M/Au:S/C:N/I:P/A:N", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "V2Score": 1.5, "V3Score": 3.3 }, "redhat": { "V2Vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "V2Score": 1.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2011/11/04/2", "http://www.openwall.com/lists/oss-security/2011/11/04/4", "https://access.redhat.com/security/cve/CVE-2011-4116", "https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14", "https://nvd.nist.gov/vuln/detail/CVE-2011-4116", "https://rt.cpan.org/Public/Bug/Display.html?id=69106", "https://seclists.org/oss-sec/2011/q4/238", "https://www.cve.org/CVERecord?id=CVE-2011-4116" ], "PublishedDate": "2020-01-31T18:15:11.343Z", "LastModifiedDate": "2025-08-04T19:04:38.29Z" }, { "VulnerabilityID": "CVE-2023-31486", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31486", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2bc953eb1485eb3ca0429728b8e268c15a47b5e085626cd4a03fecc2aa9fbbf9", "Title": "http-tiny: perl: insecure TLS cert default", "Description": "HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.", "Severity": "LOW", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 2, "amazon": 3, "cbl-mariner": 3, "debian": 1, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2023/04/29/1", "http://www.openwall.com/lists/oss-security/2023/05/03/3", "http://www.openwall.com/lists/oss-security/2023/05/03/5", "http://www.openwall.com/lists/oss-security/2023/05/07/2", "https://access.redhat.com/errata/RHSA-2023:6542", "https://access.redhat.com/security/cve/CVE-2023-31486", "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/", "https://bugzilla.redhat.com/2228392", "https://errata.almalinux.org/9/ALSA-2023-6542.html", "https://github.com/chansen/p5-http-tiny/pull/153", "https://hackeriet.github.io/cpan-http-tiny-overview/", "https://linux.oracle.com/cve/CVE-2023-31486.html", "https://linux.oracle.com/errata/ELSA-2023-7174.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-31486", "https://security.netapp.com/advisory/ntap-20241129-0011/", "https://www.cve.org/CVERecord?id=CVE-2023-31486", "https://www.openwall.com/lists/oss-security/2023/04/18/14", "https://www.openwall.com/lists/oss-security/2023/05/03/4", "https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/" ], "PublishedDate": "2023-04-29T00:15:09.083Z", "LastModifiedDate": "2026-06-17T05:57:05.473Z" }, { "VulnerabilityID": "CVE-2026-7017", "PkgID": "libperl5.36@5.36.0-7+deb12u3", "PkgName": "libperl5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/libperl5.36@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "2add15a0fd2144b5" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-7017", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b18dbb7064c096ff764a83c3c150ddf18ecb232d1eb182404b16870630460c52", "Title": "HTTP::Tiny versions before 0.095 for Perl forward credential headers t ...", "Description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-522" ], "References": [ "http://www.openwall.com/lists/oss-security/2026/07/07/13", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36", "https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes" ], "PublishedDate": "2026-07-07T19:16:55.53Z", "LastModifiedDate": "2026-07-08T15:56:29.29Z" }, { "VulnerabilityID": "CVE-2023-37769", "PkgID": "libpixman-1-0@0.42.2-1", "PkgName": "libpixman-1-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpixman-1-0@0.42.2-1?arch=amd64\u0026distro=debian-12.15", "UID": "efb046322ba383c6" }, "InstalledVersion": "0.42.2-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-37769", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:315dedf57dcacf2959816a30fbb0429db165fc8f3701fd923ee8e296bcdd61c0", "Title": "stress-test master commit e4c878 was discovered to contain a FPE vulne ...", "Description": "stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c.", "Severity": "LOW", "CweIDs": [ "CWE-369" ], "VendorSeverity": { "debian": 1, "nvd": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://gitlab.freedesktop.org/pixman/pixman/-/issues/76", "https://www.cve.org/CVERecord?id=CVE-2023-37769" ], "PublishedDate": "2023-07-17T20:15:13.547Z", "LastModifiedDate": "2026-06-17T06:08:42.34Z" }, { "VulnerabilityID": "CVE-2021-4214", "PkgID": "libpng16-16@1.6.39-2+deb12u5", "PkgName": "libpng16-16", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpng16-16@1.6.39-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "87aec9de7c5b5777" }, "InstalledVersion": "1.6.39-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-4214", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7be03d1476b21c3456e6e401e2e42a77fc9692b0dcbe3f96211f74680c4085b2", "Title": "libpng: hardcoded value leads to heap-overflow", "Description": "A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.", "Severity": "LOW", "CweIDs": [ "CWE-120", "CWE-787" ], "VendorSeverity": { "debian": 1, "nvd": 2, "photon": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2021-4214", "https://bugzilla.redhat.com/show_bug.cgi?id=2043393", "https://github.com/glennrp/libpng/issues/302", "https://nvd.nist.gov/vuln/detail/CVE-2021-4214", "https://security-tracker.debian.org/tracker/CVE-2021-4214", "https://security.netapp.com/advisory/ntap-20221020-0001/", "https://www.cve.org/CVERecord?id=CVE-2021-4214" ], "PublishedDate": "2022-08-24T16:15:10.037Z", "LastModifiedDate": "2026-06-17T04:19:14.017Z" }, { "VulnerabilityID": "CVE-2025-28162", "PkgID": "libpng16-16@1.6.39-2+deb12u5", "PkgName": "libpng16-16", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpng16-16@1.6.39-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "87aec9de7c5b5777" }, "InstalledVersion": "1.6.39-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-28162", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fed3861461ae812e6cb182b28c0fe9da983f33efd2776971c1df8f2d63104d07", "Title": "libpng: libpng: Denial of Service via buffer overflow in pngimage utility", "Description": "Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive", "Severity": "LOW", "CweIDs": [ "CWE-120" ], "VendorSeverity": { "amazon": 2, "debian": 1, "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-28162", "https://gist.github.com/kittener/fbfdb9b5610c6b3db0d5dea045a07c60", "https://github.com/pnggroup/libpng/issues/656", "https://github.com/pnggroup/libpng/pull/657", "https://nvd.nist.gov/vuln/detail/CVE-2025-28162", "https://ubuntu.com/security/notices/USN-7993-1", "https://www.cve.org/CVERecord?id=CVE-2025-28162" ], "PublishedDate": "2026-01-27T16:16:14.63Z", "LastModifiedDate": "2026-06-17T09:04:37.03Z" }, { "VulnerabilityID": "CVE-2025-28164", "PkgID": "libpng16-16@1.6.39-2+deb12u5", "PkgName": "libpng16-16", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpng16-16@1.6.39-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "87aec9de7c5b5777" }, "InstalledVersion": "1.6.39-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-28164", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d297d20b67c5cce7faafecd3b93270ec42b9a63b7ba40596d04398c567ea76d6", "Title": "libpng: libpng: Denial of Service via buffer overflow in png_create_read_struct() function", "Description": "Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.", "Severity": "LOW", "CweIDs": [ "CWE-401", "CWE-120" ], "VendorSeverity": { "amazon": 2, "debian": 1, "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-28164", "https://gist.github.com/kittener/506516f8c22178005b4379c8b2a7de20", "https://github.com/pnggroup/libpng/issues/655", "https://github.com/pnggroup/libpng/pull/657", "https://nvd.nist.gov/vuln/detail/CVE-2025-28164", "https://ubuntu.com/security/notices/USN-7993-1", "https://www.cve.org/CVERecord?id=CVE-2025-28164" ], "PublishedDate": "2026-01-27T16:16:14.76Z", "LastModifiedDate": "2026-06-17T09:04:37.19Z" }, { "VulnerabilityID": "CVE-2026-3713", "PkgID": "libpng16-16@1.6.39-2+deb12u5", "PkgName": "libpng16-16", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpng16-16@1.6.39-2%2Bdeb12u5?arch=amd64\u0026distro=debian-12.15", "UID": "87aec9de7c5b5777" }, "InstalledVersion": "1.6.39-2+deb12u5", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-3713", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1b8c409ea10afca526c06728a12be8e7a89c5fdd6c4616425f6d51b1d4db5f77", "Title": "libpng: libpng: Heap-based buffer overflow in pnm2png allows information disclosure and denial of service", "Description": "A flaw has been found in pnggroup libpng up to 1.6.55. Affected by this vulnerability is the function do_pnm2png of the file contrib/pngminus/pnm2png.c of the component pnm2png. This manipulation of the argument width/height causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.", "Severity": "LOW", "CweIDs": [ "CWE-119", "CWE-122" ], "VendorSeverity": { "debian": 1, "photon": 2, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-3713", "https://github.com/biniamf/pocs/tree/main/pnm2png", "https://github.com/pnggroup/libpng/", "https://github.com/pnggroup/libpng/issues/794", "https://nvd.nist.gov/vuln/detail/CVE-2026-3713", "https://vuldb.com/?ctiid.349658", "https://vuldb.com/?id.349658", "https://vuldb.com/?submit.761996", "https://www.cve.org/CVERecord?id=CVE-2026-3713" ], "PublishedDate": "2026-03-08T06:16:11.46Z", "LastModifiedDate": "2026-06-17T10:44:03.563Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a834330535a542ee32a4c392c1dbc28fe354b5e618536bb253c992a534a43a7f", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-07-23T12:18:30.933Z" }, { "VulnerabilityID": "CVE-2026-64831", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64831", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d8f86e7abf385d1c26f241751b9ba5528aa868e6c899d3a4bde806b07baea68e", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted HEVC/H.265 bitstream", "Description": "FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64831", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665", "https://nvd.nist.gov/vuln/detail/CVE-2026-64831", "https://www.cve.org/CVERecord?id=CVE-2026-64831", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder" ], "PublishedDate": "2026-07-22T17:16:58.697Z", "LastModifiedDate": "2026-07-23T14:17:40.63Z" }, { "VulnerabilityID": "CVE-2026-8461", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a974ee85541e848db2e1473e45bfe3c79950ab39d02382300019d8f5f8140d91", "Title": "ffmpeg: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder", "Description": "An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-8461", "https://bugzilla.redhat.com/show_bug.cgi?id=2490308", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159", "https://github.com/advisories/GHSA-qff7-4q6c-m8h6", "https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/", "https://nvd.nist.gov/vuln/detail/CVE-2026-8461", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json", "https://www.cve.org/CVERecord?id=CVE-2026-8461" ], "PublishedDate": "2026-06-18T14:17:36.66Z", "LastModifiedDate": "2026-07-23T12:18:51.763Z" }, { "VulnerabilityID": "CVE-2023-49528", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-49528", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d50d256473a96a4ae6b1c51bc99db0aa289a9c136d62db3966183e45702a1573", "Title": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, al ...", "Description": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component.", "Severity": "MEDIUM", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "ubuntu": 2 }, "References": [ "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://trac.ffmpeg.org/ticket/10691", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2023-49528" ], "PublishedDate": "2024-04-12T06:15:06.32Z", "LastModifiedDate": "2026-06-17T06:36:05.573Z" }, { "VulnerabilityID": "CVE-2023-6601", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6601", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7bbf8e74cb7145f1c484d070d58d817d02e5d122af3b23b978d2f9844b91544d", "Title": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows by ...", "Description": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-99", "CWE-94" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://bugzilla.redhat.com/show_bug.cgi?id=2253172", "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html", "https://www.cve.org/CVERecord?id=CVE-2023-6601" ], "PublishedDate": "2025-01-06T17:15:14.217Z", "LastModifiedDate": "2026-06-17T06:51:04.107Z" }, { "VulnerabilityID": "CVE-2024-31578", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-31578", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:393327492b9bf1d763b698ddcae07a53d69435c9a48a537ed9de81a846634e5b", "Title": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free ...", "Description": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "julia": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179", "https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7", "https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2024-31578" ], "PublishedDate": "2024-04-17T14:15:08.563Z", "LastModifiedDate": "2026-06-17T07:28:36.03Z" }, { "VulnerabilityID": "CVE-2024-35369", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-35369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d6a65e6aca7c618c87aa8ff4c9af5a35d8a918da0af0cfd2bff1aaee1963f33d", "Title": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c m ...", "Description": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8", "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423", "https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c" ], "PublishedDate": "2024-11-29T17:15:07.707Z", "LastModifiedDate": "2026-06-17T07:34:49.86Z" }, { "VulnerabilityID": "CVE-2025-10256", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-10256", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e65f05633ea386edf43604d33794620427b7a7837e9e96b0cc841d523e75de5c", "Title": "ffmpeg: NULL pointer dereference in Firequalizer filter (libavfilter/af_firequalizer.c)", "Description": "A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-10256", "https://bugzilla.redhat.com/show_bug.cgi?id=2394495", "https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931", "https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a", "https://nvd.nist.gov/vuln/detail/CVE-2025-10256", "https://ubuntu.com/security/notices/USN-7830-1", "https://www.cve.org/CVERecord?id=CVE-2025-10256" ], "PublishedDate": "2026-02-18T21:16:20.183Z", "LastModifiedDate": "2026-06-17T08:28:00.503Z" }, { "VulnerabilityID": "CVE-2025-22921", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:97838b7507f898915e59506da2efcfe91630c0b60ff9f51b41081e57ba3b5400", "Title": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a seg ...", "Description": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html", "https://trac.ffmpeg.org/ticket/11393", "https://ubuntu.com/security/notices/USN-7538-1", "https://www.cve.org/CVERecord?id=CVE-2025-22921" ], "PublishedDate": "2025-02-18T22:15:18.04Z", "LastModifiedDate": "2026-06-17T08:50:59.503Z" }, { "VulnerabilityID": "CVE-2026-6385", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6385", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9ba49f28b0bcabf8d00e475ed5c67dbc508a7a66f4ea3f3111f69276e2bfa75d", "Title": "ffmpeg: FFmpeg: Denial of Service and potential arbitrary code execution via signed integer overflow in DVD subtitle parser", "Description": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-6385", "https://bugzilla.redhat.com/show_bug.cgi?id=2458764", "https://nvd.nist.gov/vuln/detail/CVE-2026-6385", "https://www.cve.org/CVERecord?id=CVE-2026-6385" ], "PublishedDate": "2026-04-15T20:16:44.23Z", "LastModifiedDate": "2026-06-17T11:00:45.583Z" }, { "VulnerabilityID": "CVE-2026-65703", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65703", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3efe2ef1aba8350dba1446e539ec6d32c4fbba75f588f8f7bb841dee0cafd0e4", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via crafted AVI file in TDSC video decoder", "Description": "FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65703", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773", "https://nvd.nist.gov/vuln/detail/CVE-2026-65703", "https://www.cve.org/CVERecord?id=CVE-2026-65703", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder" ], "PublishedDate": "2026-07-23T20:17:21.803Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65704", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65704", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8ce3dd1ce9af0d7941391a95a90690c2ba51d7954a4ac727208ac55d260f3f13", "Title": "ffmpeg: FFmpeg: Heap corruption via crafted ffconcat file can lead to arbitrary code execution", "Description": "FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.", "Severity": "MEDIUM", "CweIDs": [ "CWE-191", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65704", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767", "https://nvd.nist.gov/vuln/detail/CVE-2026-65704", "https://www.cve.org/CVERecord?id=CVE-2026-65704", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder" ], "PublishedDate": "2026-07-23T20:17:21.973Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65705", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65705", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c2cd2961f25ea4a4de4f0e58def766754795b9f0f6646ef310add2062e6c8885", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via out-of-bounds write in vf_floodfill video filter", "Description": "FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65705", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780", "https://nvd.nist.gov/vuln/detail/CVE-2026-65705", "https://www.cve.org/CVERecord?id=CVE-2026-65705", "https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame" ], "PublishedDate": "2026-07-23T20:17:22.12Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65706", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65706", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d824c25d8adf2f35ad53e56c70d4897a4bb20ed8ca79be3df93685476bcc9c8e", "Title": "FFmpeg: FFmpeg: Arbitrary Code Execution via Crafted Video Frame", "Description": "FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65706", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779", "https://nvd.nist.gov/vuln/detail/CVE-2026-65706", "https://www.cve.org/CVERecord?id=CVE-2026-65706", "https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing" ], "PublishedDate": "2026-07-23T20:17:22.257Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-30999", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-30999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aec8266a99ba6c405b5c0bda5b2589ba42c5905551585a44fb8ccb2bd41f69d5", "Title": "FFmpeg: FFmpeg: Denial of Service via heap buffer overflow in av_bprint_finalize()", "Description": "A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.", "Severity": "LOW", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "debian": 1, "julia": 3, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-30999", "https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6", "https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html", "https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c", "https://nvd.nist.gov/vuln/detail/CVE-2026-30999", "https://www.cve.org/CVERecord?id=CVE-2026-30999", "https://www.ffmpeg.org/download.html" ], "PublishedDate": "2026-04-13T15:17:32.827Z", "LastModifiedDate": "2026-06-17T10:33:17.66Z" }, { "VulnerabilityID": "CVE-2024-36615", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-36615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ba69323e976aabd13076581784ac3916bb3d019b2af1c818d0e3a42620f49b27", "Title": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Thi ...", "Description": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-362" ], "References": [ "https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb", "https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738", "https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61" ], "PublishedDate": "2024-11-29T19:15:07.703Z", "LastModifiedDate": "2026-06-17T07:37:01.797Z" }, { "VulnerabilityID": "CVE-2026-13858", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13858", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cb4cc668b825a12bc7fe526aa1b591df14ddae112a5496ad9737c7104f791eca", "Title": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 a ...", "Description": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html", "https://issues.chromium.org/issues/507090179" ], "PublishedDate": "2026-06-30T23:17:00.22Z", "LastModifiedDate": "2026-07-01T15:36:19.657Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:badbb27e5654115dca2d6a1314bdd3992c93443cf8a054af3c61cd05039c6056", "Title": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vuln ...", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:90291ceb4603981b34d1a3f30399ede53529585d5ad9908496129cbf28e53115", "Title": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-415" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:88e983c5bff3de3221d934db69250396ba691a59548395be831c0751bd5bef4c", "Title": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vuln ...", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6821aa7ed0300f9dedb3c093776eb22ad9697522884f40db92d90a045aef9402", "Title": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerabi ...", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-835" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-07-23T16:17:49.397Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0dd4220e1856b3d0937a60203608ac46321a1e9b26468410de5e43ec69b2a6e3", "Title": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory acce ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-07-23T14:17:41.17Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2c93ff8b4221dcb24df2534bcc11d1548fe863767194c88b895044708ed6f9ae", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66037", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66037", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c339ddf48de36642742fae5efca70a09e96713c902c631b8aea24e0e57aa9e11", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolle ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-770" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627", "https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu" ], "PublishedDate": "2026-07-24T20:18:20.573Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66038", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66038", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d89a0b93cbb00df74a0cd281986655856e84980a4753d03565ad071e75e6e685", "Title": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information ...", "Description": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-908" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626", "https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c" ], "PublishedDate": "2026-07-24T20:18:20.727Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dc6294ce345a4901eae05245aeca3273db9422c5ed5adefa7d5c64d3d8e99e78", "Title": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integ ...", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122", "CWE-190" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3af5eada6c92e0b10033bf772e77e0e50e02abb90ba6a79d92f888ebd1cf350e", "Title": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libpostproc56@7:5.1.9-0+deb12u1", "PkgName": "libpostproc56", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpostproc56@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "d6d5852a01011fb0" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:910fc5251124419393b77527cc90f68e35161a60f436429282fb4d8f07723560", "Title": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out ...", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-14330", "PkgID": "libpulse0@16.1+dfsg1-2+b1", "PkgName": "libpulse0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libpulse0@16.1%2Bdfsg1-2%2Bb1?arch=amd64\u0026distro=debian-12.15", "UID": "acd90f9c92f1f814" }, "InstalledVersion": "16.1+dfsg1-2+b1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14330", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1cfd9be6dbef87899792a40af7c43ef678e6417966fffab91e90359839c6abfa", "Title": "pipewire: Pulse Server alloca Stack Overflow", "Description": "Multiple unbounded alloca() calls in the PulseAudio protocol server.", "Severity": "MEDIUM", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "redhat": 2, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-14330", "https://bugzilla.redhat.com/show_bug.cgi?id=2495907", "https://nvd.nist.gov/vuln/detail/CVE-2026-14330", "https://ubuntu.com/security/notices/USN-8535-1", "https://www.cve.org/CVERecord?id=CVE-2026-14330" ], "PublishedDate": "2026-07-01T15:17:06.663Z", "LastModifiedDate": "2026-07-01T18:31:17.08Z" }, { "VulnerabilityID": "CVE-2022-27943", "PkgID": "libquadmath0@12.2.0-14+deb12u1", "PkgName": "libquadmath0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libquadmath0@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "f97128e3ede84a54" }, "InstalledVersion": "12.2.0-14+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-27943", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ddab5e675059010d81377b5637a379aa5eb7045e1b22704b9418db2db1bb7658", "Title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "Description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", "Severity": "LOW", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "amazon": 1, "debian": 1, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2022-27943", "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead", "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/", "https://nvd.nist.gov/vuln/detail/CVE-2022-27943", "https://sourceware.org/bugzilla/show_bug.cgi?id=28995", "https://www.cve.org/CVERecord?id=CVE-2022-27943" ], "PublishedDate": "2022-03-26T13:15:07.9Z", "LastModifiedDate": "2026-06-17T04:37:46.95Z" }, { "VulnerabilityID": "CVE-2023-45927", "PkgID": "libslang2@2.3.3-3", "PkgName": "libslang2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libslang2@2.3.3-3?arch=amd64\u0026distro=debian-12.15", "UID": "ca72fa4542f28bda" }, "InstalledVersion": "2.3.3-3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45927", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1f4e019c1764be87bbd193d61f4e513a91a872c6882c2b04026dafd565f2e2b6", "Title": "S-Lang 2.3.2 was discovered to contain an arithmetic exception via the ...", "Description": "S-Lang 2.3.2 was discovered to contain an arithmetic exception via the function tt_sprintf().", "Severity": "LOW", "CweIDs": [ "CWE-703" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://lists.jedsoft.org/lists/slang-users/2023/0000003.html", "http://seclists.org/fulldisclosure/2024/Jan/55", "https://seclists.org/fulldisclosure/2024/Jan/55" ], "PublishedDate": "2024-03-27T04:15:10.847Z", "LastModifiedDate": "2026-06-17T06:29:48.293Z" }, { "VulnerabilityID": "CVE-2023-45929", "PkgID": "libslang2@2.3.3-3", "PkgName": "libslang2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libslang2@2.3.3-3?arch=amd64\u0026distro=debian-12.15", "UID": "ca72fa4542f28bda" }, "InstalledVersion": "2.3.3-3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45929", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e50eb1b6af07ca60f1c65f7db62239039326fd03a116cab779421039bd6eaccb", "Title": "S-Lang 2.3.2 was discovered to contain a segmentation fault via the fu ...", "Description": "S-Lang 2.3.2 was discovered to contain a segmentation fault via the function fixup_tgetstr().", "Severity": "LOW", "CweIDs": [ "CWE-120" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://lists.jedsoft.org/lists/slang-users/2023/0000002.html", "http://seclists.org/fulldisclosure/2024/Jan/57" ], "PublishedDate": "2024-03-27T04:15:11.067Z", "LastModifiedDate": "2026-06-17T06:29:48.503Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libsmartcols1@2.38.1-5+deb12u3", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "5724e02241dee022" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e6978305387d307d618ac7d77a3582b21503c848adea0bc6c1ead1c0c5d30d1c", "Title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "Description": "Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:\nCVE-2026-53615:\n\tInteger Overflow or Wraparound in libblkid/src/partitions/dos.c\n", "Severity": "HIGH", "VendorSeverity": { "amazon": 3 } }, { "VulnerabilityID": "CVE-2026-13595", "PkgID": "libsmartcols1@2.38.1-5+deb12u3", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "5724e02241dee022" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13595", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6e239fcdbf0ba71bb2d03c896c2e1ce031322d38161f726caed974834eb1bf26", "Title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "Description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26573", "https://access.redhat.com/security/cve/CVE-2026-13595", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c", "https://nvd.nist.gov/vuln/detail/CVE-2026-13595", "https://www.cve.org/CVERecord?id=CVE-2026-13595" ], "PublishedDate": "2026-06-29T09:16:28.303Z", "LastModifiedDate": "2026-07-08T03:37:21.637Z" }, { "VulnerabilityID": "CVE-2026-27456", "PkgID": "libsmartcols1@2.38.1-5+deb12u3", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "5724e02241dee022" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2f1cdfd1b6de737e3f3d5e33e6d6a40b51170cbff90074fc207dfa8444bab1f8", "Title": "util-linux: TOCTOU in the mount program when setting up loop devices", "Description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "Severity": "MEDIUM", "CweIDs": [ "CWE-59", "CWE-269", "CWE-367" ], "VendorSeverity": { "azure": 2, "bottlerocket": 2, "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://access.redhat.com/security/cve/CVE-2026-27456", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-jgcxwcxt3sxd.toml", "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g", "https://nvd.nist.gov/vuln/detail/CVE-2026-27456", "https://www.cve.org/CVERecord?id=CVE-2026-27456" ], "PublishedDate": "2026-04-03T22:16:25.4Z", "LastModifiedDate": "2026-07-24T22:10:00.14Z" }, { "VulnerabilityID": "CVE-2026-3184", "PkgID": "libsmartcols1@2.38.1-5+deb12u3", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "5724e02241dee022" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-3184", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3fe9c8e340413dc7c67f441834a3d3006c07fc83dc62a3e3d02d7eed4a120feb", "Title": "util-linux: util-linux: Access control bypass due to improper hostname canonicalization", "Description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "Severity": "MEDIUM", "CweIDs": [ "CWE-289" ], "VendorSeverity": { "azure": 1, "nvd": 2, "photon": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2026-3184", "https://bugzilla.redhat.com/show_bug.cgi?id=2442570", "https://nvd.nist.gov/vuln/detail/CVE-2026-3184", "https://www.cve.org/CVERecord?id=CVE-2026-3184" ], "PublishedDate": "2026-04-03T19:17:23.377Z", "LastModifiedDate": "2026-07-21T19:10:00.107Z" }, { "VulnerabilityID": "CVE-2022-0563", "PkgID": "libsmartcols1@2.38.1-5+deb12u3", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "5724e02241dee022" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:831163e082499848ec312da9c5259e8cd23a279355ff1be5c6d5e5ee3aa994b6", "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", "Severity": "LOW", "CweIDs": [ "CWE-209" ], "VendorSeverity": { "amazon": 2, "bottlerocket": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 }, "nvd": { "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V2Score": 1.9, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0563", "https://access.redhat.com/security/cve/CVE-2022-0563", "https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-mv4q-wq4c-5xmg", "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", "https://security.gentoo.org/glsa/202401-08", "https://security.netapp.com/advisory/ntap-20220331-0002/", "https://www.cve.org/CVERecord?id=CVE-2022-0563" ], "PublishedDate": "2022-02-21T19:15:08.393Z", "LastModifiedDate": "2026-06-17T04:20:51.053Z" }, { "VulnerabilityID": "CVE-2025-14104", "PkgID": "libsmartcols1@2.38.1-5+deb12u3", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "5724e02241dee022" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-14104", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:18b7848fddc61420c4d44188f7da15fa981a148df733184b3df1d7f8e7ea8767", "Title": "util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames", "Description": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1696", "https://access.redhat.com/errata/RHSA-2026:1852", "https://access.redhat.com/errata/RHSA-2026:1913", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2737", "https://access.redhat.com/errata/RHSA-2026:2800", "https://access.redhat.com/errata/RHSA-2026:3406", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2025-14104", "https://bugzilla.redhat.com/2419369", "https://bugzilla.redhat.com/show_bug.cgi?id=2419369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14104", "https://errata.almalinux.org/9/ALSA-2026-1913.html", "https://errata.rockylinux.org/RLSA-2026:1913", "https://linux.oracle.com/cve/CVE-2025-14104.html", "https://linux.oracle.com/errata/ELSA-2026-1913.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-14104", "https://www.cve.org/CVERecord?id=CVE-2025-14104" ], "PublishedDate": "2025-12-05T17:16:03.117Z", "LastModifiedDate": "2026-06-30T00:16:53.04Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "libsmartcols1@2.38.1-5+deb12u3", "PkgName": "libsmartcols1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "5724e02241dee022" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:677ac852efb844e23b8dfbdc7386fd86e66276ca658b224853bf0b9c8583861c", "Title": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-37555", "PkgID": "libsndfile1@1.2.0-1+deb12u1", "PkgName": "libsndfile1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsndfile1@1.2.0-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "bb37a3f1a33c240e" }, "InstalledVersion": "1.2.0-1+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-37555", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:86a9df6b245e459d57cde399ccc3f0fd399d204e46647b2ce7d63e0154b3f8eb", "Title": "libsndfile: integer overflow in ima_reader_init()", "Description": "An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:19559", "https://access.redhat.com/errata/RHSA-2026:19560", "https://access.redhat.com/errata/RHSA-2026:19610", "https://access.redhat.com/errata/RHSA-2026:23221", "https://access.redhat.com/errata/RHSA-2026:23222", "https://access.redhat.com/errata/RHSA-2026:23223", "https://access.redhat.com/errata/RHSA-2026:25092", "https://access.redhat.com/errata/RHSA-2026:25197", "https://access.redhat.com/errata/RHSA-2026:25198", "https://access.redhat.com/errata/RHSA-2026:25227", "https://access.redhat.com/errata/RHSA-2026:30078", "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/security/cve/CVE-2026-37555", "https://bugzilla.redhat.com/2463856", "https://bugzilla.redhat.com/show_bug.cgi?id=2463856", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-37555", "https://errata.almalinux.org/9/ALSA-2026-19610.html", "https://errata.rockylinux.org/RLSA-2026:19610", "https://gist.github.com/sgInnora/a5f5c19e4bf6f4fb74fab7b0ef2bfcc1", "https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151", "https://github.com/libsndfile/libsndfile/issues/833", "https://linux.oracle.com/cve/CVE-2026-37555.html", "https://linux.oracle.com/errata/ELSA-2026-19610.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-37555", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-37555.json", "https://www.cve.org/CVERecord?id=CVE-2026-37555", "https://www.openwall.com/lists/oss-security/2026/04/30/7" ], "PublishedDate": "2026-04-29T16:16:23.41Z", "LastModifiedDate": "2026-07-15T02:20:44.847Z" }, { "VulnerabilityID": "CVE-2024-50613", "PkgID": "libsndfile1@1.2.0-1+deb12u1", "PkgName": "libsndfile1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsndfile1@1.2.0-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "bb37a3f1a33c240e" }, "InstalledVersion": "1.2.0-1+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-50613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3d3e9c9086c2c5ae0c660a8b6aa15ba7315af76ec6a8267febe102decbfbe22d", "Title": "libsndfile: Reachable assertion in mpeg_l3_encoder_close", "Description": "libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.", "Severity": "MEDIUM", "CweIDs": [ "CWE-617" ], "VendorSeverity": { "nvd": 2, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-50613", "https://github.com/libsndfile/libsndfile/issues/1034", "https://nvd.nist.gov/vuln/detail/CVE-2024-50613", "https://www.cve.org/CVERecord?id=CVE-2024-50613" ], "PublishedDate": "2024-10-27T22:15:03.66Z", "LastModifiedDate": "2026-06-17T08:04:48.483Z" }, { "VulnerabilityID": "CVE-2025-56226", "PkgID": "libsndfile1@1.2.0-1+deb12u1", "PkgName": "libsndfile1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsndfile1@1.2.0-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "bb37a3f1a33c240e" }, "InstalledVersion": "1.2.0-1+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-56226", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:15c006d7a3869d936e30a9a97a3ed5de06fc47548905e0f0e6dd5d6c6b3677a5", "Title": "libsndfile: memory leak when encoding MP3 files due to an incomplete initialization", "Description": "Libsndfile \u003c=1.2.2 contains a memory leak vulnerability in the mpeg_l3_encoder_init() function within the mpeg_l3_encode.c file.", "Severity": "MEDIUM", "CweIDs": [ "CWE-401" ], "VendorSeverity": { "azure": 2, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-56226", "https://gist.github.com/Sisyphus-wang/f9e6e017b7d478bebee6e8187672abc8", "https://github.com/libsndfile/libsndfile/issues/1089", "https://nvd.nist.gov/vuln/detail/CVE-2025-56226", "https://www.cve.org/CVERecord?id=CVE-2025-56226" ], "PublishedDate": "2026-01-14T15:15:56.873Z", "LastModifiedDate": "2026-06-17T09:42:27.263Z" }, { "VulnerabilityID": "CVE-2026-55868", "PkgID": "libsrt1.5-gnutls@1.5.1-1+deb12u1", "PkgName": "libsrt1.5-gnutls", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsrt1.5-gnutls@1.5.1-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "b5cb6c92aaa5f2ac" }, "InstalledVersion": "1.5.1-1+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55868", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3389246404e357543cbad80063036c4bc5e32fcd08751f538e860fb04da677ad", "Title": "[Encryption State Machine Downgrade]", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-55869", "PkgID": "libsrt1.5-gnutls@1.5.1-1+deb12u1", "PkgName": "libsrt1.5-gnutls", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsrt1.5-gnutls@1.5.1-1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "b5cb6c92aaa5f2ac" }, "InstalledVersion": "1.5.1-1+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55869", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ceeb0a72553c9bac3d5f73d021eb767cce48eafef1a3753e4baf679f35904d16", "Title": "[Heap-Based Buffer Overflow in KMREQ Handling]", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-0966", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-0966", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1f65e1b9ed795b74a138d5b3d5686ece55d089b8d44424c5f02d5d38d5e7d55f", "Title": "libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa()", "Description": "A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.", "Severity": "HIGH", "CweIDs": [ "CWE-124" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:18160", "https://access.redhat.com/errata/RHSA-2026:18683", "https://access.redhat.com/errata/RHSA-2026:7067", "https://access.redhat.com/security/cve/CVE-2026-0966", "https://bugzilla.redhat.com/2369367", "https://bugzilla.redhat.com/2376184", "https://bugzilla.redhat.com/2376193", "https://bugzilla.redhat.com/2383220", "https://bugzilla.redhat.com/2383888", "https://bugzilla.redhat.com/2433121", "https://bugzilla.redhat.com/2436979", "https://bugzilla.redhat.com/2436980", "https://bugzilla.redhat.com/2436981", "https://bugzilla.redhat.com/2436982", "https://bugzilla.redhat.com/show_bug.cgi?id=2369367", "https://bugzilla.redhat.com/show_bug.cgi?id=2376184", "https://bugzilla.redhat.com/show_bug.cgi?id=2376193", "https://bugzilla.redhat.com/show_bug.cgi?id=2383220", "https://bugzilla.redhat.com/show_bug.cgi?id=2383888", "https://bugzilla.redhat.com/show_bug.cgi?id=2433121", "https://bugzilla.redhat.com/show_bug.cgi?id=2436979", "https://bugzilla.redhat.com/show_bug.cgi?id=2436980", "https://bugzilla.redhat.com/show_bug.cgi?id=2436981", "https://bugzilla.redhat.com/show_bug.cgi?id=2436982", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968", "https://errata.almalinux.org/9/ALSA-2026-18683.html", "https://errata.rockylinux.org/RLSA-2026:18683", "https://linux.oracle.com/cve/CVE-2026-0966.html", "https://linux.oracle.com/errata/ELSA-2026-18683.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-0966", "https://ubuntu.com/security/notices/USN-8051-1", "https://ubuntu.com/security/notices/USN-8051-2", "https://www.cve.org/CVERecord?id=CVE-2026-0966", "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/", "https://www.libssh.org/security/advisories/CVE-2026-0966.txt" ], "PublishedDate": "2026-03-26T21:17:00.783Z", "LastModifiedDate": "2026-06-17T10:11:42.263Z" }, { "VulnerabilityID": "CVE-2026-3731", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-3731", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3e55c60d287c3beb81356e6ac0d4990dd0fb61505845d2c53d2763eb5a7401f7", "Title": "libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler", "Description": "A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.", "Severity": "HIGH", "CweIDs": [ "CWE-119", "CWE-125" ], "VendorSeverity": { "amazon": 2, "azure": 2, "julia": 2, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 6.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-3731", "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60", "https://nvd.nist.gov/vuln/detail/CVE-2026-3731", "https://ubuntu.com/security/notices/USN-8093-1", "https://vuldb.com/?ctiid.349709", "https://vuldb.com/?id.349709", "https://vuldb.com/?submit.767120", "https://www.cve.org/CVERecord?id=CVE-2026-3731", "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz", "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt" ], "PublishedDate": "2026-03-08T11:15:50.307Z", "LastModifiedDate": "2026-06-17T10:44:05.853Z" }, { "VulnerabilityID": "CVE-2026-0964", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-0964", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ab66ba44671d7e212cba3a354e1f369012aeb9c6a795e5e10048f25635cc1e7b", "Title": "libssh: Improper sanitation of paths received from SCP servers", "Description": "A malicious SCP server can send unexpected paths that could make the\nclient application override local files outside of working directory.\nThis could be misused to create malicious executable or configuration\nfiles and make the user execute them under specific consequences.\n\nThis is the same issue as in OpenSSH, tracked as CVE-2019-6111.", "Severity": "MEDIUM", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 2, "julia": 2, "nvd": 2, "oracle-oval": 2, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "V3Score": 6.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "V3Score": 6.3 }, "redhat": { "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "V3Score": 5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:18160", "https://access.redhat.com/errata/RHSA-2026:18683", "https://access.redhat.com/security/cve/CVE-2026-0964", "https://bugzilla.redhat.com/2369367", "https://bugzilla.redhat.com/2376184", "https://bugzilla.redhat.com/2376193", "https://bugzilla.redhat.com/2383220", "https://bugzilla.redhat.com/2383888", "https://bugzilla.redhat.com/2433121", "https://bugzilla.redhat.com/2436979", "https://bugzilla.redhat.com/2436980", "https://bugzilla.redhat.com/2436981", "https://bugzilla.redhat.com/2436982", "https://bugzilla.redhat.com/show_bug.cgi?id=2369367", "https://bugzilla.redhat.com/show_bug.cgi?id=2376184", "https://bugzilla.redhat.com/show_bug.cgi?id=2376193", "https://bugzilla.redhat.com/show_bug.cgi?id=2383220", "https://bugzilla.redhat.com/show_bug.cgi?id=2383888", "https://bugzilla.redhat.com/show_bug.cgi?id=2433121", "https://bugzilla.redhat.com/show_bug.cgi?id=2436979", "https://bugzilla.redhat.com/show_bug.cgi?id=2436980", "https://bugzilla.redhat.com/show_bug.cgi?id=2436981", "https://bugzilla.redhat.com/show_bug.cgi?id=2436982", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968", "https://errata.almalinux.org/9/ALSA-2026-18683.html", "https://errata.rockylinux.org/RLSA-2026:18683", "https://linux.oracle.com/cve/CVE-2026-0964.html", "https://linux.oracle.com/errata/ELSA-2026-18683.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-0964", "https://ubuntu.com/security/notices/USN-8051-1", "https://ubuntu.com/security/notices/USN-8051-2", "https://www.cve.org/CVERecord?id=CVE-2026-0964", "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/", "https://www.libssh.org/security/advisories/CVE-2026-0964.txt" ], "PublishedDate": "2026-03-26T21:17:00.393Z", "LastModifiedDate": "2026-06-17T10:11:41.993Z" }, { "VulnerabilityID": "CVE-2026-0967", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-0967", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1ff04a9a38dc5adafd36dee991dfdf248bc5019404b651ba3b9d6fcceee3e5d2", "Title": "libssh: libssh: Denial of Service via inefficient regular expression processing", "Description": "A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.", "Severity": "MEDIUM", "CweIDs": [ "CWE-1333" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 1, "julia": 2, "nvd": 2, "oracle-oval": 2, "redhat": 1, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L", "V3Score": 2.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:18160", "https://access.redhat.com/errata/RHSA-2026:18683", "https://access.redhat.com/security/cve/CVE-2026-0967", "https://bugzilla.redhat.com/2369367", "https://bugzilla.redhat.com/2376184", "https://bugzilla.redhat.com/2376193", "https://bugzilla.redhat.com/2383220", "https://bugzilla.redhat.com/2383888", "https://bugzilla.redhat.com/2433121", "https://bugzilla.redhat.com/2436979", "https://bugzilla.redhat.com/2436980", "https://bugzilla.redhat.com/2436981", "https://bugzilla.redhat.com/2436982", "https://bugzilla.redhat.com/show_bug.cgi?id=2369367", "https://bugzilla.redhat.com/show_bug.cgi?id=2376184", "https://bugzilla.redhat.com/show_bug.cgi?id=2376193", "https://bugzilla.redhat.com/show_bug.cgi?id=2383220", "https://bugzilla.redhat.com/show_bug.cgi?id=2383888", "https://bugzilla.redhat.com/show_bug.cgi?id=2433121", "https://bugzilla.redhat.com/show_bug.cgi?id=2436979", "https://bugzilla.redhat.com/show_bug.cgi?id=2436980", "https://bugzilla.redhat.com/show_bug.cgi?id=2436981", "https://bugzilla.redhat.com/show_bug.cgi?id=2436982", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968", "https://errata.almalinux.org/9/ALSA-2026-18683.html", "https://errata.rockylinux.org/RLSA-2026:18683", "https://linux.oracle.com/cve/CVE-2026-0967.html", "https://linux.oracle.com/errata/ELSA-2026-18683.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-0967", "https://ubuntu.com/security/notices/USN-8051-1", "https://ubuntu.com/security/notices/USN-8051-2", "https://www.cve.org/CVERecord?id=CVE-2026-0967", "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/", "https://www.libssh.org/security/advisories/CVE-2026-0967.txt" ], "PublishedDate": "2026-03-26T21:17:00.97Z", "LastModifiedDate": "2026-06-17T10:11:42.407Z" }, { "VulnerabilityID": "CVE-2026-15370", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-15370", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a0629a7b38085c12c6d2818f7fbf8877589c72823fa16ea873d02473e93d09b4", "Title": "libssh: libssh: stack buffer overflow in SFTP server longname construction", "Description": "A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.", "Severity": "MEDIUM", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 6.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-15370", "https://bugzilla.redhat.com/show_bug.cgi?id=2499049", "https://nvd.nist.gov/vuln/detail/CVE-2026-15370", "https://www.cve.org/CVERecord?id=CVE-2026-15370" ], "PublishedDate": "2026-07-21T09:16:53.683Z", "LastModifiedDate": "2026-07-22T18:16:55.26Z" }, { "VulnerabilityID": "CVE-2026-59843", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59843", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:424a5f60e735fa865b43548528b832af27b300e0936bccfaefb5b37ffca7e799", "Title": "libssh: libssh: denial of service via zero advertised channel packet size", "Description": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42922", "https://access.redhat.com/security/cve/CVE-2026-59843", "https://bugzilla.redhat.com/show_bug.cgi?id=2498176", "https://nvd.nist.gov/vuln/detail/CVE-2026-59843", "https://www.cve.org/CVERecord?id=CVE-2026-59843" ], "PublishedDate": "2026-07-21T12:18:57.86Z", "LastModifiedDate": "2026-07-22T20:17:03.287Z" }, { "VulnerabilityID": "CVE-2026-59844", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59844", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:67fde133b60a57c9ba1df3c396d9c10446b3b26498c529ed2c51a522e24c986e", "Title": "libssh: libssh: denial of service via oversized SFTP read length", "Description": "A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.", "Severity": "MEDIUM", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42922", "https://access.redhat.com/security/cve/CVE-2026-59844", "https://bugzilla.redhat.com/show_bug.cgi?id=2498177", "https://nvd.nist.gov/vuln/detail/CVE-2026-59844", "https://www.cve.org/CVERecord?id=CVE-2026-59844" ], "PublishedDate": "2026-07-21T12:18:57.973Z", "LastModifiedDate": "2026-07-22T20:17:03.443Z" }, { "VulnerabilityID": "CVE-2026-59845", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59845", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e8c5878c8cc87e7cb77d4a5d2f1b1b0fa4cffec94bf720afc15d2a11ecdfef10", "Title": "libssh: libssh: denial of service via unchecked ProxyCommand fork() failure", "Description": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42922", "https://access.redhat.com/security/cve/CVE-2026-59845", "https://bugzilla.redhat.com/show_bug.cgi?id=2498178", "https://nvd.nist.gov/vuln/detail/CVE-2026-59845", "https://www.cve.org/CVERecord?id=CVE-2026-59845" ], "PublishedDate": "2026-07-21T12:18:58.103Z", "LastModifiedDate": "2026-07-23T15:17:27.83Z" }, { "VulnerabilityID": "CVE-2026-59847", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59847", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e55b4a63c64621692adf1b78ff127c6b9ccf8d8fd450428a0033291c0d33649e", "Title": "libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification", "Description": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.", "Severity": "MEDIUM", "CweIDs": [ "CWE-1310" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42922", "https://access.redhat.com/security/cve/CVE-2026-59847", "https://bugzilla.redhat.com/show_bug.cgi?id=2498180", "https://nvd.nist.gov/vuln/detail/CVE-2026-59847", "https://www.cve.org/CVERecord?id=CVE-2026-59847" ], "PublishedDate": "2026-07-21T14:16:34.657Z", "LastModifiedDate": "2026-07-22T20:17:03.95Z" }, { "VulnerabilityID": "CVE-2026-59848", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59848", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9227b069a40eb47dfc284e5b9ac3c5f87fa47954f8c16c073a1d9421db372326", "Title": "libssh: libssh: denial of service via SFTP responses with unknown request IDs", "Description": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42922", "https://access.redhat.com/security/cve/CVE-2026-59848", "https://bugzilla.redhat.com/show_bug.cgi?id=2498181", "https://nvd.nist.gov/vuln/detail/CVE-2026-59848", "https://www.cve.org/CVERecord?id=CVE-2026-59848" ], "PublishedDate": "2026-07-21T14:16:34.79Z", "LastModifiedDate": "2026-07-23T15:17:28.747Z" }, { "VulnerabilityID": "CVE-2026-59850", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59850", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:de70fcb0e1c45fd49ad69220b10ecd8f0e28b9d422ac65cafd247aead00374da", "Title": "libssh: libssh: use-after-free via data callbacks on closed channels", "Description": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 4.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42922", "https://access.redhat.com/security/cve/CVE-2026-59850", "https://bugzilla.redhat.com/show_bug.cgi?id=2498183", "https://nvd.nist.gov/vuln/detail/CVE-2026-59850", "https://www.cve.org/CVERecord?id=CVE-2026-59850" ], "PublishedDate": "2026-07-21T15:16:37.773Z", "LastModifiedDate": "2026-07-22T20:17:04.693Z" }, { "VulnerabilityID": "CVE-2026-0965", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-0965", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:784d87e8a405704e0bb3939bb77adb1b18c0fcbc2b037add9de586d9909eb179", "Title": "libssh: libssh: Denial of Service via improper configuration file handling", "Description": "A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.", "Severity": "LOW", "CweIDs": [ "CWE-73" ], "VendorSeverity": { "alma": 2, "amazon": 1, "azure": 1, "julia": 1, "oracle-oval": 2, "redhat": 1, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:18160", "https://access.redhat.com/errata/RHSA-2026:18683", "https://access.redhat.com/security/cve/CVE-2026-0965", "https://bugzilla.redhat.com/2369367", "https://bugzilla.redhat.com/2376184", "https://bugzilla.redhat.com/2376193", "https://bugzilla.redhat.com/2383220", "https://bugzilla.redhat.com/2383888", "https://bugzilla.redhat.com/2433121", "https://bugzilla.redhat.com/2436979", "https://bugzilla.redhat.com/2436980", "https://bugzilla.redhat.com/2436981", "https://bugzilla.redhat.com/2436982", "https://bugzilla.redhat.com/show_bug.cgi?id=2369367", "https://bugzilla.redhat.com/show_bug.cgi?id=2376184", "https://bugzilla.redhat.com/show_bug.cgi?id=2376193", "https://bugzilla.redhat.com/show_bug.cgi?id=2383220", "https://bugzilla.redhat.com/show_bug.cgi?id=2383888", "https://bugzilla.redhat.com/show_bug.cgi?id=2433121", "https://bugzilla.redhat.com/show_bug.cgi?id=2436979", "https://bugzilla.redhat.com/show_bug.cgi?id=2436980", "https://bugzilla.redhat.com/show_bug.cgi?id=2436981", "https://bugzilla.redhat.com/show_bug.cgi?id=2436982", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968", "https://errata.almalinux.org/9/ALSA-2026-18683.html", "https://errata.rockylinux.org/RLSA-2026:18683", "https://linux.oracle.com/cve/CVE-2026-0965.html", "https://linux.oracle.com/errata/ELSA-2026-18683.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-0965", "https://ubuntu.com/security/notices/USN-8051-1", "https://ubuntu.com/security/notices/USN-8051-2", "https://www.cve.org/CVERecord?id=CVE-2026-0965", "https://www.libssh.org/security/advisories/CVE-2026-0965.txt" ], "PublishedDate": "2026-03-26T21:17:00.607Z", "LastModifiedDate": "2026-06-17T10:11:42.137Z" }, { "VulnerabilityID": "CVE-2026-0968", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-0968", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:04d47e8277018240b1d3c548589264cffb4dd9dd5c5c4f2a8d9c03517232c05d", "Title": "libssh: libssh: Denial of Service due to malformed SFTP message", "Description": "A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 1, "julia": 1, "nvd": 1, "oracle-oval": 2, "redhat": 1, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:18160", "https://access.redhat.com/errata/RHSA-2026:18683", "https://access.redhat.com/security/cve/CVE-2026-0968", "https://bugzilla.redhat.com/2369367", "https://bugzilla.redhat.com/2376184", "https://bugzilla.redhat.com/2376193", "https://bugzilla.redhat.com/2383220", "https://bugzilla.redhat.com/2383888", "https://bugzilla.redhat.com/2433121", "https://bugzilla.redhat.com/2436979", "https://bugzilla.redhat.com/2436980", "https://bugzilla.redhat.com/2436981", "https://bugzilla.redhat.com/2436982", "https://bugzilla.redhat.com/show_bug.cgi?id=2369367", "https://bugzilla.redhat.com/show_bug.cgi?id=2376184", "https://bugzilla.redhat.com/show_bug.cgi?id=2376193", "https://bugzilla.redhat.com/show_bug.cgi?id=2383220", "https://bugzilla.redhat.com/show_bug.cgi?id=2383888", "https://bugzilla.redhat.com/show_bug.cgi?id=2433121", "https://bugzilla.redhat.com/show_bug.cgi?id=2436979", "https://bugzilla.redhat.com/show_bug.cgi?id=2436980", "https://bugzilla.redhat.com/show_bug.cgi?id=2436981", "https://bugzilla.redhat.com/show_bug.cgi?id=2436982", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968", "https://errata.almalinux.org/9/ALSA-2026-18683.html", "https://errata.rockylinux.org/RLSA-2026:18683", "https://linux.oracle.com/cve/CVE-2026-0968.html", "https://linux.oracle.com/errata/ELSA-2026-18683.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-0968", "https://ubuntu.com/security/notices/USN-8051-1", "https://ubuntu.com/security/notices/USN-8051-2", "https://www.cve.org/CVERecord?id=CVE-2026-0968", "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/", "https://www.libssh.org/security/advisories/CVE-2026-0968.txt" ], "PublishedDate": "2026-03-26T21:17:01.15Z", "LastModifiedDate": "2026-06-17T10:11:42.54Z" }, { "VulnerabilityID": "CVE-2026-59846", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59846", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dbe7534759a456b9056ff83ceab612a03007292ff8f37c3822531f83393e38f2", "Title": "libssh: libssh: information disclosure via ProxyCommand %r username expansion", "Description": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.", "Severity": "LOW", "CweIDs": [ "CWE-77" ], "VendorSeverity": { "redhat": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "V3Score": 3.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42922", "https://access.redhat.com/security/cve/CVE-2026-59846", "https://bugzilla.redhat.com/show_bug.cgi?id=2498179", "https://nvd.nist.gov/vuln/detail/CVE-2026-59846", "https://www.cve.org/CVERecord?id=CVE-2026-59846" ], "PublishedDate": "2026-07-21T13:17:18.143Z", "LastModifiedDate": "2026-07-23T14:17:31.49Z" }, { "VulnerabilityID": "CVE-2026-59849", "PkgID": "libssh-gcrypt-4@0.10.6-0+deb12u2", "PkgName": "libssh-gcrypt-4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssh-gcrypt-4@0.10.6-0%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3faf18c209bcd8df" }, "InstalledVersion": "0.10.6-0+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59849", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:93038635f61c1b6b10a3fffc3ec3db80bb27929c4b8ecbe3d23dd57ddb82eeba", "Title": "libssh: libssh: denial of service via automatic certificate authentication loop", "Description": "A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.", "Severity": "LOW", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "redhat": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42922", "https://access.redhat.com/security/cve/CVE-2026-59849", "https://bugzilla.redhat.com/show_bug.cgi?id=2498182", "https://nvd.nist.gov/vuln/detail/CVE-2026-59849", "https://www.cve.org/CVERecord?id=CVE-2026-59849" ], "PublishedDate": "2026-07-21T15:16:37.647Z", "LastModifiedDate": "2026-07-22T20:17:04.277Z" }, { "VulnerabilityID": "CVE-2025-27587", "PkgID": "libssl3@3.0.20-1~deb12u2", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3@3.0.20-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "2291278c434e08b5" }, "InstalledVersion": "3.0.20-1~deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-27587", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1944d026c12c9703d5f3277507b0a15ad79cb69a7543f4758e22b7b1be4db7cf", "Title": "OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable ...", "Description": "OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.", "Severity": "LOW", "CweIDs": [ "CWE-385" ], "VendorSeverity": { "debian": 1 }, "References": [ "https://github.com/openssl/openssl/issues/24253", "https://minerva.crocs.fi.muni.cz" ], "PublishedDate": "2025-06-16T22:15:44.093Z", "LastModifiedDate": "2026-06-17T09:03:50.853Z" }, { "VulnerabilityID": "CVE-2026-42767", "PkgID": "libssl3@3.0.20-1~deb12u2", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:deb/debian/libssl3@3.0.20-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "2291278c434e08b5" }, "InstalledVersion": "3.0.20-1~deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42767", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ed8b518dab0e72eea46a7c07e5df778e3cb814a9ef2f18304f3edf21edfccfbc", "Title": "openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption", "Description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 2, "photon": 2, "redhat": 1, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/security/cve/CVE-2026-42767", "https://bugzilla.redhat.com/2481879", "https://bugzilla.redhat.com/2481880", "https://bugzilla.redhat.com/2481881", "https://bugzilla.redhat.com/2481882", "https://bugzilla.redhat.com/2481884", "https://bugzilla.redhat.com/2481885", "https://bugzilla.redhat.com/2481887", "https://bugzilla.redhat.com/2481890", "https://bugzilla.redhat.com/2481891", "https://bugzilla.redhat.com/2481892", "https://bugzilla.redhat.com/2481893", "https://bugzilla.redhat.com/2481894", "https://bugzilla.redhat.com/2481896", "https://bugzilla.redhat.com/2481897", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-25239.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/openssl/openssl/commit/61a86a8cd73546c9fea916f3d304c1293e05c046", "https://github.com/openssl/openssl/commit/665d5254083affde9982efca7c41dd01cacc8774", "https://github.com/openssl/openssl/commit/810b722f772652ad48042bcc7ab07e3414b11d0f", "https://github.com/openssl/openssl/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873", "https://github.com/openssl/openssl/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d", "https://linux.oracle.com/cve/CVE-2026-42767.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42767", "https://openssl-library.org/news/secadv/20260609.txt", "https://ubuntu.com/security/notices/USN-8414-1", "https://www.cve.org/CVERecord?id=CVE-2026-42767" ], "PublishedDate": "2026-06-09T17:17:08.093Z", "LastModifiedDate": "2026-07-23T08:10:00.137Z" }, { "VulnerabilityID": "CVE-2022-27943", "PkgID": "libstdc++6@12.2.0-14+deb12u1", "PkgName": "libstdc++6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "4d5941cb5d8b3963" }, "InstalledVersion": "12.2.0-14+deb12u1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-27943", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f2024f30f8585afe96c309e5d8e589bbc672952d070b193b812c27d9c16b6c6c", "Title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "Description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", "Severity": "LOW", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "amazon": 1, "debian": 1, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2022-27943", "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79", "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead", "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/", "https://nvd.nist.gov/vuln/detail/CVE-2022-27943", "https://sourceware.org/bugzilla/show_bug.cgi?id=28995", "https://www.cve.org/CVERecord?id=CVE-2022-27943" ], "PublishedDate": "2022-03-26T13:15:07.9Z", "LastModifiedDate": "2026-06-17T04:37:46.95Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8b23e96a8bb9e436759f7f7a53d594b75b0a08dde326db4f55461ab0c95fb011", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-07-23T12:18:30.933Z" }, { "VulnerabilityID": "CVE-2026-64831", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64831", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a9aa5891da4cedb6939b7e27595c2975d2265665c7ff181a3d772eaf28c61186", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted HEVC/H.265 bitstream", "Description": "FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64831", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665", "https://nvd.nist.gov/vuln/detail/CVE-2026-64831", "https://www.cve.org/CVERecord?id=CVE-2026-64831", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder" ], "PublishedDate": "2026-07-22T17:16:58.697Z", "LastModifiedDate": "2026-07-23T14:17:40.63Z" }, { "VulnerabilityID": "CVE-2026-8461", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d32bd278a66a33bcf63a0f64353bcd324fd9ba954adef880edf21762cfa2e7be", "Title": "ffmpeg: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder", "Description": "An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-8461", "https://bugzilla.redhat.com/show_bug.cgi?id=2490308", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159", "https://github.com/advisories/GHSA-qff7-4q6c-m8h6", "https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/", "https://nvd.nist.gov/vuln/detail/CVE-2026-8461", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json", "https://www.cve.org/CVERecord?id=CVE-2026-8461" ], "PublishedDate": "2026-06-18T14:17:36.66Z", "LastModifiedDate": "2026-07-23T12:18:51.763Z" }, { "VulnerabilityID": "CVE-2023-49528", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-49528", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:445c1f404f312e280cf968d0c5fb0deae1f850c8d9a54954d56d90c2fdd1ded3", "Title": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, al ...", "Description": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component.", "Severity": "MEDIUM", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "ubuntu": 2 }, "References": [ "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://trac.ffmpeg.org/ticket/10691", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2023-49528" ], "PublishedDate": "2024-04-12T06:15:06.32Z", "LastModifiedDate": "2026-06-17T06:36:05.573Z" }, { "VulnerabilityID": "CVE-2023-6601", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6601", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6dd459b5548740ba7d387408679cb0e1e677f0e48e3adc9a4b830f73e83aeef4", "Title": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows by ...", "Description": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-99", "CWE-94" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://bugzilla.redhat.com/show_bug.cgi?id=2253172", "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html", "https://www.cve.org/CVERecord?id=CVE-2023-6601" ], "PublishedDate": "2025-01-06T17:15:14.217Z", "LastModifiedDate": "2026-06-17T06:51:04.107Z" }, { "VulnerabilityID": "CVE-2024-31578", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-31578", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ca4f665d2747add03085c60f5f14c993ce4517a40b44531bdff5665fd3706fec", "Title": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free ...", "Description": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "julia": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179", "https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7", "https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2024-31578" ], "PublishedDate": "2024-04-17T14:15:08.563Z", "LastModifiedDate": "2026-06-17T07:28:36.03Z" }, { "VulnerabilityID": "CVE-2024-35369", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-35369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f13a380dcae99868bd021e21bf49324f3c6021c7b5f510d534f18c8386198606", "Title": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c m ...", "Description": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8", "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423", "https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c" ], "PublishedDate": "2024-11-29T17:15:07.707Z", "LastModifiedDate": "2026-06-17T07:34:49.86Z" }, { "VulnerabilityID": "CVE-2025-10256", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-10256", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fbf00f1ca11e73f2fcc94c6186e951f9f8c7a8a3c703a1e87887b52c3d097bb8", "Title": "ffmpeg: NULL pointer dereference in Firequalizer filter (libavfilter/af_firequalizer.c)", "Description": "A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-10256", "https://bugzilla.redhat.com/show_bug.cgi?id=2394495", "https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931", "https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a", "https://nvd.nist.gov/vuln/detail/CVE-2025-10256", "https://ubuntu.com/security/notices/USN-7830-1", "https://www.cve.org/CVERecord?id=CVE-2025-10256" ], "PublishedDate": "2026-02-18T21:16:20.183Z", "LastModifiedDate": "2026-06-17T08:28:00.503Z" }, { "VulnerabilityID": "CVE-2025-22921", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d7bdbe179e6e580e76fc0c3ca3039be3c8fd68abe260cb92d0e45c7ea230c0e2", "Title": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a seg ...", "Description": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html", "https://trac.ffmpeg.org/ticket/11393", "https://ubuntu.com/security/notices/USN-7538-1", "https://www.cve.org/CVERecord?id=CVE-2025-22921" ], "PublishedDate": "2025-02-18T22:15:18.04Z", "LastModifiedDate": "2026-06-17T08:50:59.503Z" }, { "VulnerabilityID": "CVE-2026-6385", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6385", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:23b204542820e36a7f7fbeba93a5eae63d379e1fa41232a5db63e604fbb7eed4", "Title": "ffmpeg: FFmpeg: Denial of Service and potential arbitrary code execution via signed integer overflow in DVD subtitle parser", "Description": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-6385", "https://bugzilla.redhat.com/show_bug.cgi?id=2458764", "https://nvd.nist.gov/vuln/detail/CVE-2026-6385", "https://www.cve.org/CVERecord?id=CVE-2026-6385" ], "PublishedDate": "2026-04-15T20:16:44.23Z", "LastModifiedDate": "2026-06-17T11:00:45.583Z" }, { "VulnerabilityID": "CVE-2026-65703", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65703", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fbdb836cc7f8c97df396a36720837ceabbfc7030740f9c4e0832ab7587b38e46", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via crafted AVI file in TDSC video decoder", "Description": "FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65703", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773", "https://nvd.nist.gov/vuln/detail/CVE-2026-65703", "https://www.cve.org/CVERecord?id=CVE-2026-65703", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder" ], "PublishedDate": "2026-07-23T20:17:21.803Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65704", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65704", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f3812676d143450e124a2bc0d2fe08b259c16000c81a64088e10631dcbc24d90", "Title": "ffmpeg: FFmpeg: Heap corruption via crafted ffconcat file can lead to arbitrary code execution", "Description": "FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.", "Severity": "MEDIUM", "CweIDs": [ "CWE-191", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65704", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767", "https://nvd.nist.gov/vuln/detail/CVE-2026-65704", "https://www.cve.org/CVERecord?id=CVE-2026-65704", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder" ], "PublishedDate": "2026-07-23T20:17:21.973Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65705", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65705", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9ecc7282f73a089200c14c92b8b8708b3e2b6f33a97b4881dc4a6afd08d21921", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via out-of-bounds write in vf_floodfill video filter", "Description": "FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65705", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780", "https://nvd.nist.gov/vuln/detail/CVE-2026-65705", "https://www.cve.org/CVERecord?id=CVE-2026-65705", "https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame" ], "PublishedDate": "2026-07-23T20:17:22.12Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65706", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65706", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b081ce8f360c22949af0c6a5f7bbf263abf5764687177bc0a41eba4028210ac8", "Title": "FFmpeg: FFmpeg: Arbitrary Code Execution via Crafted Video Frame", "Description": "FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65706", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779", "https://nvd.nist.gov/vuln/detail/CVE-2026-65706", "https://www.cve.org/CVERecord?id=CVE-2026-65706", "https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing" ], "PublishedDate": "2026-07-23T20:17:22.257Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-30999", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-30999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7e05ba128c89b773035e0339d3d9748d85c63e5947ed6d76944fad13d2330eb9", "Title": "FFmpeg: FFmpeg: Denial of Service via heap buffer overflow in av_bprint_finalize()", "Description": "A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.", "Severity": "LOW", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "debian": 1, "julia": 3, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-30999", "https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6", "https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html", "https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c", "https://nvd.nist.gov/vuln/detail/CVE-2026-30999", "https://www.cve.org/CVERecord?id=CVE-2026-30999", "https://www.ffmpeg.org/download.html" ], "PublishedDate": "2026-04-13T15:17:32.827Z", "LastModifiedDate": "2026-06-17T10:33:17.66Z" }, { "VulnerabilityID": "CVE-2024-36615", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-36615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2e6d5d0fb746a6033927418a3eaf28494b0397b81f02a6954c281a335b872f13", "Title": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Thi ...", "Description": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-362" ], "References": [ "https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb", "https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738", "https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61" ], "PublishedDate": "2024-11-29T19:15:07.703Z", "LastModifiedDate": "2026-06-17T07:37:01.797Z" }, { "VulnerabilityID": "CVE-2026-13858", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13858", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:47ea06fdbfe2396163367f6a3c1bb0350e7a4bd3483ecfa362c2f4e079733fe8", "Title": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 a ...", "Description": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html", "https://issues.chromium.org/issues/507090179" ], "PublishedDate": "2026-06-30T23:17:00.22Z", "LastModifiedDate": "2026-07-01T15:36:19.657Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:85d5a1251b17042f68850c15a32b3bb4616991095b3c1bd3469cdcebd359f685", "Title": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vuln ...", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e89becc8acfc43816bc3849459f0502a06968fda22919f3384eec7447212252b", "Title": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-415" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:054b8636d66aaedf7a6534014345159ebaeaef5414b1d70f9cb72c156f2f1a4d", "Title": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vuln ...", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d4f293112b73492aea43422d5ba7c6617d00543ee0a235bae954c0870cb52ac1", "Title": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerabi ...", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-835" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-07-23T16:17:49.397Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cea8c5a4ccdec32a050303f65f401191e69749ca830e5b87d3e1a8ed438ce6e4", "Title": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory acce ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-07-23T14:17:41.17Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:47d4d124fdecc5b061bdcbe62f6469f53d43b6559d8cc2124e8f035f0276143b", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66037", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66037", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bc9f3ee55aee74154040de5322b84a6bbeb61d8243b1dff0c4437a6c265c7753", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolle ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-770" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627", "https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu" ], "PublishedDate": "2026-07-24T20:18:20.573Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66038", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66038", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bea174953384addc70b65b30adf70fdfee1ebe34af8aac01a54e12c1400ca3a9", "Title": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information ...", "Description": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-908" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626", "https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c" ], "PublishedDate": "2026-07-24T20:18:20.727Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:85df6522ebd97b85892809a85b6ef306f3986dd5eddb4696fd2f0580a91e2a8d", "Title": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integ ...", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122", "CWE-190" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7c12f0724e70b937dcd083a5110df0eb55c4277db97b75cb2f2ddfeb300bc33b", "Title": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libswresample4@7:5.1.9-0+deb12u1", "PkgName": "libswresample4", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswresample4@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "9383f87cfc78a2dd" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c441560fa51c11ff2e3e51fcb55a2de1a78c76099a1da63e1bcb3116f4ab055e", "Title": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out ...", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-58049", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-58049", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6dd98c3db1c59cd77522b6360fa67565c84cc25d48a9528b45fb2974eee3bb30", "Title": "FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream", "Description": "FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-58049", "https://bugzilla.redhat.com/show_bug.cgi?id=2493952", "https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c", "https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc", "https://nvd.nist.gov/vuln/detail/CVE-2026-58049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json", "https://www.cve.org/CVERecord?id=CVE-2026-58049", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta" ], "PublishedDate": "2026-06-28T02:16:30.477Z", "LastModifiedDate": "2026-07-23T12:18:30.933Z" }, { "VulnerabilityID": "CVE-2026-64831", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64831", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b1c1f1bdc6a1978ffa89a0579860bf63429b12c0903e75a0f5f5468bf60a7e88", "Title": "ffmpeg: FFmpeg: Arbitrary code execution via crafted HEVC/H.265 bitstream", "Description": "FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-64831", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665", "https://nvd.nist.gov/vuln/detail/CVE-2026-64831", "https://www.cve.org/CVERecord?id=CVE-2026-64831", "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder" ], "PublishedDate": "2026-07-22T17:16:58.697Z", "LastModifiedDate": "2026-07-23T14:17:40.63Z" }, { "VulnerabilityID": "CVE-2026-8461", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8461", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0189be98d021e6f612163d564c85e81d75c1ff442061a5452b9218fcf3b8f0cd", "Title": "ffmpeg: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder", "Description": "An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "julia": 3, "redhat": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:43711", "https://access.redhat.com/security/cve/CVE-2026-8461", "https://bugzilla.redhat.com/show_bug.cgi?id=2490308", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159", "https://github.com/advisories/GHSA-qff7-4q6c-m8h6", "https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/", "https://nvd.nist.gov/vuln/detail/CVE-2026-8461", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json", "https://www.cve.org/CVERecord?id=CVE-2026-8461" ], "PublishedDate": "2026-06-18T14:17:36.66Z", "LastModifiedDate": "2026-07-23T12:18:51.763Z" }, { "VulnerabilityID": "CVE-2023-49528", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-49528", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:583818c2fa6c4457c97bf2d3e4840247a0815ae6b7b0e1f911229df1c7609f27", "Title": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, al ...", "Description": "Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component.", "Severity": "MEDIUM", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "ubuntu": 2 }, "References": [ "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://trac.ffmpeg.org/ticket/10691", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2023-49528" ], "PublishedDate": "2024-04-12T06:15:06.32Z", "LastModifiedDate": "2026-06-17T06:36:05.573Z" }, { "VulnerabilityID": "CVE-2023-6601", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6601", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:adaa498bc29195bbc553fead65d6fb5e3b756394da674341cb84465ddfd5b5bc", "Title": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows by ...", "Description": "A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.", "Severity": "MEDIUM", "CweIDs": [ "CWE-99", "CWE-94" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "V3Score": 4.7 } }, "References": [ "https://bugzilla.redhat.com/show_bug.cgi?id=2253172", "https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html", "https://www.cve.org/CVERecord?id=CVE-2023-6601" ], "PublishedDate": "2025-01-06T17:15:14.217Z", "LastModifiedDate": "2026-06-17T06:51:04.107Z" }, { "VulnerabilityID": "CVE-2024-31578", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-31578", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d0f00028afaa63c8ff894072356fe0a93c1de0b37a072dc14110b1063f3eba1b", "Title": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free ...", "Description": "FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "julia": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179", "https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7", "https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/", "https://ubuntu.com/security/notices/USN-6803-1", "https://www.cve.org/CVERecord?id=CVE-2024-31578" ], "PublishedDate": "2024-04-17T14:15:08.563Z", "LastModifiedDate": "2026-06-17T07:28:36.03Z" }, { "VulnerabilityID": "CVE-2024-35369", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-35369", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ef597586d30b645c223b8ba80a073735dd4be35413a26c0f982c6a78c80698a2", "Title": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c m ...", "Description": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "julia": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8", "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423", "https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c" ], "PublishedDate": "2024-11-29T17:15:07.707Z", "LastModifiedDate": "2026-06-17T07:34:49.86Z" }, { "VulnerabilityID": "CVE-2025-10256", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-10256", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9d5189054ba9951d44180cbbbd157f5950f1b7ac25a54186f4f4a5274ff75018", "Title": "ffmpeg: NULL pointer dereference in Firequalizer filter (libavfilter/af_firequalizer.c)", "Description": "A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-10256", "https://bugzilla.redhat.com/show_bug.cgi?id=2394495", "https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931", "https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a", "https://nvd.nist.gov/vuln/detail/CVE-2025-10256", "https://ubuntu.com/security/notices/USN-7830-1", "https://www.cve.org/CVERecord?id=CVE-2025-10256" ], "PublishedDate": "2026-02-18T21:16:20.183Z", "LastModifiedDate": "2026-06-17T08:28:00.503Z" }, { "VulnerabilityID": "CVE-2025-22921", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22921", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:088cb51d78b677e22f18b3bb6464c1b3d356c0b1d00531f4b7a241343d391f58", "Title": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a seg ...", "Description": "FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.", "Severity": "MEDIUM", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "julia": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html", "https://trac.ffmpeg.org/ticket/11393", "https://ubuntu.com/security/notices/USN-7538-1", "https://www.cve.org/CVERecord?id=CVE-2025-22921" ], "PublishedDate": "2025-02-18T22:15:18.04Z", "LastModifiedDate": "2026-06-17T08:50:59.503Z" }, { "VulnerabilityID": "CVE-2026-6385", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6385", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3e5e6fa991a36bbd6f866ce8684b6896d47d7a4a130a10c1dccd59f3c28b993a", "Title": "ffmpeg: FFmpeg: Denial of Service and potential arbitrary code execution via signed integer overflow in DVD subtitle parser", "Description": "A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-6385", "https://bugzilla.redhat.com/show_bug.cgi?id=2458764", "https://nvd.nist.gov/vuln/detail/CVE-2026-6385", "https://www.cve.org/CVERecord?id=CVE-2026-6385" ], "PublishedDate": "2026-04-15T20:16:44.23Z", "LastModifiedDate": "2026-06-17T11:00:45.583Z" }, { "VulnerabilityID": "CVE-2026-65703", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65703", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:784326fdaade6ea0725e3ef08c3befce238d7567f3ec62a79df96fa4d319e8d1", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via crafted AVI file in TDSC video decoder", "Description": "FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65703", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773", "https://nvd.nist.gov/vuln/detail/CVE-2026-65703", "https://www.cve.org/CVERecord?id=CVE-2026-65703", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder" ], "PublishedDate": "2026-07-23T20:17:21.803Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65704", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65704", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0efb56bf62df043c9b5eb68aa8d33d1da53683d69a0d5eecc1a8c280d995f14b", "Title": "ffmpeg: FFmpeg: Heap corruption via crafted ffconcat file can lead to arbitrary code execution", "Description": "FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.", "Severity": "MEDIUM", "CweIDs": [ "CWE-191", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65704", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767", "https://nvd.nist.gov/vuln/detail/CVE-2026-65704", "https://www.cve.org/CVERecord?id=CVE-2026-65704", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder" ], "PublishedDate": "2026-07-23T20:17:21.973Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65705", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65705", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5eafd21de601acd4b2554f4971ade7cc57c2a7448036ea9f1bbe1610da2f785d", "Title": "FFmpeg: FFmpeg: Arbitrary code execution via out-of-bounds write in vf_floodfill video filter", "Description": "FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65705", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780", "https://nvd.nist.gov/vuln/detail/CVE-2026-65705", "https://www.cve.org/CVERecord?id=CVE-2026-65705", "https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame" ], "PublishedDate": "2026-07-23T20:17:22.12Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-65706", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-65706", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0a168fdbc661fd30cde1c30fc10caeb482bd87de1f2a19f50fc67cd216a21d62", "Title": "FFmpeg: FFmpeg: Arbitrary Code Execution via Crafted Video Frame", "Description": "FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution.", "Severity": "MEDIUM", "CweIDs": [ "CWE-131", "CWE-787" ], "VendorSeverity": { "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-65706", "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779", "https://nvd.nist.gov/vuln/detail/CVE-2026-65706", "https://www.cve.org/CVERecord?id=CVE-2026-65706", "https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing" ], "PublishedDate": "2026-07-23T20:17:22.257Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-30999", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-30999", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ecaf6ae9eeaf55791a1039a7a115b4eee49bd215d5e15e2a3d4a9733f8cd2881", "Title": "FFmpeg: FFmpeg: Denial of Service via heap buffer overflow in av_bprint_finalize()", "Description": "A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.", "Severity": "LOW", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "debian": 1, "julia": 3, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-30999", "https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6", "https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html", "https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c", "https://nvd.nist.gov/vuln/detail/CVE-2026-30999", "https://www.cve.org/CVERecord?id=CVE-2026-30999", "https://www.ffmpeg.org/download.html" ], "PublishedDate": "2026-04-13T15:17:32.827Z", "LastModifiedDate": "2026-06-17T10:33:17.66Z" }, { "VulnerabilityID": "CVE-2024-36615", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-36615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:64a65caf8b010f3787481ff6e5fb49cd6fedfc9843cb9def66b21c2371637962", "Title": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. Thi ...", "Description": "FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-362" ], "References": [ "https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb", "https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738", "https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61" ], "PublishedDate": "2024-11-29T19:15:07.703Z", "LastModifiedDate": "2026-06-17T07:37:01.797Z" }, { "VulnerabilityID": "CVE-2026-13858", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13858", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e652e4f087f0c4ee61939449e7fcdb796d4bbcdb7aa245602b868b63f12ef1e3", "Title": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 a ...", "Description": "Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html", "https://issues.chromium.org/issues/507090179" ], "PublishedDate": "2026-06-30T23:17:00.22Z", "LastModifiedDate": "2026-07-01T15:36:19.657Z" }, { "VulnerabilityID": "CVE-2026-64830", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64830", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4cebb43800a02c14a7db73326d47c15b1c99fe96f96d9cb50eb495b97565e0dd", "Title": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vuln ...", "Description": "FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub-\u003eq[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer" ], "PublishedDate": "2026-07-22T17:16:58.557Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64832", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64832", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6b2f0de2f7d37a34453018c4e3302c04f5e034ec282d8546faff6c31dd29518e", "Title": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-415" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c" ], "PublishedDate": "2026-07-22T18:17:05.483Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64833", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64833", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5f7deaa7ebba4f649664ecdc72c65eec759357d93933db2d5166797bc1c60067", "Title": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vuln ...", "Description": "FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-125" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c" ], "PublishedDate": "2026-07-22T18:17:05.627Z", "LastModifiedDate": "2026-07-22T20:33:11.59Z" }, { "VulnerabilityID": "CVE-2026-64834", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64834", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d61aab4973b0162dcaa43c970ce6890977c1b80566a685a6d02ac4ed941805ef", "Title": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerabi ...", "Description": "FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-835" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer" ], "PublishedDate": "2026-07-22T18:17:05.78Z", "LastModifiedDate": "2026-07-23T16:17:49.397Z" }, { "VulnerabilityID": "CVE-2026-64835", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-64835", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a07262b69e23ddaabb043777f971aab68406f5d8bfa16bdd0bb026e0ce0a6ffd", "Title": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory acce ...", "Description": "FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder" ], "PublishedDate": "2026-07-22T18:17:05.917Z", "LastModifiedDate": "2026-07-23T14:17:41.17Z" }, { "VulnerabilityID": "CVE-2026-66036", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66036", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:673eda5ade56d466fca8cea6d304e10733b33dba3d30110da11a8e744388b5db", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter" ], "PublishedDate": "2026-07-24T20:18:20.433Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66037", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66037", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9fb6d201fe0b74c555a60b1fedbede63d1dc3b69de6f64428a8b9f7f1fb8a74a", "Title": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolle ...", "Description": "FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted count_label field. The mix_presentation_obu() function in libavformat/iamf_parse.c calls av_calloc(count_label, sizeof(*language_label)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-770" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23627", "https://www.vulncheck.com/advisories/ffmpeg-iamf-demuxer-uncontrolled-resource-consumption-via-mix-presentation-obu" ], "PublishedDate": "2026-07-24T20:18:20.573Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66038", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66038", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9a2d0441f01deca92d4d162b46e4463a3414b4304547f99683729ea3747dec0c", "Title": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information ...", "Description": "FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-908" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626", "https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c" ], "PublishedDate": "2026-07-24T20:18:20.727Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66039", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66039", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7a76bd2491c5999c5f73ea86a5931f2eabca7f5626ca59c06ca674a4d09c2f81", "Title": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integ ...", "Description": "FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122", "CWE-190" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631", "https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file" ], "PublishedDate": "2026-07-24T20:18:20.88Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66040", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66040", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e4ef38e60f7149caddd1eb4f09191bc1c7222a748924a75acf08ebbd377aa2bb", "Title": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of- ...", "Description": "FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-122" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23786", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-png-apng-exif-encoder" ], "PublishedDate": "2026-07-24T20:18:21.063Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2026-66041", "PkgID": "libswscale6@7:5.1.9-0+deb12u1", "PkgName": "libswscale6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libswscale6@5.1.9-0%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15\u0026epoch=7", "UID": "5769911a5e22e554" }, "InstalledVersion": "7:5.1.9-0+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66041", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:76803825e6667582487e274bb063c52e677c86f61879e051120d20aaf038386d", "Title": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out ...", "Description": "FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-787" ], "References": [ "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5", "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23625", "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-via-vf-quirc-filter" ], "PublishedDate": "2026-07-24T20:18:21.24Z", "LastModifiedDate": "2026-07-27T20:34:24.887Z" }, { "VulnerabilityID": "CVE-2013-4392", "PkgID": "libsystemd0@252.39-1~deb12u2", "PkgName": "libsystemd0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "39a9ef8237c534db" }, "InstalledVersion": "252.39-1~deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2013-4392", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:74bcd4bf1fece35ecbe1f6435dc6b956cd183cc187a4374a8b47dbf192b02633", "Title": "systemd: TOCTOU race condition when updating file permissions and SELinux security contexts", "Description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.", "Severity": "LOW", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "debian": 1, "nvd": 1, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N", "V2Score": 3.3 }, "redhat": { "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N", "V2Score": 3.3 } }, "References": [ "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357", "http://www.openwall.com/lists/oss-security/2013/10/01/9", "https://access.redhat.com/security/cve/CVE-2013-4392", "https://bugzilla.redhat.com/show_bug.cgi?id=859060", "https://nvd.nist.gov/vuln/detail/CVE-2013-4392", "https://www.cve.org/CVERecord?id=CVE-2013-4392" ], "PublishedDate": "2013-10-28T22:55:03.773Z", "LastModifiedDate": "2026-04-29T01:13:23.04Z" }, { "VulnerabilityID": "CVE-2023-31437", "PkgID": "libsystemd0@252.39-1~deb12u2", "PkgName": "libsystemd0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "39a9ef8237c534db" }, "InstalledVersion": "252.39-1~deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31437", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:af9018229cf61b43ca9b3c2446b4f2f6d8b99e050f70596153409aff391762d9", "Title": "An issue was discovered in systemd 253. An attacker can modify a seale ...", "Description": "An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", "Severity": "LOW", "CweIDs": [ "CWE-354" ], "VendorSeverity": { "debian": 1, "nvd": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 } }, "References": [ "https://github.com/kastel-security/Journald", "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf", "https://github.com/systemd/systemd/releases" ], "PublishedDate": "2023-06-13T17:15:14.657Z", "LastModifiedDate": "2026-06-17T05:56:57.143Z" }, { "VulnerabilityID": "CVE-2023-31438", "PkgID": "libsystemd0@252.39-1~deb12u2", "PkgName": "libsystemd0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "39a9ef8237c534db" }, "InstalledVersion": "252.39-1~deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31438", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:17c65f7d45a19ba2061b160af0665c068410dc6884d44e7bfae5613a09b5301d", "Title": "An issue was discovered in systemd 253. An attacker can truncate a sea ...", "Description": "An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", "Severity": "LOW", "CweIDs": [ "CWE-354" ], "VendorSeverity": { "debian": 1, "nvd": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 } }, "References": [ "https://github.com/kastel-security/Journald", "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf", "https://github.com/systemd/systemd/pull/28886", "https://github.com/systemd/systemd/releases" ], "PublishedDate": "2023-06-13T17:15:14.707Z", "LastModifiedDate": "2026-06-17T05:56:57.36Z" }, { "VulnerabilityID": "CVE-2023-31439", "PkgID": "libsystemd0@252.39-1~deb12u2", "PkgName": "libsystemd0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "39a9ef8237c534db" }, "InstalledVersion": "252.39-1~deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31439", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bf9e06d2f7a9c33eeb744c2e6b38ec9f742230343b842977169b2c5074252445", "Title": "An issue was discovered in systemd 253. An attacker can modify the con ...", "Description": "An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", "Severity": "LOW", "CweIDs": [ "CWE-354" ], "VendorSeverity": { "amazon": 1, "bottlerocket": 2, "debian": 1, "nvd": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31439", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-c8rh-5r8v-5w68", "https://github.com/kastel-security/Journald", "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf", "https://github.com/systemd/systemd/pull/28885", "https://github.com/systemd/systemd/releases" ], "PublishedDate": "2023-06-13T17:15:14.753Z", "LastModifiedDate": "2026-06-17T05:56:57.503Z" }, { "VulnerabilityID": "CVE-2026-40228", "PkgID": "libsystemd0@252.39-1~deb12u2", "PkgName": "libsystemd0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "39a9ef8237c534db" }, "InstalledVersion": "252.39-1~deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40228", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a27817602815dd31d4a5dbc93e3d76fe8759cf370ababc5233111f4bb2c2a042", "Title": "systemd: systemd-journald: Unintended output to user terminals via logger command", "Description": "In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set.", "Severity": "LOW", "CweIDs": [ "CWE-669" ], "VendorSeverity": { "nvd": 1, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "V3Score": 3.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 2.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/05/1", "https://access.redhat.com/security/cve/CVE-2026-40228", "https://nvd.nist.gov/vuln/detail/CVE-2026-40228", "https://www.cve.org/CVERecord?id=CVE-2026-40228", "https://www.openwall.com/lists/oss-security/2026/04/08/1" ], "PublishedDate": "2026-04-10T16:16:33.753Z", "LastModifiedDate": "2026-06-17T10:44:53.31Z" }, { "VulnerabilityID": "CVE-2025-13151", "PkgID": "libtasn1-6@4.19.0-2+deb12u1", "PkgName": "libtasn1-6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtasn1-6@4.19.0-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "484c57438715f01f" }, "InstalledVersion": "4.19.0-2+deb12u1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-13151", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:48b7f2cf063481256eb67678fc86498e9415838d06cd9f6ec154d361b4fe176b", "Title": "libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string", "Description": "Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.", "Severity": "LOW", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 1, "amazon": 3, "azure": 1, "cbl-mariner": 1, "oracle-oval": 1, "photon": 3, "redhat": 1, "rocky": 1, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/01/08/5", "https://access.redhat.com/errata/RHSA-2026:28253", "https://access.redhat.com/security/cve/CVE-2025-13151", "https://bugzilla.redhat.com/2427698", "https://bugzilla.redhat.com/show_bug.cgi?id=2427698", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13151", "https://errata.almalinux.org/9/ALSA-2026-28253.html", "https://errata.rockylinux.org/RLSA-2026:28253", "https://gitlab.com/gnutls/libtasn1", "https://gitlab.com/gnutls/libtasn1/-/merge_requests/121", "https://linux.oracle.com/cve/CVE-2025-13151.html", "https://linux.oracle.com/errata/ELSA-2026-36728.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-13151", "https://ubuntu.com/security/notices/USN-7954-1", "https://ubuntu.com/security/notices/USN-7954-2", "https://www.cve.org/CVERecord?id=CVE-2025-13151", "https://www.kb.cert.org/vuls/id/271649" ], "PublishedDate": "2026-01-07T22:15:43.2Z", "LastModifiedDate": "2026-06-17T08:33:34.88Z" }, { "VulnerabilityID": "CVE-2026-5673", "PkgID": "libtheora0@1.1.1+dfsg.1-16.1+deb12u1", "PkgName": "libtheora0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtheora0@1.1.1%2Bdfsg.1-16.1%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "2b4af0e14c9e90de" }, "InstalledVersion": "1.1.1+dfsg.1-16.1+deb12u1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5673", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:60dee1034bbe955ec5e98ca00de6a87e29a3734677de22873ec5a30091704ccb", "Title": "libtheora: libtheora: Denial of Service or Information Disclosure via malformed AVI file processing", "Description": "A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H", "V3Score": 5.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-5673", "https://bugzilla.redhat.com/show_bug.cgi?id=2455340", "https://github.com/xiph/theora/issues/24", "https://nvd.nist.gov/vuln/detail/CVE-2026-5673", "https://www.cve.org/CVERecord?id=CVE-2026-5673" ], "PublishedDate": "2026-04-06T10:16:03.4Z", "LastModifiedDate": "2026-06-17T10:59:29.177Z" }, { "VulnerabilityID": "CVE-2023-52355", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-52355", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1a622f35806c0e244dcaf90af3bdf44409cac0631b3f2c5591ec83912275b041", "Title": "libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM", "Description": "An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:20801", "https://access.redhat.com/errata/RHSA-2025:21994", "https://access.redhat.com/errata/RHSA-2025:23078", "https://access.redhat.com/errata/RHSA-2025:23079", "https://access.redhat.com/errata/RHSA-2025:23080", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:41892", "https://access.redhat.com/errata/RHSA-2026:43537", "https://access.redhat.com/security/cve/CVE-2023-52355", "https://bugzilla.redhat.com/2251326", "https://bugzilla.redhat.com/2492871", "https://bugzilla.redhat.com/show_bug.cgi?id=2251326", "https://bugzilla.redhat.com/show_bug.cgi?id=2251344", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52355", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52356", "https://errata.almalinux.org/10/ALSA-2026-41892.html", "https://errata.rockylinux.org/RLSA-2025:20801", "https://gitlab.com/libtiff/libtiff/-/issues/621", "https://linux.oracle.com/cve/CVE-2023-52355.html", "https://linux.oracle.com/errata/ELSA-2026-41892.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-52355", "https://www.cve.org/CVERecord?id=CVE-2023-52355" ], "PublishedDate": "2024-01-25T20:15:38.353Z", "LastModifiedDate": "2026-07-22T18:16:54.137Z" }, { "VulnerabilityID": "CVE-2026-12912", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12912", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ea4bcf1223d5201a86635f0bef9a2da00d8afa9c58da7481e6c205dbf6a30e95", "Title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image", "Description": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).", "Severity": "HIGH", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:34890", "https://access.redhat.com/errata/RHSA-2026:41892", "https://access.redhat.com/errata/RHSA-2026:42668", "https://access.redhat.com/security/cve/CVE-2026-12912", "https://bugzilla.redhat.com/2492871", "https://bugzilla.redhat.com/show_bug.cgi?id=2492871", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12912", "https://errata.almalinux.org/9/ALSA-2026-42668.html", "https://errata.rockylinux.org/RLSA-2026:42668", "https://gitlab.com/libtiff/libtiff/-/merge_requests/873", "https://gitlab.com/libtiff/libtiff/-/work_items/824", "https://linux.oracle.com/cve/CVE-2026-12912.html", "https://linux.oracle.com/errata/ELSA-2026-42668.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12912", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json", "https://www.cve.org/CVERecord?id=CVE-2026-12912" ], "PublishedDate": "2026-06-29T17:16:28.23Z", "LastModifiedDate": "2026-07-22T12:17:09.56Z" }, { "VulnerabilityID": "CVE-2026-36849", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-36849", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b368ad75085d762fd2263bf2d7579147bba7987e3f6014acf2f0c64a1b658944", "Title": "[Denial of Service via large SamplesPerPixel tag]", "Description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2026-36849:\n\tDenial of Service via large SamplesPerPixel tag\n\nCVE-2026-12912:\n\tA flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).\n", "Severity": "HIGH", "VendorSeverity": { "amazon": 3 } }, { "VulnerabilityID": "CVE-2023-6277", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "will_not_fix", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6277", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c3ffd612c8211b50fb1069cb25e5745966eec9725b8b04fbe360a20d45308860", "Title": "libtiff: Out-of-memory in TIFFOpen via a craft file", "Description": "An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB.", "Severity": "MEDIUM", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "amazon": 3, "azure": 2, "cbl-mariner": 2, "nvd": 2, "photon": 2, "redhat": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "http://seclists.org/fulldisclosure/2024/Jul/16", "http://seclists.org/fulldisclosure/2024/Jul/17", "http://seclists.org/fulldisclosure/2024/Jul/18", "http://seclists.org/fulldisclosure/2024/Jul/19", "http://seclists.org/fulldisclosure/2024/Jul/20", "http://seclists.org/fulldisclosure/2024/Jul/21", "http://seclists.org/fulldisclosure/2024/Jul/22", "http://seclists.org/fulldisclosure/2024/Jul/23", "https://access.redhat.com/security/cve/CVE-2023-6277", "https://bugzilla.redhat.com/show_bug.cgi?id=2251311", "https://gitlab.com/libtiff/libtiff/-/issues/614", "https://gitlab.com/libtiff/libtiff/-/merge_requests/545", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJIN6DTSL3VODZUGWEUXLEL5DR53EZMV/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y7ZGN2MZXJ6E57W3L4YBM3ZPAU3T7T5C/", "https://nvd.nist.gov/vuln/detail/CVE-2023-6277", "https://security.netapp.com/advisory/ntap-20240119-0002/", "https://support.apple.com/kb/HT214116", "https://support.apple.com/kb/HT214117", "https://support.apple.com/kb/HT214118", "https://support.apple.com/kb/HT214119", "https://support.apple.com/kb/HT214120", "https://support.apple.com/kb/HT214122", "https://support.apple.com/kb/HT214123", "https://support.apple.com/kb/HT214124", "https://ubuntu.com/security/notices/USN-6644-1", "https://ubuntu.com/security/notices/USN-6644-2", "https://www.cve.org/CVERecord?id=CVE-2023-6277" ], "PublishedDate": "2023-11-24T19:15:07.643Z", "LastModifiedDate": "2026-06-17T06:50:26.807Z" }, { "VulnerabilityID": "CVE-2017-16232", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-16232", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ab9dba0eace1d223c64e623dd2191f91b12e8d9e671fcf484f27cb3aa3ed3d96", "Title": "libtiff: Memory leaks in tif_open.c, tif_lzw.c, and tif_aux.c", "Description": "LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue", "Severity": "LOW", "CweIDs": [ "CWE-772" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V2Score": 5, "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html", "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html", "http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html", "http://seclists.org/fulldisclosure/2018/Dec/32", "http://seclists.org/fulldisclosure/2018/Dec/47", "http://www.openwall.com/lists/oss-security/2017/11/01/11", "http://www.openwall.com/lists/oss-security/2017/11/01/3", "http://www.openwall.com/lists/oss-security/2017/11/01/7", "http://www.openwall.com/lists/oss-security/2017/11/01/8", "http://www.securityfocus.com/bid/101696", "https://access.redhat.com/security/cve/CVE-2017-16232", "https://nvd.nist.gov/vuln/detail/CVE-2017-16232", "https://www.cve.org/CVERecord?id=CVE-2017-16232" ], "PublishedDate": "2019-03-21T15:59:56.53Z", "LastModifiedDate": "2026-06-17T01:09:01.353Z" }, { "VulnerabilityID": "CVE-2018-10126", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-10126", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:09298a2dfcef4463db472121408f3becc9a5d2005deafc190ef66370e65bc3fc", "Title": "libtiff: NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c", "Description": "ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1, "nvd": 2, "photon": 2, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "http://bugzilla.maptools.org/show_bug.cgi?id=2786", "https://access.redhat.com/security/cve/CVE-2018-10126", "https://gitlab.com/libtiff/libtiff/-/issues/128", "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2018-10126", "https://www.cve.org/CVERecord?id=CVE-2018-10126" ], "PublishedDate": "2018-04-21T21:29:00.29Z", "LastModifiedDate": "2026-06-17T01:33:33.92Z" }, { "VulnerabilityID": "CVE-2022-1210", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-1210", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1744defe71b2bcc23f9f7ed6c5a78b851adfd41369b857378d9ea64443c13f81", "Title": "tiff: Malicious file leads to a denial of service in TIFF File Handler", "Description": "A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.", "Severity": "LOW", "CweIDs": [ "CWE-400", "CWE-404" ], "VendorSeverity": { "amazon": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "nvd": { "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V2Score": 4.3, "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 4.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2022-1210", "https://gitlab.com/libtiff/libtiff/-/issues/402", "https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff", "https://nvd.nist.gov/vuln/detail/CVE-2022-1210", "https://security.gentoo.org/glsa/202210-10", "https://security.netapp.com/advisory/ntap-20220513-0005/", "https://vuldb.com/?id.196363", "https://www.cve.org/CVERecord?id=CVE-2022-1210" ], "PublishedDate": "2022-04-03T09:15:09.033Z", "LastModifiedDate": "2026-06-17T04:22:01.163Z" }, { "VulnerabilityID": "CVE-2023-1916", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-1916", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:21972dcd77fbe06622612252ea3a7fcbdc6f922fd84f533dd4bb0e0eeb72a8ef", "Title": "libtiff: out-of-bounds read in extractImageSection() in tools/tiffcrop.c", "Description": "A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 6.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 6.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-1916", "https://gitlab.com/libtiff/libtiff/-/issues/536", "https://gitlab.com/libtiff/libtiff/-/issues/536%2C", "https://gitlab.com/libtiff/libtiff/-/issues/537", "https://nvd.nist.gov/vuln/detail/CVE-2023-1916", "https://support.apple.com/kb/HT213844", "https://ubuntu.com/security/notices/USN-6428-1", "https://www.cve.org/CVERecord?id=CVE-2023-1916" ], "PublishedDate": "2023-04-10T22:15:09.223Z", "LastModifiedDate": "2026-06-17T05:29:01.817Z" }, { "VulnerabilityID": "CVE-2023-3164", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-3164", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:55d6dafbead2a1f189470e998311aafbf0b16356c1b99f7f16d66453130224c4", "Title": "libtiff: heap-buffer-overflow in extractImageSection()", "Description": "A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.", "Severity": "LOW", "CweIDs": [ "CWE-120", "CWE-787" ], "VendorSeverity": { "amazon": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-3164", "https://bugzilla.redhat.com/show_bug.cgi?id=2213531", "https://gitlab.com/libtiff/libtiff/-/issues/542", "https://gitlab.com/libtiff/libtiff/-/merge_requests/595", "https://nvd.nist.gov/vuln/detail/CVE-2023-3164", "https://ubuntu.com/security/notices/USN-6827-1", "https://www.cve.org/CVERecord?id=CVE-2023-3164" ], "PublishedDate": "2023-11-02T12:15:09.543Z", "LastModifiedDate": "2026-06-17T06:13:29.55Z" }, { "VulnerabilityID": "CVE-2023-6228", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-6228", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9cb079700508fe5b7becf8877805d635ce52881e6f421e790f60bf4d7ed22228", "Title": "libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c", "Description": "An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.", "Severity": "LOW", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 2, "azure": 1, "cbl-mariner": 1, "debian": 1, "nvd": 2, "oracle-oval": 2, "photon": 2, "redhat": 1, "rocky": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:2289", "https://access.redhat.com/errata/RHSA-2024:5079", "https://access.redhat.com/security/cve/CVE-2023-6228", "https://bugzilla.redhat.com/2215865", "https://bugzilla.redhat.com/2234970", "https://bugzilla.redhat.com/2235264", "https://bugzilla.redhat.com/2235265", "https://bugzilla.redhat.com/2240995", "https://bugzilla.redhat.com/show_bug.cgi?id=1614051", "https://bugzilla.redhat.com/show_bug.cgi?id=2218744", "https://bugzilla.redhat.com/show_bug.cgi?id=2240995", "https://bugzilla.redhat.com/show_bug.cgi?id=2251344", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15209", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25433", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6228", "https://errata.almalinux.org/9/ALSA-2024-2289.html", "https://errata.rockylinux.org/RLSA-2024:5079", "https://linux.oracle.com/cve/CVE-2023-6228.html", "https://linux.oracle.com/errata/ELSA-2024-5079.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-6228", "https://ubuntu.com/security/notices/USN-6644-1", "https://ubuntu.com/security/notices/USN-6644-2", "https://www.cve.org/CVERecord?id=CVE-2023-6228" ], "PublishedDate": "2023-12-18T14:15:11.84Z", "LastModifiedDate": "2026-06-17T06:50:20.353Z" }, { "VulnerabilityID": "CVE-2024-13978", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-13978", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:719f56a452e974def4f01c0740068528f0e3b36418bc05d733f18505566aeaeb", "Title": "libtiff: LibTIFF Null Pointer Dereference", "Description": "A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.", "Severity": "LOW", "CweIDs": [ "CWE-404", "CWE-476" ], "VendorSeverity": { "azure": 1, "cbl-mariner": 1, "julia": 1, "photon": 1, "redhat": 1, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "V40Vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "V3Score": 2.5, "V40Score": 2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 2.5 } }, "References": [ "http://www.libtiff.org/", "https://access.redhat.com/security/cve/CVE-2024-13978", "https://gitlab.com/libtiff/libtiff/-/commit/2ebfffb0e8836bfb1cd7d85c059cd285c59761a4", "https://gitlab.com/libtiff/libtiff/-/commit/7be20ccaab97455f192de0ac561ceda7cd9e12d1", "https://gitlab.com/libtiff/libtiff/-/issues/649", "https://gitlab.com/libtiff/libtiff/-/issues/650", "https://gitlab.com/libtiff/libtiff/-/merge_requests/667", "https://lists.debian.org/debian-lts-announce/2025/09/msg00031.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-13978", "https://vuldb.com/?ctiid.318355", "https://vuldb.com/?id.318355", "https://vuldb.com/?submit.624562", "https://www.cve.org/CVERecord?id=CVE-2024-13978" ], "PublishedDate": "2025-08-01T22:15:25.32Z", "LastModifiedDate": "2026-06-17T07:03:05.58Z" }, { "VulnerabilityID": "CVE-2025-61143", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61143", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:be3f84483c859376fe70db838358ea9635956de1596c160f8d88cd934e675a9a", "Title": "libtiff: libtiff: Denial of Service via NULL pointer dereference in tif_open.c", "Description": "libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-61143", "https://gist.github.com/optionGo/9c024cd8e7b131463b84dc60af9bb0aa", "https://gitlab.com/libtiff/libtiff/-/issues/737", "https://gitlab.com/libtiff/libtiff/-/merge_requests/755", "https://nvd.nist.gov/vuln/detail/CVE-2025-61143", "https://ubuntu.com/security/notices/USN-8113-1", "https://www.cve.org/CVERecord?id=CVE-2025-61143" ], "PublishedDate": "2026-02-23T19:22:56.517Z", "LastModifiedDate": "2026-06-17T09:50:21.56Z" }, { "VulnerabilityID": "CVE-2025-61144", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61144", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8bf8de7ce76a77b43cf944eb9e1154a941455d2ebe3c5838d2c5149a9e2ece8e", "Title": "libtiff: libtiff: Denial of Service via buffer overflow", "Description": "libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.", "Severity": "LOW", "CweIDs": [ "CWE-119" ], "VendorSeverity": { "amazon": 3, "azure": 4, "cbl-mariner": 4, "debian": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-61144", "https://gist.github.com/optionGo/5ad17e96a0a40f03578dd6c9f8645952", "https://gitlab.com/libtiff/libtiff/-/commit/09f53a86cf26dfd961925227e59e180db617f26d", "https://gitlab.com/libtiff/libtiff/-/commit/88cf9dbb48f6e172629795ecffae35d5052f68aa", "https://gitlab.com/libtiff/libtiff/-/issues/740", "https://gitlab.com/libtiff/libtiff/-/merge_requests/757", "https://nvd.nist.gov/vuln/detail/CVE-2025-61144", "https://ubuntu.com/security/notices/USN-8113-1", "https://www.cve.org/CVERecord?id=CVE-2025-61144" ], "PublishedDate": "2026-02-23T19:22:56.643Z", "LastModifiedDate": "2026-06-17T09:50:21.72Z" }, { "VulnerabilityID": "CVE-2025-61145", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61145", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:89282cbc1dde22662488823b5577baa1165fff09747e42a4142c730f50b138b6", "Title": "libtiff: libtiff: Denial of service via double free in tiffcrop.c", "Description": "libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.", "Severity": "LOW", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-61145", "https://gist.github.com/optionGo/062f109569196dbffd8ac12020b42289", "https://gitlab.com/libtiff/libtiff/-/issues/736", "https://gitlab.com/libtiff/libtiff/-/merge_requests/753", "https://nvd.nist.gov/vuln/detail/CVE-2025-61145", "https://www.cve.org/CVERecord?id=CVE-2025-61145" ], "PublishedDate": "2026-02-23T19:22:56.757Z", "LastModifiedDate": "2026-06-17T09:50:21.877Z" }, { "VulnerabilityID": "CVE-2025-8176", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-8176", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:081abfcc766a900b3f1d0bd1ef85e3a6a32fd66232fbdcf34ced2c1a0a3b96a2", "Title": "libtiff: LibTIFF Use-After-Free Vulnerability", "Description": "A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.", "Severity": "LOW", "CweIDs": [ "CWE-119", "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 1, "cbl-mariner": 1, "debian": 1, "julia": 1, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "V3Score": 7.8, "V40Score": 1.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.libtiff.org/", "https://access.redhat.com/errata/RHSA-2025:20956", "https://access.redhat.com/security/cve/CVE-2025-8176", "https://bugzilla.redhat.com/2383598", "https://bugzilla.redhat.com/2392784", "https://bugzilla.redhat.com/show_bug.cgi?id=2383598", "https://bugzilla.redhat.com/show_bug.cgi?id=2392784", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8176", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9900", "https://errata.almalinux.org/9/ALSA-2025-20956.html", "https://errata.rockylinux.org/RLSA-2025:20956", "https://gitlab.com/libtiff/libtiff/-/commit/fe10872e53efba9cc36c66ac4ab3b41a839d5172", "https://gitlab.com/libtiff/libtiff/-/issues/707", "https://gitlab.com/libtiff/libtiff/-/merge_requests/727", "https://linux.oracle.com/cve/CVE-2025-8176.html", "https://linux.oracle.com/errata/ELSA-2025-21407.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-8176", "https://ubuntu.com/security/notices/USN-7707-1", "https://vuldb.com/?ctiid.317590", "https://vuldb.com/?id.317590", "https://vuldb.com/?submit.621796", "https://www.cve.org/CVERecord?id=CVE-2025-8176" ], "PublishedDate": "2025-07-26T04:16:10.527Z", "LastModifiedDate": "2026-06-17T10:06:27.507Z" }, { "VulnerabilityID": "CVE-2025-8177", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-8177", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6e67e83a152f55b7c1adf45d9d3e95f909262045dc4dd4739d43521bed066d67", "Title": "libtiff: LibTIFF Buffer Overflow", "Description": "A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer.", "Severity": "LOW", "CweIDs": [ "CWE-119", "CWE-120" ], "VendorSeverity": { "amazon": 2, "azure": 1, "cbl-mariner": 1, "debian": 1, "julia": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 4.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.libtiff.org/", "https://access.redhat.com/security/cve/CVE-2025-8177", "https://gitlab.com/libtiff/libtiff/-/commit/e8c9d6c616b19438695fd829e58ae4fde5bfbc22", "https://gitlab.com/libtiff/libtiff/-/issues/715", "https://gitlab.com/libtiff/libtiff/-/merge_requests/737", "https://linux.oracle.com/cve/CVE-2025-8177.html", "https://linux.oracle.com/errata/ELSA-2025-21407.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-8177", "https://ubuntu.com/security/notices/USN-7707-1", "https://vuldb.com/?ctiid.317591", "https://vuldb.com/?id.317591", "https://vuldb.com/?submit.621797", "https://www.cve.org/CVERecord?id=CVE-2025-8177" ], "PublishedDate": "2025-07-26T04:16:10.983Z", "LastModifiedDate": "2026-06-17T10:06:27.647Z" }, { "VulnerabilityID": "CVE-2025-8534", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-8534", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3b842f2f1db71a35da2c2a07a65e23e282b8d0a654b910e6ec8e19081ff79684", "Title": "libtiff: Libtiff Null Pointer Dereference Vulnerability", "Description": "A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that \"[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. \"rD\") option is used.\"", "Severity": "LOW", "CweIDs": [ "CWE-404", "CWE-476" ], "VendorSeverity": { "azure": 1, "cbl-mariner": 1, "debian": 1, "julia": 1, "photon": 1, "redhat": 1, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "V40Vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "V3Score": 2.5, "V40Score": 1.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 2.5 } }, "References": [ "http://www.libtiff.org/", "https://access.redhat.com/security/cve/CVE-2025-8534", "https://drive.google.com/file/d/15JPA3kLYiYD-nRNJ8y8HmnYjhv9NE7k6/view?usp=drive_link", "https://gitlab.com/libtiff/libtiff/-/commit/6ba36f159fd396ad11bf6b7874554197736ecc8b", "https://gitlab.com/libtiff/libtiff/-/issues/718", "https://gitlab.com/libtiff/libtiff/-/merge_requests/746", "https://nvd.nist.gov/vuln/detail/CVE-2025-8534", "https://ubuntu.com/security/notices/USN-7707-1", "https://vuldb.com/?ctiid.318664", "https://vuldb.com/?id.318664", "https://vuldb.com/?submit.617831", "https://www.cve.org/CVERecord?id=CVE-2025-8534" ], "PublishedDate": "2025-08-05T00:15:56.88Z", "LastModifiedDate": "2026-06-17T10:07:10.343Z" }, { "VulnerabilityID": "CVE-2025-8851", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-8851", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:98c3dc4a1b180355030c02fe593d9c17776012a0c6305dbddc692b5233de272e", "Title": "libtiff: LibTIFF Stack-based buffer overflow", "Description": "A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.", "Severity": "LOW", "CweIDs": [ "CWE-119", "CWE-121" ], "VendorSeverity": { "amazon": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "photon": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "V3Score": 5.3, "V40Score": 4.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "V3Score": 5.3 } }, "References": [ "http://www.libtiff.org/", "https://access.redhat.com/security/cve/CVE-2025-8851", "https://gitlab.com/libtiff/libtiff/-/commit/8a7a48d7a645992ca83062b3a1873c951661e2b3", "https://gitlab.com/libtiff/libtiff/-/commit/8a7a48d7a645992ca83062b3a1873c951661e2b3%20%28v4.7.0rc1%29", "https://nvd.nist.gov/vuln/detail/CVE-2025-8851", "https://ubuntu.com/security/notices/USN-7707-1", "https://vuldb.com/?ctiid.319382", "https://vuldb.com/?id.319382", "https://vuldb.com/?submit.624604", "https://www.cve.org/CVERecord?id=CVE-2025-8851" ], "PublishedDate": "2025-08-11T14:15:27.597Z", "LastModifiedDate": "2026-06-17T10:07:47.173Z" }, { "VulnerabilityID": "CVE-2025-8961", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-8961", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7ebf865dfa5cbbc5ea0922f221b4dda75f059e91069a978ad0fe72fc61fd398c", "Title": "libtiff: LibTIFF memory corruption", "Description": "A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.", "Severity": "LOW", "CweIDs": [ "CWE-119" ], "VendorSeverity": { "amazon": 2, "azure": 1, "cbl-mariner": 1, "debian": 1, "julia": 1, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "V3Score": 3.3, "V40Score": 1.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "http://www.libtiff.org/", "https://access.redhat.com/security/cve/CVE-2025-8961", "https://drive.google.com/file/d/15L4q2eD8GX3Aj3z6SWC3_FbqaM1ChUx2/view?usp=sharing", "https://gitlab.com/libtiff/libtiff/-/issues/721", "https://gitlab.com/libtiff/libtiff/-/issues/721#note_2670686960", "https://nvd.nist.gov/vuln/detail/CVE-2025-8961", "https://ubuntu.com/security/notices/USN-7783-1", "https://vuldb.com/?ctiid.319955", "https://vuldb.com/?id.319955", "https://vuldb.com/?submit.627957", "https://www.cve.org/CVERecord?id=CVE-2025-8961" ], "PublishedDate": "2025-08-14T13:15:38.037Z", "LastModifiedDate": "2026-06-17T10:08:02.193Z" }, { "VulnerabilityID": "CVE-2025-9165", "PkgID": "libtiff6@4.5.0-6+deb12u4", "PkgName": "libtiff6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtiff6@4.5.0-6%2Bdeb12u4?arch=amd64\u0026distro=debian-12.15", "UID": "f288bc50f8715b44" }, "InstalledVersion": "4.5.0-6+deb12u4", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-9165", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3d3e0c48c99302843b623f7ba8ea6c8ed8494dc618f2db276620e58a6bb2b41a", "Title": "libtiff: LibTIFF memory leak", "Description": "A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because \"this is a memory leak on a command line tool that is about to exit anyway\". In the reply the project maintainer declares this issue as \"a simple 'bug' when leaving the command line tool and (...) not a security issue at all\".", "Severity": "LOW", "CweIDs": [ "CWE-401", "CWE-404" ], "VendorSeverity": { "amazon": 1, "azure": 2, "cbl-mariner": 2, "debian": 1, "photon": 1, "redhat": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "http://www.libtiff.org/", "https://access.redhat.com/security/cve/CVE-2025-9165", "https://drive.google.com/file/d/1FWhmkzksH8-qU0ZM6seBzGNB3aPnX3G8/view?usp=sharing", "https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0", "https://gitlab.com/libtiff/libtiff/-/issues/728", "https://gitlab.com/libtiff/libtiff/-/issues/728#note_2709263214", "https://gitlab.com/libtiff/libtiff/-/merge_requests/747", "https://nvd.nist.gov/vuln/detail/CVE-2025-9165", "https://ubuntu.com/security/notices/USN-7783-1", "https://vuldb.com/?ctiid.320543", "https://vuldb.com/?id.320543", "https://vuldb.com/?submit.630506", "https://vuldb.com/?submit.630507", "https://www.cve.org/CVERecord?id=CVE-2025-9165" ], "PublishedDate": "2025-08-19T20:15:37.557Z", "LastModifiedDate": "2026-06-17T10:08:27.157Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "libtinfo6@6.4-4", "PkgName": "libtinfo6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtinfo6@6.4-4?arch=amd64\u0026distro=debian-12.15", "UID": "35a440edb17e1ce3" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:052e34c2e3734e3791512af1daf70fcd58cecca978ac8dfbcdc5db6dbb385017", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2023-50495", "PkgID": "libtinfo6@6.4-4", "PkgName": "libtinfo6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtinfo6@6.4-4?arch=amd64\u0026distro=debian-12.15", "UID": "35a440edb17e1ce3" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-50495", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2a12503ddcdde0eaa12c8889ac5f0c204abba5c4f826cc0ba8faffeab9d57a9a", "Title": "ncurses: segmentation fault via _nc_wrap_entry()", "Description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().", "Severity": "MEDIUM", "VendorSeverity": { "amazon": 2, "cbl-mariner": 2, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-50495", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/", "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html", "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-50495", "https://security.netapp.com/advisory/ntap-20240119-0008/", "https://ubuntu.com/security/notices/USN-6684-1", "https://www.cve.org/CVERecord?id=CVE-2023-50495" ], "PublishedDate": "2023-12-12T15:15:07.867Z", "LastModifiedDate": "2026-06-17T06:39:44.053Z" }, { "VulnerabilityID": "CVE-2025-6141", "PkgID": "libtinfo6@6.4-4", "PkgName": "libtinfo6", "PkgIdentifier": { "PURL": "pkg:deb/debian/libtinfo6@6.4-4?arch=amd64\u0026distro=debian-12.15", "UID": "35a440edb17e1ce3" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-6141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:77c699d2d9f0083d51bb7510379ce321c856118eefe2dd085bacc3a4e12b2b5f", "Title": "gnu-ncurses: ncurses Stack Buffer Overflow", "Description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "Severity": "LOW", "CweIDs": [ "CWE-119", "CWE-121" ], "VendorSeverity": { "azure": 2, "julia": 2, "photon": 1, "redhat": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "V3Score": 3.3, "V40Score": 4.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-6141", "https://cert-portal.siemens.com/productcert/html/ssa-089022.html", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://github.com/advisories/GHSA-wfwf-ggr2-rpjf", "https://invisible-island.net/ncurses/NEWS.html#index-t20250329", "https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html", "https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html", "https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00114.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-6141", "https://vuldb.com/?ctiid.312610", "https://vuldb.com/?id.312610", "https://vuldb.com/?submit.593000", "https://www.cve.org/CVERecord?id=CVE-2025-6141", "https://www.gnu.org", "https://www.gnu.org/" ], "PublishedDate": "2025-06-16T22:16:41.527Z", "LastModifiedDate": "2026-06-17T10:01:15.04Z" }, { "VulnerabilityID": "CVE-2013-4392", "PkgID": "libudev1@252.39-1~deb12u2", "PkgName": "libudev1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3c4724c0041c8265" }, "InstalledVersion": "252.39-1~deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2013-4392", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:07b1fd05c0aef58bafcf1c57db355bd138c95e6543a2c91cd9556b926f288b56", "Title": "systemd: TOCTOU race condition when updating file permissions and SELinux security contexts", "Description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.", "Severity": "LOW", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "debian": 1, "nvd": 1, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N", "V2Score": 3.3 }, "redhat": { "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N", "V2Score": 3.3 } }, "References": [ "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357", "http://www.openwall.com/lists/oss-security/2013/10/01/9", "https://access.redhat.com/security/cve/CVE-2013-4392", "https://bugzilla.redhat.com/show_bug.cgi?id=859060", "https://nvd.nist.gov/vuln/detail/CVE-2013-4392", "https://www.cve.org/CVERecord?id=CVE-2013-4392" ], "PublishedDate": "2013-10-28T22:55:03.773Z", "LastModifiedDate": "2026-04-29T01:13:23.04Z" }, { "VulnerabilityID": "CVE-2023-31437", "PkgID": "libudev1@252.39-1~deb12u2", "PkgName": "libudev1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3c4724c0041c8265" }, "InstalledVersion": "252.39-1~deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31437", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ec5fc07bbc5b559f4697b46923d5df4eec337875c0d44a47415dbaf6719e1ef8", "Title": "An issue was discovered in systemd 253. An attacker can modify a seale ...", "Description": "An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", "Severity": "LOW", "CweIDs": [ "CWE-354" ], "VendorSeverity": { "debian": 1, "nvd": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 } }, "References": [ "https://github.com/kastel-security/Journald", "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf", "https://github.com/systemd/systemd/releases" ], "PublishedDate": "2023-06-13T17:15:14.657Z", "LastModifiedDate": "2026-06-17T05:56:57.143Z" }, { "VulnerabilityID": "CVE-2023-31438", "PkgID": "libudev1@252.39-1~deb12u2", "PkgName": "libudev1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3c4724c0041c8265" }, "InstalledVersion": "252.39-1~deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31438", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b572d73b91f63d1296690f0298651184459546c91d8ef0cd1c7c62712a0f8643", "Title": "An issue was discovered in systemd 253. An attacker can truncate a sea ...", "Description": "An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", "Severity": "LOW", "CweIDs": [ "CWE-354" ], "VendorSeverity": { "debian": 1, "nvd": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 } }, "References": [ "https://github.com/kastel-security/Journald", "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf", "https://github.com/systemd/systemd/pull/28886", "https://github.com/systemd/systemd/releases" ], "PublishedDate": "2023-06-13T17:15:14.707Z", "LastModifiedDate": "2026-06-17T05:56:57.36Z" }, { "VulnerabilityID": "CVE-2023-31439", "PkgID": "libudev1@252.39-1~deb12u2", "PkgName": "libudev1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3c4724c0041c8265" }, "InstalledVersion": "252.39-1~deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31439", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cd9c6fde56d8ba006594c3f5917aa8a41dc21454c5dc9a7bcbe7d1b73418c3e3", "Title": "An issue was discovered in systemd 253. An attacker can modify the con ...", "Description": "An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\"", "Severity": "LOW", "CweIDs": [ "CWE-354" ], "VendorSeverity": { "amazon": 1, "bottlerocket": 2, "debian": 1, "nvd": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31439", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-c8rh-5r8v-5w68", "https://github.com/kastel-security/Journald", "https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf", "https://github.com/systemd/systemd/pull/28885", "https://github.com/systemd/systemd/releases" ], "PublishedDate": "2023-06-13T17:15:14.753Z", "LastModifiedDate": "2026-06-17T05:56:57.503Z" }, { "VulnerabilityID": "CVE-2026-40228", "PkgID": "libudev1@252.39-1~deb12u2", "PkgName": "libudev1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "3c4724c0041c8265" }, "InstalledVersion": "252.39-1~deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40228", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e63078ccc1a453211cc51b9adb81686e7f1166bf236b5190f1551e22f0b1858b", "Title": "systemd: systemd-journald: Unintended output to user terminals via logger command", "Description": "In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set.", "Severity": "LOW", "CweIDs": [ "CWE-669" ], "VendorSeverity": { "nvd": 1, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "V3Score": 3.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 2.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/05/1", "https://access.redhat.com/security/cve/CVE-2026-40228", "https://nvd.nist.gov/vuln/detail/CVE-2026-40228", "https://www.cve.org/CVERecord?id=CVE-2026-40228", "https://www.openwall.com/lists/oss-security/2026/04/08/1" ], "PublishedDate": "2026-04-10T16:16:33.753Z", "LastModifiedDate": "2026-06-17T10:44:53.31Z" }, { "VulnerabilityID": "CVE-2026-23679", "PkgID": "libusb-1.0-0@2:1.0.26-1", "PkgName": "libusb-1.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libusb-1.0-0@1.0.26-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "135a14008821d03b" }, "InstalledVersion": "2:1.0.26-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23679", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b961948f4734c8dc5a6e26773075bfcf7f90ef6c2a3e5dbe1b84d69c31d706bb", "Title": "libusb: libusb: Denial of Service via malformed USB configuration descriptor", "Description": "libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.", "Severity": "MEDIUM", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "amazon": 2, "julia": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 5.5, "V40Score": 6.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23679", "https://github.com/advisories/GHSA-jp69-qvgm-mqwx", "https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704", "https://github.com/libusb/libusb/issues/1813", "https://github.com/libusb/libusb/pull/1814", "https://github.com/libusb/libusb/releases/tag/v1.0.30", "https://nvd.nist.gov/vuln/detail/CVE-2026-23679", "https://www.cve.org/CVERecord?id=CVE-2026-23679", "https://www.vulncheck.com/advisories/libusb-null-pointer-dereference-in-parse-interface" ], "PublishedDate": "2026-05-27T14:16:44.17Z", "LastModifiedDate": "2026-07-14T16:16:52.027Z" }, { "VulnerabilityID": "CVE-2026-47104", "PkgID": "libusb-1.0-0@2:1.0.26-1", "PkgName": "libusb-1.0-0", "PkgIdentifier": { "PURL": "pkg:deb/debian/libusb-1.0-0@1.0.26-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "135a14008821d03b" }, "InstalledVersion": "2:1.0.26-1", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-47104", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:389cdf5904df8b63db22c10596dfd384683048032272554b081095cad51103d6", "Title": "libusb: libusb: Denial of Service via malformed USB descriptor", "Description": "libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "julia": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "V3Score": 5.5, "V40Score": 5.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-47104", "https://github.com/advisories/GHSA-fh6g-r8pf-wqgw", "https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704", "https://github.com/libusb/libusb/issues/1813", "https://github.com/libusb/libusb/pull/1814", "https://github.com/libusb/libusb/releases/tag/v1.0.30", "https://nvd.nist.gov/vuln/detail/CVE-2026-47104", "https://www.cve.org/CVERecord?id=CVE-2026-47104", "https://www.vulncheck.com/advisories/libusb-out-of-bounds-read-in-parse-iad-array" ], "PublishedDate": "2026-05-27T14:17:32.59Z", "LastModifiedDate": "2026-07-14T22:16:58.53Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "libuuid1@2.38.1-5+deb12u3", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d649adb64a1fff7d" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:612974a2d7cfb5a40b98312196eb55a2f52a7c8d530f907d9bb95ca1daf2f229", "Title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "Description": "Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:\nCVE-2026-53615:\n\tInteger Overflow or Wraparound in libblkid/src/partitions/dos.c\n", "Severity": "HIGH", "VendorSeverity": { "amazon": 3 } }, { "VulnerabilityID": "CVE-2026-13595", "PkgID": "libuuid1@2.38.1-5+deb12u3", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d649adb64a1fff7d" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13595", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:401acf8b400844896c0546fb90b48b86b5032ebbf7dd87d03f9b26f7d7d91d03", "Title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "Description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26573", "https://access.redhat.com/security/cve/CVE-2026-13595", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c", "https://nvd.nist.gov/vuln/detail/CVE-2026-13595", "https://www.cve.org/CVERecord?id=CVE-2026-13595" ], "PublishedDate": "2026-06-29T09:16:28.303Z", "LastModifiedDate": "2026-07-08T03:37:21.637Z" }, { "VulnerabilityID": "CVE-2026-27456", "PkgID": "libuuid1@2.38.1-5+deb12u3", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d649adb64a1fff7d" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f03a39a4cf316e7ddebc5922efe626da38a922aa16023f6a479959b55cc0fa74", "Title": "util-linux: TOCTOU in the mount program when setting up loop devices", "Description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "Severity": "MEDIUM", "CweIDs": [ "CWE-59", "CWE-269", "CWE-367" ], "VendorSeverity": { "azure": 2, "bottlerocket": 2, "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://access.redhat.com/security/cve/CVE-2026-27456", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-jgcxwcxt3sxd.toml", "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g", "https://nvd.nist.gov/vuln/detail/CVE-2026-27456", "https://www.cve.org/CVERecord?id=CVE-2026-27456" ], "PublishedDate": "2026-04-03T22:16:25.4Z", "LastModifiedDate": "2026-07-24T22:10:00.14Z" }, { "VulnerabilityID": "CVE-2026-3184", "PkgID": "libuuid1@2.38.1-5+deb12u3", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d649adb64a1fff7d" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-3184", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1d29a77d851bb25aab72abf71e0466af7e2e818e26825f3805d971cacaf50e98", "Title": "util-linux: util-linux: Access control bypass due to improper hostname canonicalization", "Description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "Severity": "MEDIUM", "CweIDs": [ "CWE-289" ], "VendorSeverity": { "azure": 1, "nvd": 2, "photon": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2026-3184", "https://bugzilla.redhat.com/show_bug.cgi?id=2442570", "https://nvd.nist.gov/vuln/detail/CVE-2026-3184", "https://www.cve.org/CVERecord?id=CVE-2026-3184" ], "PublishedDate": "2026-04-03T19:17:23.377Z", "LastModifiedDate": "2026-07-21T19:10:00.107Z" }, { "VulnerabilityID": "CVE-2022-0563", "PkgID": "libuuid1@2.38.1-5+deb12u3", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d649adb64a1fff7d" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1d5ea794007fb3dc465ae4ba1b86b292c1f113a7300af27be3a0daa4c005221d", "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", "Severity": "LOW", "CweIDs": [ "CWE-209" ], "VendorSeverity": { "amazon": 2, "bottlerocket": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 }, "nvd": { "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V2Score": 1.9, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0563", "https://access.redhat.com/security/cve/CVE-2022-0563", "https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-mv4q-wq4c-5xmg", "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", "https://security.gentoo.org/glsa/202401-08", "https://security.netapp.com/advisory/ntap-20220331-0002/", "https://www.cve.org/CVERecord?id=CVE-2022-0563" ], "PublishedDate": "2022-02-21T19:15:08.393Z", "LastModifiedDate": "2026-06-17T04:20:51.053Z" }, { "VulnerabilityID": "CVE-2025-14104", "PkgID": "libuuid1@2.38.1-5+deb12u3", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d649adb64a1fff7d" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-14104", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f3db763697a799d426553e7f8f3a1c2df1ba5f93d039b10292640acbf9c219e1", "Title": "util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames", "Description": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1696", "https://access.redhat.com/errata/RHSA-2026:1852", "https://access.redhat.com/errata/RHSA-2026:1913", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2737", "https://access.redhat.com/errata/RHSA-2026:2800", "https://access.redhat.com/errata/RHSA-2026:3406", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2025-14104", "https://bugzilla.redhat.com/2419369", "https://bugzilla.redhat.com/show_bug.cgi?id=2419369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14104", "https://errata.almalinux.org/9/ALSA-2026-1913.html", "https://errata.rockylinux.org/RLSA-2026:1913", "https://linux.oracle.com/cve/CVE-2025-14104.html", "https://linux.oracle.com/errata/ELSA-2026-1913.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-14104", "https://www.cve.org/CVERecord?id=CVE-2025-14104" ], "PublishedDate": "2025-12-05T17:16:03.117Z", "LastModifiedDate": "2026-06-30T00:16:53.04Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "libuuid1@2.38.1-5+deb12u3", "PkgName": "libuuid1", "PkgIdentifier": { "PURL": "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "d649adb64a1fff7d" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c67e5ed3cfb7bd394026bcaa382793582d82f56f5c5a1039e9a208e26379e001", "Title": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2025-25467", "PkgID": "libx264-164@2:0.164.3095+gitbaee400-3", "PkgName": "libx264-164", "PkgIdentifier": { "PURL": "pkg:deb/debian/libx264-164@0.164.3095%2Bgitbaee400-3?arch=amd64\u0026distro=debian-12.15\u0026epoch=2", "UID": "7af7e7d1cc47e2b2" }, "InstalledVersion": "2:0.164.3095+gitbaee400-3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-25467", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:34a1531851a25550daf8ad2c66bd62b1f1dacc2190f77b7efcd00820428c7b28", "Title": "Insufficient tracking and releasing of allocated used memory in libx26 ...", "Description": "Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.", "Severity": "LOW", "CweIDs": [ "CWE-94" ], "VendorSeverity": { "debian": 1, "ubuntu": 2 }, "References": [ "https://code.videolan.org/videolan/x264/-/issues/75", "https://www.cve.org/CVERecord?id=CVE-2025-25467" ], "PublishedDate": "2025-02-18T22:15:18.373Z", "LastModifiedDate": "2026-06-17T09:00:48.443Z" }, { "VulnerabilityID": "CVE-2026-6653", "PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u6", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u6?arch=amd64\u0026distro=debian-12.15", "UID": "6e17f8e68de5666e" }, "InstalledVersion": "2.9.14+dfsg-1.3~deb12u6", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6653", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:27f3992111be0b10b82f23fad330e9afdce0ddab4586886e710a2cf58dc66c3e", "Title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free", "Description": "Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.", "Severity": "CRITICAL", "CweIDs": [ "CWE-416", "CWE-611" ], "VendorSeverity": { "amazon": 2, "nvd": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-6653", "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260", "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058", "https://nvd.nist.gov/vuln/detail/CVE-2026-6653", "https://ubuntu.com/security/notices/USN-8456-1", "https://www.cve.org/CVERecord?id=CVE-2026-6653" ], "PublishedDate": "2026-06-22T14:17:51.113Z", "LastModifiedDate": "2026-07-14T16:00:16.047Z" }, { "VulnerabilityID": "CVE-2026-11979", "PkgID": "libxml2@2.9.14+dfsg-1.3~deb12u6", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u6?arch=amd64\u0026distro=debian-12.15", "UID": "6e17f8e68de5666e" }, "InstalledVersion": "2.9.14+dfsg-1.3~deb12u6", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11979", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3797eb0536596d3fddb66682c8cc29e2fba5e780671aa575964a6dcd9089cd32", "Title": "libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow", "Description": "libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.\nBy supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.\nSuccessful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.\n\nThis issue has been fixed in the commit c2e233fc.\n\nNOTE:\nThe maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.", "Severity": "LOW", "CweIDs": [ "CWE-121" ], "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "V3Score": 4.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11979", "https://cert.pl/en/posts/2026/06/CVE-2026-11979", "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e", "https://nvd.nist.gov/vuln/detail/CVE-2026-11979", "https://www.cve.org/CVERecord?id=CVE-2026-11979" ], "PublishedDate": "2026-06-29T14:16:40.593Z", "LastModifiedDate": "2026-06-30T20:22:07.153Z" }, { "VulnerabilityID": "CVE-2007-5686", "PkgID": "login@1:4.13+dfsg1-1+deb12u2", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "38a1786e5b20bfe2" }, "InstalledVersion": "1:4.13+dfsg1-1+deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2007-5686", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:215cd5d20be71b8c3e571e433681a9f12a9cc97140b43e7a89615faf7756edb8", "Title": "initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ...", "Description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.", "Severity": "LOW", "CweIDs": [ "CWE-264" ], "VendorSeverity": { "debian": 1, "nvd": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N", "V2Score": 4.9 } }, "References": [ "http://secunia.com/advisories/27215", "http://www.securityfocus.com/archive/1/482129/100/100/threaded", "http://www.securityfocus.com/archive/1/482857/100/0/threaded", "http://www.securityfocus.com/bid/26048", "http://www.vupen.com/english/advisories/2007/3474", "https://issues.rpath.com/browse/RPL-1825" ], "PublishedDate": "2007-10-28T17:08:00Z", "LastModifiedDate": "2026-04-23T00:35:47.467Z" }, { "VulnerabilityID": "CVE-2024-56433", "PkgID": "login@1:4.13+dfsg1-1+deb12u2", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "38a1786e5b20bfe2" }, "InstalledVersion": "1:4.13+dfsg1-1+deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-56433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3d0886aa8ad5c117c9402f9088cd38d1aa932624ec405dc520f7a163027de66d", "Title": "shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise", "Description": "shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.", "Severity": "LOW", "CweIDs": [ "CWE-1188" ], "VendorSeverity": { "alma": 1, "azure": 1, "oracle-oval": 1, "redhat": 1, "rocky": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "V3Score": 3.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:20559", "https://access.redhat.com/security/cve/CVE-2024-56433", "https://bugzilla.redhat.com/2334165", "https://bugzilla.redhat.com/show_bug.cgi?id=2334165", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56433", "https://errata.almalinux.org/9/ALSA-2025-20559.html", "https://errata.rockylinux.org/RLSA-2025:20559", "https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241", "https://github.com/shadow-maint/shadow/issues/1157", "https://github.com/shadow-maint/shadow/releases/tag/4.4", "https://linux.oracle.com/cve/CVE-2024-56433.html", "https://linux.oracle.com/errata/ELSA-2025-20559-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-56433", "https://www.cve.org/CVERecord?id=CVE-2024-56433" ], "PublishedDate": "2024-12-26T09:15:07.267Z", "LastModifiedDate": "2026-06-17T08:12:10.903Z" }, { "VulnerabilityID": "TEMP-0628843-DBAD28", "PkgID": "login@1:4.13+dfsg1-1+deb12u2", "PkgName": "login", "PkgIdentifier": { "PURL": "pkg:deb/debian/login@4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "38a1786e5b20bfe2" }, "InstalledVersion": "1:4.13+dfsg1-1+deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0628843-DBAD28", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7f4c22b1cb19fed416ba67f5628a150ba902f146aa71f5b8b987b87b1d101234", "Title": "[more related to CVE-2005-4890]", "Severity": "LOW", "VendorSeverity": { "debian": 1 } }, { "VulnerabilityID": "CVE-2023-45913", "PkgID": "mesa-va-drivers@22.3.6-1+deb12u2", "PkgName": "mesa-va-drivers", "PkgIdentifier": { "PURL": "pkg:deb/debian/mesa-va-drivers@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "94e4ab95868a544" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45913", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c88684693e02e47027ee6336f2952e178ffb4c37fca351fb3206f1aee57a5282", "Title": "Mesa v23.0.4 was discovered to contain a NULL pointer dereference via ...", "Description": "Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId(). This vulnerability is triggered when the X11 server sends an DRI2_BufferSwapComplete event unexpectedly when the application is using DRI3. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176800/Mesa-23.0.4-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/28", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9856", "https://seclists.org/fulldisclosure/2024/Jan/71" ], "PublishedDate": "2024-03-27T04:15:10.59Z", "LastModifiedDate": "2026-06-17T06:29:47.107Z" }, { "VulnerabilityID": "CVE-2023-45919", "PkgID": "mesa-va-drivers@22.3.6-1+deb12u2", "PkgName": "mesa-va-drivers", "PkgIdentifier": { "PURL": "pkg:deb/debian/mesa-va-drivers@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "94e4ab95868a544" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45919", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6c5cc038862ce63f18caaedd7045ad04803b88739a33e6b8a3a7f626069ae7db", "Title": "Mesa 23.0.4 was discovered to contain a buffer over-read in glXQuerySe ...", "Description": "Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176802/Mesa-23.0.4-Buffer-Overflow.html", "http://seclists.org/fulldisclosure/2024/Jan/47", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9858" ], "PublishedDate": "2024-03-27T05:15:47.03Z", "LastModifiedDate": "2026-06-17T06:29:47.34Z" }, { "VulnerabilityID": "CVE-2023-45922", "PkgID": "mesa-va-drivers@22.3.6-1+deb12u2", "PkgName": "mesa-va-drivers", "PkgIdentifier": { "PURL": "pkg:deb/debian/mesa-va-drivers@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "94e4ab95868a544" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45922", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4b6a322a3fcd5150cc96abf3be3fdb143fec269384f6c3ad1f0921b908960a2b", "Title": "glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation ...", "Description": "glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.", "Severity": "LOW", "CweIDs": [ "CWE-754" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176805/Mesa-23.0.4-Buffer-Overflow-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/50", "http://seclists.org/fulldisclosure/2024/Jan/71", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9857" ], "PublishedDate": "2024-03-27T05:15:47.203Z", "LastModifiedDate": "2026-06-17T06:29:47.72Z" }, { "VulnerabilityID": "CVE-2023-45931", "PkgID": "mesa-va-drivers@22.3.6-1+deb12u2", "PkgName": "mesa-va-drivers", "PkgIdentifier": { "PURL": "pkg:deb/debian/mesa-va-drivers@22.3.6-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "94e4ab95868a544" }, "InstalledVersion": "22.3.6-1+deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45931", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:450c12bf2a6607f4b6cd5b6c5864e21998d0f5d5a1515e58496c08cd3b2f58a6", "Title": "Mesa 23.0.4 was discovered to contain a NULL pointer dereference in ch ...", "Description": "Mesa 23.0.4 was discovered to contain a NULL pointer dereference in check_xshm() for the has_error state. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "debian": 1 }, "References": [ "http://packetstormsecurity.com/files/176813/Mesa-23.0.4-Null-Pointer.html", "http://seclists.org/fulldisclosure/2024/Jan/59", "http://seclists.org/fulldisclosure/2024/Jan/71", "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9859", "https://seclists.org/fulldisclosure/2024/Jan/71" ], "PublishedDate": "2024-03-27T04:15:11.25Z", "LastModifiedDate": "2026-06-17T06:29:48.707Z" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "mount@2.38.1-5+deb12u3", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "db6b596e9b2c0272" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:8278b7d7c3aa4448c92d42445bf6c62d9263c7740642b5ddd8fd558fcfa9e52e", "Title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "Description": "Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:\nCVE-2026-53615:\n\tInteger Overflow or Wraparound in libblkid/src/partitions/dos.c\n", "Severity": "HIGH", "VendorSeverity": { "amazon": 3 } }, { "VulnerabilityID": "CVE-2026-13595", "PkgID": "mount@2.38.1-5+deb12u3", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "db6b596e9b2c0272" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13595", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:db198eb38cac1e4a09a60a018c1d1dd76be20f21af75df2a709534a6d0abef49", "Title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "Description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26573", "https://access.redhat.com/security/cve/CVE-2026-13595", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c", "https://nvd.nist.gov/vuln/detail/CVE-2026-13595", "https://www.cve.org/CVERecord?id=CVE-2026-13595" ], "PublishedDate": "2026-06-29T09:16:28.303Z", "LastModifiedDate": "2026-07-08T03:37:21.637Z" }, { "VulnerabilityID": "CVE-2026-27456", "PkgID": "mount@2.38.1-5+deb12u3", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "db6b596e9b2c0272" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:12b5f7913745a444b7af24edfc6b7141ceb248a2d6a68d004bfe58c363dd6c49", "Title": "util-linux: TOCTOU in the mount program when setting up loop devices", "Description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "Severity": "MEDIUM", "CweIDs": [ "CWE-59", "CWE-269", "CWE-367" ], "VendorSeverity": { "azure": 2, "bottlerocket": 2, "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://access.redhat.com/security/cve/CVE-2026-27456", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-jgcxwcxt3sxd.toml", "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g", "https://nvd.nist.gov/vuln/detail/CVE-2026-27456", "https://www.cve.org/CVERecord?id=CVE-2026-27456" ], "PublishedDate": "2026-04-03T22:16:25.4Z", "LastModifiedDate": "2026-07-24T22:10:00.14Z" }, { "VulnerabilityID": "CVE-2026-3184", "PkgID": "mount@2.38.1-5+deb12u3", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "db6b596e9b2c0272" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-3184", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:253c70dabf239a9f36b527af43843cd06ea3566cf248a68c4fbd457651c4cbdf", "Title": "util-linux: util-linux: Access control bypass due to improper hostname canonicalization", "Description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "Severity": "MEDIUM", "CweIDs": [ "CWE-289" ], "VendorSeverity": { "azure": 1, "nvd": 2, "photon": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2026-3184", "https://bugzilla.redhat.com/show_bug.cgi?id=2442570", "https://nvd.nist.gov/vuln/detail/CVE-2026-3184", "https://www.cve.org/CVERecord?id=CVE-2026-3184" ], "PublishedDate": "2026-04-03T19:17:23.377Z", "LastModifiedDate": "2026-07-21T19:10:00.107Z" }, { "VulnerabilityID": "CVE-2022-0563", "PkgID": "mount@2.38.1-5+deb12u3", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "db6b596e9b2c0272" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9f24f13e8706905346aab3b02dc978d6703d247de2bca132006aabcbdfc5eb13", "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", "Severity": "LOW", "CweIDs": [ "CWE-209" ], "VendorSeverity": { "amazon": 2, "bottlerocket": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 }, "nvd": { "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V2Score": 1.9, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0563", "https://access.redhat.com/security/cve/CVE-2022-0563", "https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-mv4q-wq4c-5xmg", "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", "https://security.gentoo.org/glsa/202401-08", "https://security.netapp.com/advisory/ntap-20220331-0002/", "https://www.cve.org/CVERecord?id=CVE-2022-0563" ], "PublishedDate": "2022-02-21T19:15:08.393Z", "LastModifiedDate": "2026-06-17T04:20:51.053Z" }, { "VulnerabilityID": "CVE-2025-14104", "PkgID": "mount@2.38.1-5+deb12u3", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "db6b596e9b2c0272" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-14104", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:01430599de33662ec1e5b456e2e23f897e622523a57b4e78c9b875521228aac2", "Title": "util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames", "Description": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1696", "https://access.redhat.com/errata/RHSA-2026:1852", "https://access.redhat.com/errata/RHSA-2026:1913", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2737", "https://access.redhat.com/errata/RHSA-2026:2800", "https://access.redhat.com/errata/RHSA-2026:3406", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2025-14104", "https://bugzilla.redhat.com/2419369", "https://bugzilla.redhat.com/show_bug.cgi?id=2419369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14104", "https://errata.almalinux.org/9/ALSA-2026-1913.html", "https://errata.rockylinux.org/RLSA-2026:1913", "https://linux.oracle.com/cve/CVE-2025-14104.html", "https://linux.oracle.com/errata/ELSA-2026-1913.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-14104", "https://www.cve.org/CVERecord?id=CVE-2025-14104" ], "PublishedDate": "2025-12-05T17:16:03.117Z", "LastModifiedDate": "2026-06-30T00:16:53.04Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "mount@2.38.1-5+deb12u3", "PkgName": "mount", "PkgIdentifier": { "PURL": "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "db6b596e9b2c0272" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:fbbee9bd7776ff749c5e7bbb76772a7ee80b84dcb66afaad7852e2e64e0aa8f1", "Title": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "ncurses-base@6.4-4", "PkgName": "ncurses-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-base@6.4-4?arch=all\u0026distro=debian-12.15", "UID": "8e69deb4f19b17b3" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:5f9d0db2ac5838d40f1d890a33155e00000ee83944d5399e6c4c3fcf7f846ed1", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2023-50495", "PkgID": "ncurses-base@6.4-4", "PkgName": "ncurses-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-base@6.4-4?arch=all\u0026distro=debian-12.15", "UID": "8e69deb4f19b17b3" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-50495", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ee2bc73dd00baefe0f2fcbb85d6a2a05a49f009aefa7154566838378f518b64e", "Title": "ncurses: segmentation fault via _nc_wrap_entry()", "Description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().", "Severity": "MEDIUM", "VendorSeverity": { "amazon": 2, "cbl-mariner": 2, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-50495", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/", "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html", "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-50495", "https://security.netapp.com/advisory/ntap-20240119-0008/", "https://ubuntu.com/security/notices/USN-6684-1", "https://www.cve.org/CVERecord?id=CVE-2023-50495" ], "PublishedDate": "2023-12-12T15:15:07.867Z", "LastModifiedDate": "2026-06-17T06:39:44.053Z" }, { "VulnerabilityID": "CVE-2025-6141", "PkgID": "ncurses-base@6.4-4", "PkgName": "ncurses-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-base@6.4-4?arch=all\u0026distro=debian-12.15", "UID": "8e69deb4f19b17b3" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-6141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a2267fd425d3a9dda4f39f3379fab3b71b0cf0f02495abb3230a3fa9b1c4da7c", "Title": "gnu-ncurses: ncurses Stack Buffer Overflow", "Description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "Severity": "LOW", "CweIDs": [ "CWE-119", "CWE-121" ], "VendorSeverity": { "azure": 2, "julia": 2, "photon": 1, "redhat": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "V3Score": 3.3, "V40Score": 4.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-6141", "https://cert-portal.siemens.com/productcert/html/ssa-089022.html", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://github.com/advisories/GHSA-wfwf-ggr2-rpjf", "https://invisible-island.net/ncurses/NEWS.html#index-t20250329", "https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html", "https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html", "https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00114.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-6141", "https://vuldb.com/?ctiid.312610", "https://vuldb.com/?id.312610", "https://vuldb.com/?submit.593000", "https://www.cve.org/CVERecord?id=CVE-2025-6141", "https://www.gnu.org", "https://www.gnu.org/" ], "PublishedDate": "2025-06-16T22:16:41.527Z", "LastModifiedDate": "2026-06-17T10:01:15.04Z" }, { "VulnerabilityID": "CVE-2025-69720", "PkgID": "ncurses-bin@6.4-4", "PkgName": "ncurses-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.4-4?arch=amd64\u0026distro=debian-12.15", "UID": "e3f559220e0fbad1" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69720", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e5fc4fcf34e1aa0d94421f818476cadb892467054fe8b929823e5140bf58aa67", "Title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.", "Description": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.", "Severity": "HIGH", "CweIDs": [ "CWE-121", "CWE-120" ], "VendorSeverity": { "alma": 2, "azure": 4, "cbl-mariner": 4, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:5913", "https://access.redhat.com/security/cve/CVE-2025-69720", "https://bugzilla.redhat.com/2449037", "https://bugzilla.redhat.com/show_bug.cgi?id=2449037", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69720", "https://errata.almalinux.org/10/ALSA-2026-5913.html", "https://errata.rockylinux.org/RLSA-2026:5913", "https://github.com/Cao-Wuhui/CVE-2025-69720", "https://invisible-island.net/archives/ncurses/6.5/", "https://invisible-island.net/ncurses/", "https://linux.oracle.com/cve/CVE-2025-69720.html", "https://linux.oracle.com/errata/ELSA-2026-5913.html", "https://marc.info/?l=ncurses-bug\u0026m=176539968328570\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176540731801330\u0026w=2", "https://marc.info/?l=ncurses-bug\u0026m=176545557728083\u0026w=2", "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "https://ubuntu.com/security/notices/USN-8503-1", "https://www.cve.org/CVERecord?id=CVE-2025-69720" ], "PublishedDate": "2026-03-19T15:16:21.293Z", "LastModifiedDate": "2026-06-17T10:00:50.423Z" }, { "VulnerabilityID": "CVE-2023-50495", "PkgID": "ncurses-bin@6.4-4", "PkgName": "ncurses-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.4-4?arch=amd64\u0026distro=debian-12.15", "UID": "e3f559220e0fbad1" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-50495", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:95ceab7a83b9b2de7c1352de06cb00b677a6479ed2b185b6b5df6142e6e9df0e", "Title": "ncurses: segmentation fault via _nc_wrap_entry()", "Description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().", "Severity": "MEDIUM", "VendorSeverity": { "amazon": 2, "cbl-mariner": 2, "nvd": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2023-50495", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/", "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html", "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-50495", "https://security.netapp.com/advisory/ntap-20240119-0008/", "https://ubuntu.com/security/notices/USN-6684-1", "https://www.cve.org/CVERecord?id=CVE-2023-50495" ], "PublishedDate": "2023-12-12T15:15:07.867Z", "LastModifiedDate": "2026-06-17T06:39:44.053Z" }, { "VulnerabilityID": "CVE-2025-6141", "PkgID": "ncurses-bin@6.4-4", "PkgName": "ncurses-bin", "PkgIdentifier": { "PURL": "pkg:deb/debian/ncurses-bin@6.4-4?arch=amd64\u0026distro=debian-12.15", "UID": "e3f559220e0fbad1" }, "InstalledVersion": "6.4-4", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-6141", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:22cfa85e56af09d7bc6a1042f91fa952f7169efbe29f37251a41022c83479b6c", "Title": "gnu-ncurses: ncurses Stack Buffer Overflow", "Description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "Severity": "LOW", "CweIDs": [ "CWE-119", "CWE-121" ], "VendorSeverity": { "azure": 2, "julia": 2, "photon": 1, "redhat": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "V3Score": 3.3, "V40Score": 4.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-6141", "https://cert-portal.siemens.com/productcert/html/ssa-089022.html", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://github.com/advisories/GHSA-wfwf-ggr2-rpjf", "https://invisible-island.net/ncurses/NEWS.html#index-t20250329", "https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html", "https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html", "https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00114.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-6141", "https://vuldb.com/?ctiid.312610", "https://vuldb.com/?id.312610", "https://vuldb.com/?submit.593000", "https://www.cve.org/CVERecord?id=CVE-2025-6141", "https://www.gnu.org", "https://www.gnu.org/" ], "PublishedDate": "2025-06-16T22:16:41.527Z", "LastModifiedDate": "2026-06-17T10:01:15.04Z" }, { "VulnerabilityID": "CVE-2025-27587", "PkgID": "openssl@3.0.20-1~deb12u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.0.20-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "a0263937aada4eab" }, "InstalledVersion": "3.0.20-1~deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-27587", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:56d9168a3275c6fa5effdc5403d7784bc2bb2097f212729f250e58a378149d82", "Title": "OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable ...", "Description": "OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.", "Severity": "LOW", "CweIDs": [ "CWE-385" ], "VendorSeverity": { "debian": 1 }, "References": [ "https://github.com/openssl/openssl/issues/24253", "https://minerva.crocs.fi.muni.cz" ], "PublishedDate": "2025-06-16T22:15:44.093Z", "LastModifiedDate": "2026-06-17T09:03:50.853Z" }, { "VulnerabilityID": "CVE-2026-42767", "PkgID": "openssl@3.0.20-1~deb12u2", "PkgName": "openssl", "PkgIdentifier": { "PURL": "pkg:deb/debian/openssl@3.0.20-1~deb12u2?arch=amd64\u0026distro=debian-12.15", "UID": "a0263937aada4eab" }, "InstalledVersion": "3.0.20-1~deb12u2", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42767", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e7b018999abbc1fcb77d9fc834091ce6b55362492b943fe0d8ead17a1d40fb48", "Title": "openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption", "Description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "LOW", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 2, "photon": 2, "redhat": 1, "rocky": 3, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/security/cve/CVE-2026-42767", "https://bugzilla.redhat.com/2481879", "https://bugzilla.redhat.com/2481880", "https://bugzilla.redhat.com/2481881", "https://bugzilla.redhat.com/2481882", "https://bugzilla.redhat.com/2481884", "https://bugzilla.redhat.com/2481885", "https://bugzilla.redhat.com/2481887", "https://bugzilla.redhat.com/2481890", "https://bugzilla.redhat.com/2481891", "https://bugzilla.redhat.com/2481892", "https://bugzilla.redhat.com/2481893", "https://bugzilla.redhat.com/2481894", "https://bugzilla.redhat.com/2481896", "https://bugzilla.redhat.com/2481897", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-25239.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/openssl/openssl/commit/61a86a8cd73546c9fea916f3d304c1293e05c046", "https://github.com/openssl/openssl/commit/665d5254083affde9982efca7c41dd01cacc8774", "https://github.com/openssl/openssl/commit/810b722f772652ad48042bcc7ab07e3414b11d0f", "https://github.com/openssl/openssl/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873", "https://github.com/openssl/openssl/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d", "https://linux.oracle.com/cve/CVE-2026-42767.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42767", "https://openssl-library.org/news/secadv/20260609.txt", "https://ubuntu.com/security/notices/USN-8414-1", "https://www.cve.org/CVERecord?id=CVE-2026-42767" ], "PublishedDate": "2026-06-09T17:17:08.093Z", "LastModifiedDate": "2026-07-23T08:10:00.137Z" }, { "VulnerabilityID": "CVE-2007-5686", "PkgID": "passwd@1:4.13+dfsg1-1+deb12u2", "PkgName": "passwd", "PkgIdentifier": { "PURL": "pkg:deb/debian/passwd@4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "8c2b119c05698e6a" }, "InstalledVersion": "1:4.13+dfsg1-1+deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2007-5686", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:08bcbcd3a1e096b630810d26d76369ad6b5a9fab533f2d3ab9afc1f4b878b9b5", "Title": "initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ...", "Description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.", "Severity": "LOW", "CweIDs": [ "CWE-264" ], "VendorSeverity": { "debian": 1, "nvd": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N", "V2Score": 4.9 } }, "References": [ "http://secunia.com/advisories/27215", "http://www.securityfocus.com/archive/1/482129/100/100/threaded", "http://www.securityfocus.com/archive/1/482857/100/0/threaded", "http://www.securityfocus.com/bid/26048", "http://www.vupen.com/english/advisories/2007/3474", "https://issues.rpath.com/browse/RPL-1825" ], "PublishedDate": "2007-10-28T17:08:00Z", "LastModifiedDate": "2026-04-23T00:35:47.467Z" }, { "VulnerabilityID": "CVE-2024-56433", "PkgID": "passwd@1:4.13+dfsg1-1+deb12u2", "PkgName": "passwd", "PkgIdentifier": { "PURL": "pkg:deb/debian/passwd@4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "8c2b119c05698e6a" }, "InstalledVersion": "1:4.13+dfsg1-1+deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-56433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d2096d1b69cec0312bd0a12444da5a5207a9926ee01deddf2ebcf44afe3459d0", "Title": "shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise", "Description": "shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.", "Severity": "LOW", "CweIDs": [ "CWE-1188" ], "VendorSeverity": { "alma": 1, "azure": 1, "oracle-oval": 1, "redhat": 1, "rocky": 1, "ubuntu": 1 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "V3Score": 3.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:20559", "https://access.redhat.com/security/cve/CVE-2024-56433", "https://bugzilla.redhat.com/2334165", "https://bugzilla.redhat.com/show_bug.cgi?id=2334165", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56433", "https://errata.almalinux.org/9/ALSA-2025-20559.html", "https://errata.rockylinux.org/RLSA-2025:20559", "https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241", "https://github.com/shadow-maint/shadow/issues/1157", "https://github.com/shadow-maint/shadow/releases/tag/4.4", "https://linux.oracle.com/cve/CVE-2024-56433.html", "https://linux.oracle.com/errata/ELSA-2025-20559-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-56433", "https://www.cve.org/CVERecord?id=CVE-2024-56433" ], "PublishedDate": "2024-12-26T09:15:07.267Z", "LastModifiedDate": "2026-06-17T08:12:10.903Z" }, { "VulnerabilityID": "TEMP-0628843-DBAD28", "PkgID": "passwd@1:4.13+dfsg1-1+deb12u2", "PkgName": "passwd", "PkgIdentifier": { "PURL": "pkg:deb/debian/passwd@4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "8c2b119c05698e6a" }, "InstalledVersion": "1:4.13+dfsg1-1+deb12u2", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0628843-DBAD28", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a2de66d45c25b9fd6c52395e01aee96827d93312876054c01b1dda12a1575123", "Title": "[more related to CVE-2005-4890]", "Severity": "LOW", "VendorSeverity": { "debian": 1 } }, { "VulnerabilityID": "CVE-2026-13221", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b7a429fb3668d46414c619d7ea235893699de9cdc0775bca6b9492042c1b996a", "Title": "Perl versions through 5.43.9 produce silently incorrect regular expres ...", "Description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "azure": 2, "nvd": 4 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-07-14T18:15:18.85Z" }, { "VulnerabilityID": "CVE-2026-42496", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:4b5e4afa6ac5aa7c096ecde5f83b1c5013f73d20760c8bc525ec341145cc52df", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-57433", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ca38b6feea8d7916c469bd26e03d75274c6e19f37966bb736c41888ea8291069", "Title": "Storable versions before 3.41 for Perl have a signed integer overflow ...", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "azure": 4 }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-07-14T17:47:20.473Z" }, { "VulnerabilityID": "CVE-2026-8376", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d7fba09fe62b1a1fd7e65db95d58ca4e04a82e3eea371bb8e2fee890536f60c0", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-42497", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bf6412ced42935f0c24be1b6bc4adb42804deca0bc86a88d9c43221a6dac2b57", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d5df99bb0cef1f618f29980c444f43709a3ea57c730dea29d37a7ee9be86b9f5", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57432", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:282e9bd5b07b8590eb8503a12a06935e65b4b87c15779694029c8b996b650977", "Title": "Perl versions through 5.43.10 have an integer overflow in S_measure_st ...", "Description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "azure": 3, "nvd": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-07-14T18:04:48.367Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6935bc220cb690b36c8f67a49a915987fac9905208b7ba4dee8016a012ce280b", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2025-15649", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-15649", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:64600cd426e1dd60d7fa8137431cd74b631ade20a0d038ce214a4d05ecbfa4aa", "Title": "perl-IO-Compress: perl-IO-Compress: Denial of Service via malformed DOS date in zip header", "Description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.\n\n_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.\n\nThe exception propagates out of IO::Uncompress::Unzip-\u003enew($file) where callers expect undef plus $UnzipError.", "Severity": "MEDIUM", "CweIDs": [ "CWE-248" ], "VendorSeverity": { "azure": 2, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/1", "https://access.redhat.com/security/cve/CVE-2025-15649", "https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch", "https://github.com/pmqs/IO-Compress/issues/65", "https://metacpan.org/release/PMQS/IO-Compress-2.215/changes", "https://nvd.nist.gov/vuln/detail/CVE-2025-15649", "https://www.cve.org/CVERecord?id=CVE-2025-15649" ], "PublishedDate": "2026-05-27T04:16:23.873Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-12087", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12087", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ac2b2e791776d4bc9f5df92f8a2dd8f62e7f13d7806909a62ee587f6072c20ac", "Title": "perl-Socket: perl-Socket: Information Disclosure due to Out-of-Bounds Read", "Description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "Severity": "MEDIUM", "CweIDs": [ "CWE-125", "CWE-805" ], "VendorSeverity": { "azure": 3, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/06/15/10", "https://access.redhat.com/security/cve/CVE-2026-12087", "https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch", "https://metacpan.org/release/PEVANS/Socket-2.041/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-12087", "https://www.cve.org/CVERecord?id=CVE-2026-12087" ], "PublishedDate": "2026-06-15T22:16:16.197Z", "LastModifiedDate": "2026-06-17T10:14:37.383Z" }, { "VulnerabilityID": "CVE-2026-48959", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48959", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:94cea119f465512ae526d426dfc958f00fa9012fedba26f99aa166f333de3de3", "Title": "perl-IO-Compress: perl-IO-Compress: CPU exhaustion via per-byte read loop in fastForward", "Description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip-\u003enew($zip, Name =\u003e $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "Severity": "MEDIUM", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "amazon": 3, "azure": 3, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/2", "https://access.redhat.com/security/cve/CVE-2026-48959", "https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48959", "https://www.cve.org/CVERecord?id=CVE-2026-48959" ], "PublishedDate": "2026-05-27T04:16:31.093Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-48961", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48961", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aff74dd7258b2ccfb8b9408eeead53d1ab83c05d2cac706ad8e969ae37d4975e", "Title": "perl-IO-Compress: IO::Compress: Denial of Service in zipdetails CLI tool via malformed Info-ZIP Unix Extra Field", "Description": "IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.", "Severity": "MEDIUM", "CweIDs": [ "CWE-755" ], "VendorSeverity": { "amazon": 3, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/3", "https://access.redhat.com/security/cve/CVE-2026-48961", "https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48961", "https://www.cve.org/CVERecord?id=CVE-2026-48961" ], "PublishedDate": "2026-05-27T04:16:31.21Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-7010", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-7010", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9952317a5c3a058fecbb7f9706b2624fea46d49fa69c670c2b8e9c78f20fbd6b", "Title": "HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP ...", "Description": "HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.\n\nThe unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values.\n\nAn attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.", "Severity": "MEDIUM", "CweIDs": [ "CWE-113" ], "VendorSeverity": { "amazon": 2 }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/11/17", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/d73c7651e82ace02693842df55928b6c3ae7c38d.patch", "https://metacpan.org/release/HAARG/HTTP-Tiny-0.093-TRIAL/changes" ], "PublishedDate": "2026-05-11T22:22:14.75Z", "LastModifiedDate": "2026-06-17T11:01:37.993Z" }, { "VulnerabilityID": "CVE-2011-4116", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-4116", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:82de7d1686f25e10222845ac7d393d2357fb0341affde76e6a00b32b31ad00e9", "Title": "perl: File:: Temp insecure temporary file handling", "Description": "_is_safe in the File::Temp module for Perl does not properly handle symlinks.", "Severity": "LOW", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "debian": 1, "nvd": 1, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:M/Au:S/C:N/I:P/A:N", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "V2Score": 1.5, "V3Score": 3.3 }, "redhat": { "V2Vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "V2Score": 1.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2011/11/04/2", "http://www.openwall.com/lists/oss-security/2011/11/04/4", "https://access.redhat.com/security/cve/CVE-2011-4116", "https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14", "https://nvd.nist.gov/vuln/detail/CVE-2011-4116", "https://rt.cpan.org/Public/Bug/Display.html?id=69106", "https://seclists.org/oss-sec/2011/q4/238", "https://www.cve.org/CVERecord?id=CVE-2011-4116" ], "PublishedDate": "2020-01-31T18:15:11.343Z", "LastModifiedDate": "2025-08-04T19:04:38.29Z" }, { "VulnerabilityID": "CVE-2023-31486", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31486", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7eff94c17227100fc7aaa51901ae259e6f79881e638f6623ca68617839cf5480", "Title": "http-tiny: perl: insecure TLS cert default", "Description": "HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.", "Severity": "LOW", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 2, "amazon": 3, "cbl-mariner": 3, "debian": 1, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2023/04/29/1", "http://www.openwall.com/lists/oss-security/2023/05/03/3", "http://www.openwall.com/lists/oss-security/2023/05/03/5", "http://www.openwall.com/lists/oss-security/2023/05/07/2", "https://access.redhat.com/errata/RHSA-2023:6542", "https://access.redhat.com/security/cve/CVE-2023-31486", "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/", "https://bugzilla.redhat.com/2228392", "https://errata.almalinux.org/9/ALSA-2023-6542.html", "https://github.com/chansen/p5-http-tiny/pull/153", "https://hackeriet.github.io/cpan-http-tiny-overview/", "https://linux.oracle.com/cve/CVE-2023-31486.html", "https://linux.oracle.com/errata/ELSA-2023-7174.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-31486", "https://security.netapp.com/advisory/ntap-20241129-0011/", "https://www.cve.org/CVERecord?id=CVE-2023-31486", "https://www.openwall.com/lists/oss-security/2023/04/18/14", "https://www.openwall.com/lists/oss-security/2023/05/03/4", "https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/" ], "PublishedDate": "2023-04-29T00:15:09.083Z", "LastModifiedDate": "2026-06-17T05:57:05.473Z" }, { "VulnerabilityID": "CVE-2026-7017", "PkgID": "perl@5.36.0-7+deb12u3", "PkgName": "perl", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "48e79b4c12ff5fac" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-7017", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aea7f29d223971ef304a74485a5051bc83c63c75706da54de47d0b7bb6fbb525", "Title": "HTTP::Tiny versions before 0.095 for Perl forward credential headers t ...", "Description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-522" ], "References": [ "http://www.openwall.com/lists/oss-security/2026/07/07/13", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36", "https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes" ], "PublishedDate": "2026-07-07T19:16:55.53Z", "LastModifiedDate": "2026-07-08T15:56:29.29Z" }, { "VulnerabilityID": "CVE-2026-13221", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:189f7ba41412ed015ac8ffd8cf6510d4e165bd72550f82e6741ec4c196220643", "Title": "Perl versions through 5.43.9 produce silently incorrect regular expres ...", "Description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "azure": 2, "nvd": 4 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-07-14T18:15:18.85Z" }, { "VulnerabilityID": "CVE-2026-42496", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d39048c7e973d1157cecdb4f960bbd8ce23be3056309edf8b2fc197e086296c7", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-57433", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:42f729ba403420b5c11749ea18905d4d98757d67338156a0dde86379309bb525", "Title": "Storable versions before 3.41 for Perl have a signed integer overflow ...", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "azure": 4 }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-07-14T17:47:20.473Z" }, { "VulnerabilityID": "CVE-2026-8376", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:e2391360d73a8b2a5db8869d2b3bd4f85fa543494f7fee4a8338b5f3e0326d04", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-42497", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b61c0377b26d0fb66c0e82ef24044f5d9b0540f7581440403da85e45628addfb", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:05d44f64e0f30075eb664890065c34a56dde404609d2ed80e35707d2f420a44a", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57432", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:76b345d9c64d234d59ac738753c05a8a0a9092b07e98af7ef305bb8323fa2b30", "Title": "Perl versions through 5.43.10 have an integer overflow in S_measure_st ...", "Description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "azure": 3, "nvd": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-07-14T18:04:48.367Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aca2a1016e5c95a3417526d6117eed979824a3a4a98ab2638107f45d476d7d44", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2025-15649", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-15649", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b5a4b27ca573b4ce58473ac09b8c0dc6a55b3ec5503cde2e5784cc2670982b19", "Title": "perl-IO-Compress: perl-IO-Compress: Denial of Service via malformed DOS date in zip header", "Description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.\n\n_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.\n\nThe exception propagates out of IO::Uncompress::Unzip-\u003enew($file) where callers expect undef plus $UnzipError.", "Severity": "MEDIUM", "CweIDs": [ "CWE-248" ], "VendorSeverity": { "azure": 2, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/1", "https://access.redhat.com/security/cve/CVE-2025-15649", "https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch", "https://github.com/pmqs/IO-Compress/issues/65", "https://metacpan.org/release/PMQS/IO-Compress-2.215/changes", "https://nvd.nist.gov/vuln/detail/CVE-2025-15649", "https://www.cve.org/CVERecord?id=CVE-2025-15649" ], "PublishedDate": "2026-05-27T04:16:23.873Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-12087", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12087", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d1c23356bde43d21b1f796f1abe037e20f9e135c84a7dd91bd6cd625cffc279c", "Title": "perl-Socket: perl-Socket: Information Disclosure due to Out-of-Bounds Read", "Description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "Severity": "MEDIUM", "CweIDs": [ "CWE-125", "CWE-805" ], "VendorSeverity": { "azure": 3, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/06/15/10", "https://access.redhat.com/security/cve/CVE-2026-12087", "https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch", "https://metacpan.org/release/PEVANS/Socket-2.041/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-12087", "https://www.cve.org/CVERecord?id=CVE-2026-12087" ], "PublishedDate": "2026-06-15T22:16:16.197Z", "LastModifiedDate": "2026-06-17T10:14:37.383Z" }, { "VulnerabilityID": "CVE-2026-48959", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48959", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a93d6cdb4de52c37ab55f1703bcbac69406e1e41b0903aba081293ca3ee8d681", "Title": "perl-IO-Compress: perl-IO-Compress: CPU exhaustion via per-byte read loop in fastForward", "Description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip-\u003enew($zip, Name =\u003e $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "Severity": "MEDIUM", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "amazon": 3, "azure": 3, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/2", "https://access.redhat.com/security/cve/CVE-2026-48959", "https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48959", "https://www.cve.org/CVERecord?id=CVE-2026-48959" ], "PublishedDate": "2026-05-27T04:16:31.093Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-48961", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48961", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:c16164179904fec55d9cd3031ff691899555efd03787816d972505590bf2f708", "Title": "perl-IO-Compress: IO::Compress: Denial of Service in zipdetails CLI tool via malformed Info-ZIP Unix Extra Field", "Description": "IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.", "Severity": "MEDIUM", "CweIDs": [ "CWE-755" ], "VendorSeverity": { "amazon": 3, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/3", "https://access.redhat.com/security/cve/CVE-2026-48961", "https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48961", "https://www.cve.org/CVERecord?id=CVE-2026-48961" ], "PublishedDate": "2026-05-27T04:16:31.21Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-7010", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-7010", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b1e7c449a1cacafea90648664073b4a552f8902d6d07307ba4cf3bef9a685808", "Title": "HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP ...", "Description": "HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.\n\nThe unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values.\n\nAn attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.", "Severity": "MEDIUM", "CweIDs": [ "CWE-113" ], "VendorSeverity": { "amazon": 2 }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/11/17", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/d73c7651e82ace02693842df55928b6c3ae7c38d.patch", "https://metacpan.org/release/HAARG/HTTP-Tiny-0.093-TRIAL/changes" ], "PublishedDate": "2026-05-11T22:22:14.75Z", "LastModifiedDate": "2026-06-17T11:01:37.993Z" }, { "VulnerabilityID": "CVE-2011-4116", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-4116", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ddf94dcec33ff3d55c445675cad7d24f2a0d1a1563045c225d42cf11badd634c", "Title": "perl: File:: Temp insecure temporary file handling", "Description": "_is_safe in the File::Temp module for Perl does not properly handle symlinks.", "Severity": "LOW", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "debian": 1, "nvd": 1, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:M/Au:S/C:N/I:P/A:N", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "V2Score": 1.5, "V3Score": 3.3 }, "redhat": { "V2Vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "V2Score": 1.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2011/11/04/2", "http://www.openwall.com/lists/oss-security/2011/11/04/4", "https://access.redhat.com/security/cve/CVE-2011-4116", "https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14", "https://nvd.nist.gov/vuln/detail/CVE-2011-4116", "https://rt.cpan.org/Public/Bug/Display.html?id=69106", "https://seclists.org/oss-sec/2011/q4/238", "https://www.cve.org/CVERecord?id=CVE-2011-4116" ], "PublishedDate": "2020-01-31T18:15:11.343Z", "LastModifiedDate": "2025-08-04T19:04:38.29Z" }, { "VulnerabilityID": "CVE-2023-31486", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31486", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:6002afaa4113e0e82c20e5eccb4df2496cbdfbbd9464c19823b39ea4f2a9a923", "Title": "http-tiny: perl: insecure TLS cert default", "Description": "HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.", "Severity": "LOW", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 2, "amazon": 3, "cbl-mariner": 3, "debian": 1, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2023/04/29/1", "http://www.openwall.com/lists/oss-security/2023/05/03/3", "http://www.openwall.com/lists/oss-security/2023/05/03/5", "http://www.openwall.com/lists/oss-security/2023/05/07/2", "https://access.redhat.com/errata/RHSA-2023:6542", "https://access.redhat.com/security/cve/CVE-2023-31486", "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/", "https://bugzilla.redhat.com/2228392", "https://errata.almalinux.org/9/ALSA-2023-6542.html", "https://github.com/chansen/p5-http-tiny/pull/153", "https://hackeriet.github.io/cpan-http-tiny-overview/", "https://linux.oracle.com/cve/CVE-2023-31486.html", "https://linux.oracle.com/errata/ELSA-2023-7174.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-31486", "https://security.netapp.com/advisory/ntap-20241129-0011/", "https://www.cve.org/CVERecord?id=CVE-2023-31486", "https://www.openwall.com/lists/oss-security/2023/04/18/14", "https://www.openwall.com/lists/oss-security/2023/05/03/4", "https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/" ], "PublishedDate": "2023-04-29T00:15:09.083Z", "LastModifiedDate": "2026-06-17T05:57:05.473Z" }, { "VulnerabilityID": "CVE-2026-7017", "PkgID": "perl-base@5.36.0-7+deb12u3", "PkgName": "perl-base", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "4d96814618e564ec" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-7017", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:cade47df2174bb41a264ed3b4a4f4187b4fca383daa0e34508a0333d2f0dfc3c", "Title": "HTTP::Tiny versions before 0.095 for Perl forward credential headers t ...", "Description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-522" ], "References": [ "http://www.openwall.com/lists/oss-security/2026/07/07/13", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36", "https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes" ], "PublishedDate": "2026-07-07T19:16:55.53Z", "LastModifiedDate": "2026-07-08T15:56:29.29Z" }, { "VulnerabilityID": "CVE-2026-13221", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13221", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0644eea748d6d31013dcc8a53ca63aedea374bd36ca7ad8965a5e40c3a53b7b9", "Title": "Perl versions through 5.43.9 produce silently incorrect regular expres ...", "Description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "azure": 2, "nvd": 4 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 9.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/5", "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "https://github.com/Perl/perl5/issues/23388", "https://nvd.nist.gov/vuln/detail/CVE-2026-13221" ], "PublishedDate": "2026-07-13T17:16:48.923Z", "LastModifiedDate": "2026-07-14T18:15:18.85Z" }, { "VulnerabilityID": "CVE-2026-42496", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42496", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:b2acdc6c09ff737f21ac31c9e56f0c885a9bb841fabfd4308a532811a9ea40b0", "Title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "Description": "Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.", "Severity": "CRITICAL", "CweIDs": [ "CWE-59", "CWE-22" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30852", "https://access.redhat.com/errata/RHSA-2026:30856", "https://access.redhat.com/errata/RHSA-2026:30857", "https://access.redhat.com/security/cve/CVE-2026-42496", "https://bugzilla.redhat.com/2481314", "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "https://errata.almalinux.org/9/ALSA-2026-30856.html", "https://errata.rockylinux.org/RLSA-2026:30856", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://linux.oracle.com/cve/CVE-2026-42496.html", "https://linux.oracle.com/errata/ELSA-2026-30857.html", "https://lists.security.metacpan.org/cve-announce/msg/40396459/", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.13Z", "LastModifiedDate": "2026-07-24T10:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-57433", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57433", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9edb582994a7c4be32693e1a213f8bb76e9f9a7706d73debec0d4443366c15f0", "Title": "Storable versions before 3.41 for Perl have a signed integer overflow ...", "Description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "azure": 4 }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/7", "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "https://nvd.nist.gov/vuln/detail/CVE-2026-57433" ], "PublishedDate": "2026-07-13T17:17:55.783Z", "LastModifiedDate": "2026-07-14T17:47:20.473Z" }, { "VulnerabilityID": "CVE-2026-8376", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8376", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2cd9bc2930c95ab7fb889fa81665458960ef5a98884554cff2c6e6f89b76a3a4", "Title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "Description": "Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.", "Severity": "CRITICAL", "CweIDs": [ "CWE-680" ], "VendorSeverity": { "amazon": 2, "azure": 2, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 5.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/1", "https://access.redhat.com/security/cve/CVE-2026-8376", "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "https://github.com/Perl/perl5/pull/24433", "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "https://ubuntu.com/security/notices/USN-8467-1", "https://www.cve.org/CVERecord?id=CVE-2026-8376" ], "PublishedDate": "2026-05-26T00:16:57.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-42497", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42497", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d572be429eda9a3eed33c1d3ee99a444e979cfee6cc5a3aeb6be525c189720ec", "Title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction", "Description": "Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.", "Severity": "HIGH", "CweIDs": [ "CWE-59", "CWE-732" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42497", "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "https://www.cve.org/CVERecord?id=CVE-2026-42496", "https://www.cve.org/CVERecord?id=CVE-2026-42497" ], "PublishedDate": "2026-05-26T02:16:40.25Z", "LastModifiedDate": "2026-07-24T11:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-48962", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48962", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:a91fe16284e8384ddf5a3cfd1e5f33f636c6628461ff6edcfb05a562b7a20452", "Title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "Description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.", "Severity": "HIGH", "CweIDs": [ "CWE-95", "CWE-94" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/4", "https://access.redhat.com/errata/RHSA-2026:29182", "https://access.redhat.com/errata/RHSA-2026:29210", "https://access.redhat.com/errata/RHSA-2026:29867", "https://access.redhat.com/errata/RHSA-2026:29941", "https://access.redhat.com/errata/RHSA-2026:30085", "https://access.redhat.com/errata/RHSA-2026:30086", "https://access.redhat.com/errata/RHSA-2026:30115", "https://access.redhat.com/errata/RHSA-2026:30843", "https://access.redhat.com/errata/RHSA-2026:30851", "https://access.redhat.com/errata/RHSA-2026:30858", "https://access.redhat.com/errata/RHSA-2026:30859", "https://access.redhat.com/errata/RHSA-2026:30860", "https://access.redhat.com/security/cve/CVE-2026-48962", "https://bugzilla.redhat.com/2481767", "https://bugzilla.redhat.com/show_bug.cgi?id=2481767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962", "https://errata.almalinux.org/9/ALSA-2026-30859.html", "https://errata.rockylinux.org/RLSA-2026:30859", "https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch", "https://linux.oracle.com/cve/CVE-2026-48962.html", "https://linux.oracle.com/errata/ELSA-2026-30860.html", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json", "https://www.cve.org/CVERecord?id=CVE-2026-48962" ], "PublishedDate": "2026-05-27T04:16:31.333Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-57432", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-57432", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:3b06dcfcd89d6cd8d54037391a25dbffb48781d7244e7700bbc181e8df1dd148", "Title": "Perl versions through 5.43.10 have an integer overflow in S_measure_st ...", "Description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "azure": 3, "nvd": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/13/6", "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "https://nvd.nist.gov/vuln/detail/CVE-2026-57432" ], "PublishedDate": "2026-07-13T17:17:55.67Z", "LastModifiedDate": "2026-07-14T18:04:48.367Z" }, { "VulnerabilityID": "CVE-2026-9538", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "fix_deferred", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9538", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dda5d6877018d04b2d1f400d2ed1704cc0d41695b354a6248c0a6cb39c02561b", "Title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "Description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "amazon": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/26/4", "https://access.redhat.com/security/cve/CVE-2026-9538", "https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch", "https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "https://www.cve.org/CVERecord?id=CVE-2026-9538" ], "PublishedDate": "2026-05-26T02:16:41.15Z", "LastModifiedDate": "2026-07-23T11:10:00.12Z" }, { "VulnerabilityID": "CVE-2025-15649", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-15649", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:57f7d85abe4809638e9012ccc5c7d6a6ea0513b8d5fb068f794a98d7bd5e9f6b", "Title": "perl-IO-Compress: perl-IO-Compress: Denial of Service via malformed DOS date in zip header", "Description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.\n\n_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.\n\nThe exception propagates out of IO::Uncompress::Unzip-\u003enew($file) where callers expect undef plus $UnzipError.", "Severity": "MEDIUM", "CweIDs": [ "CWE-248" ], "VendorSeverity": { "azure": 2, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/1", "https://access.redhat.com/security/cve/CVE-2025-15649", "https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch", "https://github.com/pmqs/IO-Compress/issues/65", "https://metacpan.org/release/PMQS/IO-Compress-2.215/changes", "https://nvd.nist.gov/vuln/detail/CVE-2025-15649", "https://www.cve.org/CVERecord?id=CVE-2025-15649" ], "PublishedDate": "2026-05-27T04:16:23.873Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-12087", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12087", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:37d287c3c7382bc56f2a638aa4cc94a27182bc94e0b21fec41455d9bfdfa65c8", "Title": "perl-Socket: perl-Socket: Information Disclosure due to Out-of-Bounds Read", "Description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "Severity": "MEDIUM", "CweIDs": [ "CWE-125", "CWE-805" ], "VendorSeverity": { "azure": 3, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/06/15/10", "https://access.redhat.com/security/cve/CVE-2026-12087", "https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch", "https://metacpan.org/release/PEVANS/Socket-2.041/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-12087", "https://www.cve.org/CVERecord?id=CVE-2026-12087" ], "PublishedDate": "2026-06-15T22:16:16.197Z", "LastModifiedDate": "2026-06-17T10:14:37.383Z" }, { "VulnerabilityID": "CVE-2026-48959", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48959", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:d25de2f27c6640a4caac82adf0895525715e700a21f394f9a41016f195dc76c2", "Title": "perl-IO-Compress: perl-IO-Compress: CPU exhaustion via per-byte read loop in fastForward", "Description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip-\u003enew($zip, Name =\u003e $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "Severity": "MEDIUM", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "amazon": 3, "azure": 3, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/2", "https://access.redhat.com/security/cve/CVE-2026-48959", "https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48959", "https://www.cve.org/CVERecord?id=CVE-2026-48959" ], "PublishedDate": "2026-05-27T04:16:31.093Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-48961", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48961", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:61bccadad095a403cd01cf103fd422748b28beeadc7063decfe693a9958abbb8", "Title": "perl-IO-Compress: IO::Compress: Denial of Service in zipdetails CLI tool via malformed Info-ZIP Unix Extra Field", "Description": "IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine \u0026main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.", "Severity": "MEDIUM", "CweIDs": [ "CWE-755" ], "VendorSeverity": { "amazon": 3, "redhat": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/27/3", "https://access.redhat.com/security/cve/CVE-2026-48961", "https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch", "https://metacpan.org/release/PMQS/IO-Compress-2.220/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-48961", "https://www.cve.org/CVERecord?id=CVE-2026-48961" ], "PublishedDate": "2026-05-27T04:16:31.21Z", "LastModifiedDate": "2026-07-24T12:10:00.21Z" }, { "VulnerabilityID": "CVE-2026-7010", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-7010", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:2bf532b1163a6bf59baa6836326506c8fec1a032373068af7242a0486937bfd9", "Title": "HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP ...", "Description": "HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.\n\nThe unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values.\n\nAn attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.", "Severity": "MEDIUM", "CweIDs": [ "CWE-113" ], "VendorSeverity": { "amazon": 2 }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/11/17", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/d73c7651e82ace02693842df55928b6c3ae7c38d.patch", "https://metacpan.org/release/HAARG/HTTP-Tiny-0.093-TRIAL/changes" ], "PublishedDate": "2026-05-11T22:22:14.75Z", "LastModifiedDate": "2026-06-17T11:01:37.993Z" }, { "VulnerabilityID": "CVE-2011-4116", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2011-4116", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:48a2234ea582a8b757daf53945fd99a16edead5160ebc0504f3b052c3fb5be34", "Title": "perl: File:: Temp insecure temporary file handling", "Description": "_is_safe in the File::Temp module for Perl does not properly handle symlinks.", "Severity": "LOW", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "debian": 1, "nvd": 1, "redhat": 1 }, "CVSS": { "nvd": { "V2Vector": "AV:L/AC:M/Au:S/C:N/I:P/A:N", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "V2Score": 1.5, "V3Score": 3.3 }, "redhat": { "V2Vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "V2Score": 1.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2011/11/04/2", "http://www.openwall.com/lists/oss-security/2011/11/04/4", "https://access.redhat.com/security/cve/CVE-2011-4116", "https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14", "https://nvd.nist.gov/vuln/detail/CVE-2011-4116", "https://rt.cpan.org/Public/Bug/Display.html?id=69106", "https://seclists.org/oss-sec/2011/q4/238", "https://www.cve.org/CVERecord?id=CVE-2011-4116" ], "PublishedDate": "2020-01-31T18:15:11.343Z", "LastModifiedDate": "2025-08-04T19:04:38.29Z" }, { "VulnerabilityID": "CVE-2023-31486", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-31486", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:10f42a0ba10d078471b491c20b685bed3a828894901d751c51fbe345f2147cf6", "Title": "http-tiny: perl: insecure TLS cert default", "Description": "HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.", "Severity": "LOW", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 2, "amazon": 3, "cbl-mariner": 3, "debian": 1, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2023/04/29/1", "http://www.openwall.com/lists/oss-security/2023/05/03/3", "http://www.openwall.com/lists/oss-security/2023/05/03/5", "http://www.openwall.com/lists/oss-security/2023/05/07/2", "https://access.redhat.com/errata/RHSA-2023:6542", "https://access.redhat.com/security/cve/CVE-2023-31486", "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/", "https://bugzilla.redhat.com/2228392", "https://errata.almalinux.org/9/ALSA-2023-6542.html", "https://github.com/chansen/p5-http-tiny/pull/153", "https://hackeriet.github.io/cpan-http-tiny-overview/", "https://linux.oracle.com/cve/CVE-2023-31486.html", "https://linux.oracle.com/errata/ELSA-2023-7174.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-31486", "https://security.netapp.com/advisory/ntap-20241129-0011/", "https://www.cve.org/CVERecord?id=CVE-2023-31486", "https://www.openwall.com/lists/oss-security/2023/04/18/14", "https://www.openwall.com/lists/oss-security/2023/05/03/4", "https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/" ], "PublishedDate": "2023-04-29T00:15:09.083Z", "LastModifiedDate": "2026-06-17T05:57:05.473Z" }, { "VulnerabilityID": "CVE-2026-7017", "PkgID": "perl-modules-5.36@5.36.0-7+deb12u3", "PkgName": "perl-modules-5.36", "PkgIdentifier": { "PURL": "pkg:deb/debian/perl-modules-5.36@5.36.0-7%2Bdeb12u3?arch=all\u0026distro=debian-12.15", "UID": "762f8ee6fb8d1b06" }, "InstalledVersion": "5.36.0-7+deb12u3", "Status": "affected", "Layer": { "DiffID": "sha256:84231ac74bd2ea3c696cdbb12a01846e2df0aae693aea5c89ed61d136650dfee" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-7017", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:adc11760a8fb4fb0c1fd72fdd084549935cb1e7a361c2045d624c06e7e96e613", "Title": "HTTP::Tiny versions before 0.095 for Perl forward credential headers t ...", "Description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "Severity": "UNKNOWN", "CweIDs": [ "CWE-522" ], "References": [ "http://www.openwall.com/lists/oss-security/2026/07/07/13", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch", "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36", "https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes" ], "PublishedDate": "2026-07-07T19:16:55.53Z", "LastModifiedDate": "2026-07-08T15:56:29.29Z" }, { "VulnerabilityID": "TEMP-0517018-A83CE6", "PkgID": "sysvinit-utils@3.06-4", "PkgName": "sysvinit-utils", "PkgIdentifier": { "PURL": "pkg:deb/debian/sysvinit-utils@3.06-4?arch=amd64\u0026distro=debian-12.15", "UID": "490ed47f91a0290b" }, "InstalledVersion": "3.06-4", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0517018-A83CE6", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:dc8b60aca2f2561756d63425caf3f206591b5f3a17c456687fa4b97d1c9d9217", "Title": "[sysvinit: no-root option in expert installer exposes locally exploitable security flaw]", "Severity": "LOW", "VendorSeverity": { "debian": 1 } }, { "VulnerabilityID": "CVE-2026-5704", "PkgID": "tar@1.34+dfsg-1.2+deb12u1", "PkgName": "tar", "PkgIdentifier": { "PURL": "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "1d42a4168a18e3b2" }, "InstalledVersion": "1.34+dfsg-1.2+deb12u1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5704", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:bb48b9931a80f11aae9b6599d1cceeb07649cb2644873b0c597b3421bde81211", "Title": "tar: tar: Hidden file injection via crafted archives", "Description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "Severity": "MEDIUM", "CweIDs": [ "CWE-434" ], "VendorSeverity": { "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "V3Score": 5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/11/10", "http://www.openwall.com/lists/oss-security/2026/04/11/11", "http://www.openwall.com/lists/oss-security/2026/04/12/2", "https://access.redhat.com/security/cve/CVE-2026-5704", "https://bugzilla.redhat.com/show_bug.cgi?id=2455360", "https://nvd.nist.gov/vuln/detail/CVE-2026-5704", "https://ubuntu.com/security/notices/USN-8477-1", "https://ubuntu.com/security/notices/USN-8477-2", "https://ubuntu.com/security/notices/USN-8477-3", "https://www.cve.org/CVERecord?id=CVE-2026-5704" ], "PublishedDate": "2026-04-06T16:16:42.14Z", "LastModifiedDate": "2026-06-17T10:59:31.78Z" }, { "VulnerabilityID": "CVE-2005-2541", "PkgID": "tar@1.34+dfsg-1.2+deb12u1", "PkgName": "tar", "PkgIdentifier": { "PURL": "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "1d42a4168a18e3b2" }, "InstalledVersion": "1.34+dfsg-1.2+deb12u1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2005-2541", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:374916b7ae07c84675e4774699dcb9c313ee9657f46cb91ac3fd20253dda18ab", "Title": "tar: does not properly warn the user when extracting setuid or setgid files", "Description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.", "Severity": "LOW", "VendorSeverity": { "debian": 1, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V2Vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "V2Score": 10 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://marc.info/?l=bugtraq\u0026m=112327628230258\u0026w=2", "https://access.redhat.com/security/cve/CVE-2005-2541", "https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E", "https://nvd.nist.gov/vuln/detail/CVE-2005-2541", "https://www.cve.org/CVERecord?id=CVE-2005-2541" ], "PublishedDate": "2005-08-10T04:00:00Z", "LastModifiedDate": "2026-04-16T00:27:16.627Z" }, { "VulnerabilityID": "TEMP-0290435-0B57B5", "PkgID": "tar@1.34+dfsg-1.2+deb12u1", "PkgName": "tar", "PkgIdentifier": { "PURL": "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12.15", "UID": "1d42a4168a18e3b2" }, "InstalledVersion": "1.34+dfsg-1.2+deb12u1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://security-tracker.debian.org/tracker/TEMP-0290435-0B57B5", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7ff5b3bc3b832cd27f01a76c0b4ace1eb362d84984dcd61f4a664e9b2a151f56", "Title": "[tar's rmt command may have undesired side effects]", "Severity": "LOW", "VendorSeverity": { "debian": 1 } }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "util-linux@2.38.1-5+deb12u3", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "c50a1829816b9d94" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:61d0fd90c99f5a7e4f64c0973b5ee701ee4ab51a635ed0300d49070c6d35f1d9", "Title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "Description": "Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:\nCVE-2026-53615:\n\tInteger Overflow or Wraparound in libblkid/src/partitions/dos.c\n", "Severity": "HIGH", "VendorSeverity": { "amazon": 3 } }, { "VulnerabilityID": "CVE-2026-13595", "PkgID": "util-linux@2.38.1-5+deb12u3", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "c50a1829816b9d94" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13595", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:912a47ed2d20b3e28608dff53d6ff4efffe71a97a3817fae99e69e7f8c23b0e8", "Title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "Description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26573", "https://access.redhat.com/security/cve/CVE-2026-13595", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c", "https://nvd.nist.gov/vuln/detail/CVE-2026-13595", "https://www.cve.org/CVERecord?id=CVE-2026-13595" ], "PublishedDate": "2026-06-29T09:16:28.303Z", "LastModifiedDate": "2026-07-08T03:37:21.637Z" }, { "VulnerabilityID": "CVE-2026-27456", "PkgID": "util-linux@2.38.1-5+deb12u3", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "c50a1829816b9d94" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:319b8b3332171f2b56d0c93a2d52647d03b1754a9b03b9c14fc3685fddd4970b", "Title": "util-linux: TOCTOU in the mount program when setting up loop devices", "Description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "Severity": "MEDIUM", "CweIDs": [ "CWE-59", "CWE-269", "CWE-367" ], "VendorSeverity": { "azure": 2, "bottlerocket": 2, "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://access.redhat.com/security/cve/CVE-2026-27456", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-jgcxwcxt3sxd.toml", "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g", "https://nvd.nist.gov/vuln/detail/CVE-2026-27456", "https://www.cve.org/CVERecord?id=CVE-2026-27456" ], "PublishedDate": "2026-04-03T22:16:25.4Z", "LastModifiedDate": "2026-07-24T22:10:00.14Z" }, { "VulnerabilityID": "CVE-2026-3184", "PkgID": "util-linux@2.38.1-5+deb12u3", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "c50a1829816b9d94" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-3184", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:470727f7e353bf6a825970b0039583f8b1bb88b06f65f52c10461220b808e1a6", "Title": "util-linux: util-linux: Access control bypass due to improper hostname canonicalization", "Description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "Severity": "MEDIUM", "CweIDs": [ "CWE-289" ], "VendorSeverity": { "azure": 1, "nvd": 2, "photon": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2026-3184", "https://bugzilla.redhat.com/show_bug.cgi?id=2442570", "https://nvd.nist.gov/vuln/detail/CVE-2026-3184", "https://www.cve.org/CVERecord?id=CVE-2026-3184" ], "PublishedDate": "2026-04-03T19:17:23.377Z", "LastModifiedDate": "2026-07-21T19:10:00.107Z" }, { "VulnerabilityID": "CVE-2022-0563", "PkgID": "util-linux@2.38.1-5+deb12u3", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "c50a1829816b9d94" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:9da650644f1f7f66776b3756570bf861fe77397032ca6da256f8f76c5d6c4055", "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", "Severity": "LOW", "CweIDs": [ "CWE-209" ], "VendorSeverity": { "amazon": 2, "bottlerocket": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 }, "nvd": { "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V2Score": 1.9, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0563", "https://access.redhat.com/security/cve/CVE-2022-0563", "https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-mv4q-wq4c-5xmg", "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", "https://security.gentoo.org/glsa/202401-08", "https://security.netapp.com/advisory/ntap-20220331-0002/", "https://www.cve.org/CVERecord?id=CVE-2022-0563" ], "PublishedDate": "2022-02-21T19:15:08.393Z", "LastModifiedDate": "2026-06-17T04:20:51.053Z" }, { "VulnerabilityID": "CVE-2025-14104", "PkgID": "util-linux@2.38.1-5+deb12u3", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "c50a1829816b9d94" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-14104", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:80c3b90ce79df6c879d9ae2ac5a54f75c98dfcb43248c305633ad6e2787dd850", "Title": "util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames", "Description": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1696", "https://access.redhat.com/errata/RHSA-2026:1852", "https://access.redhat.com/errata/RHSA-2026:1913", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2737", "https://access.redhat.com/errata/RHSA-2026:2800", "https://access.redhat.com/errata/RHSA-2026:3406", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2025-14104", "https://bugzilla.redhat.com/2419369", "https://bugzilla.redhat.com/show_bug.cgi?id=2419369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14104", "https://errata.almalinux.org/9/ALSA-2026-1913.html", "https://errata.rockylinux.org/RLSA-2026:1913", "https://linux.oracle.com/cve/CVE-2025-14104.html", "https://linux.oracle.com/errata/ELSA-2026-1913.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-14104", "https://www.cve.org/CVERecord?id=CVE-2025-14104" ], "PublishedDate": "2025-12-05T17:16:03.117Z", "LastModifiedDate": "2026-06-30T00:16:53.04Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "util-linux@2.38.1-5+deb12u3", "PkgName": "util-linux", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "c50a1829816b9d94" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:1ae8270bb92b19ebb3ec3deda60e7b8a24a260c302bea042a81a14e1dbf58881", "Title": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2026-53615", "PkgID": "util-linux-extra@2.38.1-5+deb12u3", "PkgName": "util-linux-extra", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ec22fa64ac4832d8" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53615", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:aea4ef375610ce5051b95bfb71aa9348d2ab1a3334988251e6da9aa0ef45f4cc", "Title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "Description": "Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:\nCVE-2026-53615:\n\tInteger Overflow or Wraparound in libblkid/src/partitions/dos.c\n", "Severity": "HIGH", "VendorSeverity": { "amazon": 3 } }, { "VulnerabilityID": "CVE-2026-13595", "PkgID": "util-linux-extra@2.38.1-5+deb12u3", "PkgName": "util-linux-extra", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ec22fa64ac4832d8" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-13595", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f71ebe0fb9a8df77a35338cad03a73bf853d352389500b76ba575e4411c34e17", "Title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "Description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "Severity": "MEDIUM", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "azure": 2, "nvd": 2, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26573", "https://access.redhat.com/security/cve/CVE-2026-13595", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c", "https://nvd.nist.gov/vuln/detail/CVE-2026-13595", "https://www.cve.org/CVERecord?id=CVE-2026-13595" ], "PublishedDate": "2026-06-29T09:16:28.303Z", "LastModifiedDate": "2026-07-08T03:37:21.637Z" }, { "VulnerabilityID": "CVE-2026-27456", "PkgID": "util-linux-extra@2.38.1-5+deb12u3", "PkgName": "util-linux-extra", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ec22fa64ac4832d8" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27456", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:7d601cb43ef26b5048c42ad615c65d740e1e3f84b0e63ceb7a6535293d01b7d8", "Title": "util-linux: TOCTOU in the mount program when setting up loop devices", "Description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "Severity": "MEDIUM", "CweIDs": [ "CWE-59", "CWE-269", "CWE-367" ], "VendorSeverity": { "azure": 2, "bottlerocket": 2, "julia": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 4.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://access.redhat.com/security/cve/CVE-2026-27456", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-jgcxwcxt3sxd.toml", "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g", "https://nvd.nist.gov/vuln/detail/CVE-2026-27456", "https://www.cve.org/CVERecord?id=CVE-2026-27456" ], "PublishedDate": "2026-04-03T22:16:25.4Z", "LastModifiedDate": "2026-07-24T22:10:00.14Z" }, { "VulnerabilityID": "CVE-2026-3184", "PkgID": "util-linux-extra@2.38.1-5+deb12u3", "PkgName": "util-linux-extra", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ec22fa64ac4832d8" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-3184", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:481a97180ee30da3b38e83d1ca6ae0c1b159e34404729f21fe863fab1170de03", "Title": "util-linux: util-linux: Access control bypass due to improper hostname canonicalization", "Description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "Severity": "MEDIUM", "CweIDs": [ "CWE-289" ], "VendorSeverity": { "azure": 1, "nvd": 2, "photon": 2, "redhat": 1, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2026-3184", "https://bugzilla.redhat.com/show_bug.cgi?id=2442570", "https://nvd.nist.gov/vuln/detail/CVE-2026-3184", "https://www.cve.org/CVERecord?id=CVE-2026-3184" ], "PublishedDate": "2026-04-03T19:17:23.377Z", "LastModifiedDate": "2026-07-21T19:10:00.107Z" }, { "VulnerabilityID": "CVE-2022-0563", "PkgID": "util-linux-extra@2.38.1-5+deb12u3", "PkgName": "util-linux-extra", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ec22fa64ac4832d8" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-0563", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:f848f6b655b1c2ec374da9ded104d5b02c1b9619e5aaa1f36fc22bf3a38bfbab", "Title": "util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline", "Description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", "Severity": "LOW", "CweIDs": [ "CWE-209" ], "VendorSeverity": { "amazon": 2, "bottlerocket": 2, "cbl-mariner": 2, "debian": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 }, "nvd": { "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V2Score": 1.9, "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0563", "https://access.redhat.com/security/cve/CVE-2022-0563", "https://blog.trailofbits.com/2023/02/16/suid-logic-bug-linux-readline/", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-mv4q-wq4c-5xmg", "https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u", "https://nvd.nist.gov/vuln/detail/CVE-2022-0563", "https://security.gentoo.org/glsa/202401-08", "https://security.netapp.com/advisory/ntap-20220331-0002/", "https://www.cve.org/CVERecord?id=CVE-2022-0563" ], "PublishedDate": "2022-02-21T19:15:08.393Z", "LastModifiedDate": "2026-06-17T04:20:51.053Z" }, { "VulnerabilityID": "CVE-2025-14104", "PkgID": "util-linux-extra@2.38.1-5+deb12u3", "PkgName": "util-linux-extra", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ec22fa64ac4832d8" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "debian", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-14104", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:ef190578e5ee5eff83d24c7a5c9ad3ff167cb0adf66ad7a4560a743dc2774f1c", "Title": "util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames", "Description": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.", "Severity": "LOW", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "azure": 2, "cbl-mariner": 2, "debian": 1, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1696", "https://access.redhat.com/errata/RHSA-2026:1852", "https://access.redhat.com/errata/RHSA-2026:1913", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2737", "https://access.redhat.com/errata/RHSA-2026:2800", "https://access.redhat.com/errata/RHSA-2026:3406", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2025-14104", "https://bugzilla.redhat.com/2419369", "https://bugzilla.redhat.com/show_bug.cgi?id=2419369", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14104", "https://errata.almalinux.org/9/ALSA-2026-1913.html", "https://errata.rockylinux.org/RLSA-2026:1913", "https://linux.oracle.com/cve/CVE-2025-14104.html", "https://linux.oracle.com/errata/ELSA-2026-1913.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-14104", "https://www.cve.org/CVERecord?id=CVE-2025-14104" ], "PublishedDate": "2025-12-05T17:16:03.117Z", "LastModifiedDate": "2026-06-30T00:16:53.04Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "util-linux-extra@2.38.1-5+deb12u3", "PkgName": "util-linux-extra", "PkgIdentifier": { "PURL": "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12.15", "UID": "ec22fa64ac4832d8" }, "InstalledVersion": "2.38.1-5+deb12u3", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:02caf32b3312f37d7b0236b9b3bcb19d7c14bd20b2c6141b9be05f7588ae089a", "Title": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "Severity": "UNKNOWN" }, { "VulnerabilityID": "CVE-2023-45853", "PkgID": "zlib1g@1:1.2.13.dfsg-1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.2.13.dfsg-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "c3a50d0cd388a7b8" }, "InstalledVersion": "1:1.2.13.dfsg-1", "Status": "will_not_fix", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45853", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:af006505134f298de6c58e7ccd5ba6310eda40e349c7c92f337a65b1cf706525", "Title": "zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6", "Description": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.", "Severity": "CRITICAL", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "cbl-mariner": 4, "ghsa": 4, "julia": 4, "nvd": 4, "photon": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "V3Score": 5.3 } }, "References": [ "http://www.openwall.com/lists/oss-security/2023/10/20/9", "http://www.openwall.com/lists/oss-security/2024/01/24/10", "https://access.redhat.com/security/cve/CVE-2023-45853", "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "https://cert-portal.siemens.com/productcert/html/ssa-470355.html", "https://cert-portal.siemens.com/productcert/html/ssa-769027.html", "https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356", "https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61", "https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4", "https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c", "https://github.com/madler/zlib/pull/843", "https://github.com/smihica/pyminizip", "https://github.com/smihica/pyminizip/blob/master/zlib-1.2.11/contrib/minizip/zip.c", "https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-45853", "https://pypi.org/project/pyminizip/#history", "https://security.gentoo.org/glsa/202401-18", "https://security.netapp.com/advisory/ntap-20231130-0009", "https://security.netapp.com/advisory/ntap-20231130-0009/", "https://ubuntu.com/security/notices/USN-7107-1", "https://www.cve.org/CVERecord?id=CVE-2023-45853", "https://www.winimage.com/zLibDll/minizip.html" ], "PublishedDate": "2023-10-14T02:15:09.323Z", "LastModifiedDate": "2026-07-14T13:17:02.983Z" }, { "VulnerabilityID": "CVE-2026-27171", "PkgID": "zlib1g@1:1.2.13.dfsg-1", "PkgName": "zlib1g", "PkgIdentifier": { "PURL": "pkg:deb/debian/zlib1g@1.2.13.dfsg-1?arch=amd64\u0026distro=debian-12.15\u0026epoch=1", "UID": "c3a50d0cd388a7b8" }, "InstalledVersion": "1:1.2.13.dfsg-1", "Status": "affected", "Layer": { "Digest": "sha256:597c6c618d36213af657a6a8444a5d87801f9a219682b206ad21ccb8f3e57bbd", "DiffID": "sha256:81f823b9617547261c907396f63f770deaa554748ff739bedfa650e3bb74595a" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27171", "DataSource": { "ID": "debian", "Name": "Debian Security Tracker", "URL": "https://salsa.debian.org/security-tracker-team/security-tracker" }, "Fingerprint": "sha256:0647ad9406ba435532672ce5ddb3f7bf5447ff12be13abac5705570c0f983ee6", "Title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "Description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "Severity": "MEDIUM", "CweIDs": [ "CWE-1284" ], "VendorSeverity": { "amazon": 1, "azure": 1, "cbl-mariner": 1, "julia": 2, "nvd": 2, "photon": 2, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.3 } }, "References": [ "https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit", "https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/", "https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf", "https://access.redhat.com/security/cve/CVE-2026-27171", "https://github.com/advisories/GHSA-h858-mf2m-8jf4", "https://github.com/madler/zlib/issues/904", "https://github.com/madler/zlib/releases/tag/v1.3.2", "https://nvd.nist.gov/vuln/detail/CVE-2026-27171", "https://ostif.org/zlib-audit-complete", "https://ostif.org/zlib-audit-complete/", "https://www.cve.org/CVERecord?id=CVE-2026-27171" ], "PublishedDate": "2026-02-18T04:16:01.263Z", "LastModifiedDate": "2026-06-17T10:26:47.357Z" } ] }, { "Target": "Node.js", "Class": "lang-pkgs", "Type": "node-pkg", "Packages": [ { "ID": "@img/colour@1.1.0", "Name": "@img/colour", "Identifier": { "PURL": "pkg:npm/%40img/colour@1.1.0", "UID": "6d95c7c6db37e311" }, "Version": "1.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/@img/colour/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@img/sharp-libvips-linux-x64@1.3.2", "Name": "@img/sharp-libvips-linux-x64", "Identifier": { "PURL": "pkg:npm/%40img/sharp-libvips-linux-x64@1.3.2", "UID": "1872af2a2a8fd906" }, "Version": "1.3.2", "Licenses": [ "LGPL-3.0-or-later" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/@img/sharp-libvips-linux-x64/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@img/sharp-libvips-linuxmusl-x64@1.3.2", "Name": "@img/sharp-libvips-linuxmusl-x64", "Identifier": { "PURL": "pkg:npm/%40img/sharp-libvips-linuxmusl-x64@1.3.2", "UID": "cc4252414e4dd1a6" }, "Version": "1.3.2", "Licenses": [ "LGPL-3.0-or-later" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/@img/sharp-libvips-linuxmusl-x64/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@img/sharp-linux-x64@0.35.3", "Name": "@img/sharp-linux-x64", "Identifier": { "PURL": "pkg:npm/%40img/sharp-linux-x64@0.35.3", "UID": "a5ac96a01ac2f7f7" }, "Version": "0.35.3", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/@img/sharp-linux-x64/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@img/sharp-linuxmusl-x64@0.35.3", "Name": "@img/sharp-linuxmusl-x64", "Identifier": { "PURL": "pkg:npm/%40img/sharp-linuxmusl-x64@0.35.3", "UID": "f8ea8b7e5ce78a5e" }, "Version": "0.35.3", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/@img/sharp-linuxmusl-x64/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@leichtgewicht/ip-codec@2.0.5", "Name": "@leichtgewicht/ip-codec", "Identifier": { "PURL": "pkg:npm/%40leichtgewicht/ip-codec@2.0.5", "UID": "3d92f6d1bfede559" }, "Version": "2.0.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/@leichtgewicht/ip-codec/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "accepts@1.3.8", "Name": "accepts", "Identifier": { "PURL": "pkg:npm/accepts@1.3.8", "UID": "ae1abfe19782c4e" }, "Version": "1.3.8", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/accepts/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "array-flatten@1.1.1", "Name": "array-flatten", "Identifier": { "PURL": "pkg:npm/array-flatten@1.1.1", "UID": "99005f86dd629de0" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/array-flatten/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "body-parser@1.20.6", "Name": "body-parser", "Identifier": { "PURL": "pkg:npm/body-parser@1.20.6", "UID": "61a842f3de0560d9" }, "Version": "1.20.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/body-parser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "bonjour-service@1.4.3", "Name": "bonjour-service", "Identifier": { "PURL": "pkg:npm/bonjour-service@1.4.3", "UID": "adce5e15dcf80794" }, "Version": "1.4.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/bonjour-service/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "bytes@3.1.2", "Name": "bytes", "Identifier": { "PURL": "pkg:npm/bytes@3.1.2", "UID": "c529683a611bfec9" }, "Version": "3.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/bytes/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "call-bind-apply-helpers@1.0.2", "Name": "call-bind-apply-helpers", "Identifier": { "PURL": "pkg:npm/call-bind-apply-helpers@1.0.2", "UID": "3ed05679f533f3d9" }, "Version": "1.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/call-bind-apply-helpers/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "call-bound@1.0.4", "Name": "call-bound", "Identifier": { "PURL": "pkg:npm/call-bound@1.0.4", "UID": "fc37499831bf353b" }, "Version": "1.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/call-bound/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "compressible@2.0.18", "Name": "compressible", "Identifier": { "PURL": "pkg:npm/compressible@2.0.18", "UID": "7a22abf302f661fa" }, "Version": "2.0.18", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/compressible/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "compression@1.8.1", "Name": "compression", "Identifier": { "PURL": "pkg:npm/compression@1.8.1", "UID": "a99f7347e7f3ece6" }, "Version": "1.8.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/compression/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "content-disposition@0.5.4", "Name": "content-disposition", "Identifier": { "PURL": "pkg:npm/content-disposition@0.5.4", "UID": "2fd3acf3ee1d18e" }, "Version": "0.5.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/content-disposition/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "content-type@1.0.5", "Name": "content-type", "Identifier": { "PURL": "pkg:npm/content-type@1.0.5", "UID": "d1694da015b2043a" }, "Version": "1.0.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/content-type/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cookie@0.7.2", "Name": "cookie", "Identifier": { "PURL": "pkg:npm/cookie@0.7.2", "UID": "aa583ca752683e1e" }, "Version": "0.7.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/cookie/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "cookie-signature@1.0.7", "Name": "cookie-signature", "Identifier": { "PURL": "pkg:npm/cookie-signature@1.0.7", "UID": "47723db89e73f0ab" }, "Version": "1.0.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/cookie-signature/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "debug@2.6.9", "Name": "debug", "Identifier": { "PURL": "pkg:npm/debug@2.6.9", "UID": "f885b8342535d864" }, "Version": "2.6.9", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/body-parser/node_modules/debug/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "debug@2.6.9", "Name": "debug", "Identifier": { "PURL": "pkg:npm/debug@2.6.9", "UID": "58c3ceabd75bdad4" }, "Version": "2.6.9", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/compression/node_modules/debug/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "debug@2.6.9", "Name": "debug", "Identifier": { "PURL": "pkg:npm/debug@2.6.9", "UID": "d3288b24184b9d9d" }, "Version": "2.6.9", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/express/node_modules/debug/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "debug@2.6.9", "Name": "debug", "Identifier": { "PURL": "pkg:npm/debug@2.6.9", "UID": "ff6ca18a36685e1a" }, "Version": "2.6.9", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/finalhandler/node_modules/debug/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "debug@2.6.9", "Name": "debug", "Identifier": { "PURL": "pkg:npm/debug@2.6.9", "UID": "d67b298e64a44530" }, "Version": "2.6.9", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/send/node_modules/debug/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "depd@2.0.0", "Name": "depd", "Identifier": { "PURL": "pkg:npm/depd@2.0.0", "UID": "86f35a425070f524" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/depd/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "destroy@1.2.0", "Name": "destroy", "Identifier": { "PURL": "pkg:npm/destroy@1.2.0", "UID": "803bceaed4d6dbf9" }, "Version": "1.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/destroy/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "detect-libc@2.1.2", "Name": "detect-libc", "Identifier": { "PURL": "pkg:npm/detect-libc@2.1.2", "UID": "1889fea1cb41153d" }, "Version": "2.1.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/detect-libc/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "dns-packet@5.6.1", "Name": "dns-packet", "Identifier": { "PURL": "pkg:npm/dns-packet@5.6.1", "UID": "f694d5d9b2721846" }, "Version": "5.6.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/dns-packet/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "dunder-proto@1.0.1", "Name": "dunder-proto", "Identifier": { "PURL": "pkg:npm/dunder-proto@1.0.1", "UID": "7da26877f5268d13" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/dunder-proto/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ee-first@1.1.1", "Name": "ee-first", "Identifier": { "PURL": "pkg:npm/ee-first@1.1.1", "UID": "ab61617d96ea8d68" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/ee-first/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "encodeurl@2.0.0", "Name": "encodeurl", "Identifier": { "PURL": "pkg:npm/encodeurl@2.0.0", "UID": "2dfbd6d8e4a634ed" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/encodeurl/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "es-define-property@1.0.1", "Name": "es-define-property", "Identifier": { "PURL": "pkg:npm/es-define-property@1.0.1", "UID": "a15a72494b6d8239" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/es-define-property/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "es-errors@1.3.0", "Name": "es-errors", "Identifier": { "PURL": "pkg:npm/es-errors@1.3.0", "UID": "220f22b5a4ca93dd" }, "Version": "1.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/es-errors/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "es-object-atoms@1.1.2", "Name": "es-object-atoms", "Identifier": { "PURL": "pkg:npm/es-object-atoms@1.1.2", "UID": "7b0ef9f0b5321faf" }, "Version": "1.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/es-object-atoms/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "escape-html@1.0.3", "Name": "escape-html", "Identifier": { "PURL": "pkg:npm/escape-html@1.0.3", "UID": "9291dd2318507459" }, "Version": "1.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/escape-html/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "etag@1.8.1", "Name": "etag", "Identifier": { "PURL": "pkg:npm/etag@1.8.1", "UID": "7387fb6decb26f47" }, "Version": "1.8.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/etag/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "express@4.22.2", "Name": "express", "Identifier": { "PURL": "pkg:npm/express@4.22.2", "UID": "5e5bf713040ab504" }, "Version": "4.22.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/express/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "fast-deep-equal@3.1.3", "Name": "fast-deep-equal", "Identifier": { "PURL": "pkg:npm/fast-deep-equal@3.1.3", "UID": "e122c6fb273f9fbb" }, "Version": "3.1.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/fast-deep-equal/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "finalhandler@1.3.2", "Name": "finalhandler", "Identifier": { "PURL": "pkg:npm/finalhandler@1.3.2", "UID": "1864fae80dad2070" }, "Version": "1.3.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/finalhandler/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "finetic@0.1.92", "Name": "finetic", "Identifier": { "PURL": "pkg:npm/finetic@0.1.92", "UID": "f9edc6e65197f7f0" }, "Version": "0.1.92", "Licenses": [ "SEE LICENSE IN LICENSE" ], "Layer": { "DiffID": "sha256:a90fdd1491bbbbbb6935b02b0278000af1ac8528216740d10d2922d8893840f4" }, "FilePath": "opt/finetic/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "forwarded@0.2.0", "Name": "forwarded", "Identifier": { "PURL": "pkg:npm/forwarded@0.2.0", "UID": "cbb0f231fe783108" }, "Version": "0.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/forwarded/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "fresh@0.5.2", "Name": "fresh", "Identifier": { "PURL": "pkg:npm/fresh@0.5.2", "UID": "75049fdb45899a38" }, "Version": "0.5.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/fresh/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "function-bind@1.1.2", "Name": "function-bind", "Identifier": { "PURL": "pkg:npm/function-bind@1.1.2", "UID": "7ded48dfd7384625" }, "Version": "1.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/function-bind/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "get-intrinsic@1.3.0", "Name": "get-intrinsic", "Identifier": { "PURL": "pkg:npm/get-intrinsic@1.3.0", "UID": "8b8d7428bce13a44" }, "Version": "1.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/get-intrinsic/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "get-proto@1.0.1", "Name": "get-proto", "Identifier": { "PURL": "pkg:npm/get-proto@1.0.1", "UID": "bea9953c4016c096" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/get-proto/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "gopd@1.2.0", "Name": "gopd", "Identifier": { "PURL": "pkg:npm/gopd@1.2.0", "UID": "a5471a4f173c5f3" }, "Version": "1.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/gopd/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "has-symbols@1.1.0", "Name": "has-symbols", "Identifier": { "PURL": "pkg:npm/has-symbols@1.1.0", "UID": "4c582c0668a645f2" }, "Version": "1.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/has-symbols/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "hasown@2.0.4", "Name": "hasown", "Identifier": { "PURL": "pkg:npm/hasown@2.0.4", "UID": "3c2ce1efbaa51ddc" }, "Version": "2.0.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/hasown/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "http-errors@2.0.1", "Name": "http-errors", "Identifier": { "PURL": "pkg:npm/http-errors@2.0.1", "UID": "d508e8f920661743" }, "Version": "2.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/http-errors/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "iconv-lite@0.4.24", "Name": "iconv-lite", "Identifier": { "PURL": "pkg:npm/iconv-lite@0.4.24", "UID": "c6e2f1d675c175e1" }, "Version": "0.4.24", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/iconv-lite/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "inherits@2.0.4", "Name": "inherits", "Identifier": { "PURL": "pkg:npm/inherits@2.0.4", "UID": "abe5fbec38486912" }, "Version": "2.0.4", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/inherits/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ipaddr.js@1.9.1", "Name": "ipaddr.js", "Identifier": { "PURL": "pkg:npm/ipaddr.js@1.9.1", "UID": "d1417da851d89311" }, "Version": "1.9.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/ipaddr.js/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "math-intrinsics@1.1.0", "Name": "math-intrinsics", "Identifier": { "PURL": "pkg:npm/math-intrinsics@1.1.0", "UID": "56ea431be739fa91" }, "Version": "1.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/math-intrinsics/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "maxmind@5.0.6", "Name": "maxmind", "Identifier": { "PURL": "pkg:npm/maxmind@5.0.6", "UID": "7cfe915e54f1b98f" }, "Version": "5.0.6", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/maxmind/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "media-typer@0.3.0", "Name": "media-typer", "Identifier": { "PURL": "pkg:npm/media-typer@0.3.0", "UID": "6d66372b3a14248e" }, "Version": "0.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/media-typer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "merge-descriptors@1.0.3", "Name": "merge-descriptors", "Identifier": { "PURL": "pkg:npm/merge-descriptors@1.0.3", "UID": "f02c88e4ade06357" }, "Version": "1.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/merge-descriptors/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "methods@1.1.2", "Name": "methods", "Identifier": { "PURL": "pkg:npm/methods@1.1.2", "UID": "81ad995da6340717" }, "Version": "1.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/methods/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "mime@1.6.0", "Name": "mime", "Identifier": { "PURL": "pkg:npm/mime@1.6.0", "UID": "863202ed799c5a93" }, "Version": "1.6.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/mime/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "mime-db@1.52.0", "Name": "mime-db", "Identifier": { "PURL": "pkg:npm/mime-db@1.52.0", "UID": "c4f3f92ba6886d29" }, "Version": "1.52.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/mime-db/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "mime-types@2.1.35", "Name": "mime-types", "Identifier": { "PURL": "pkg:npm/mime-types@2.1.35", "UID": "945161e9915e4b25" }, "Version": "2.1.35", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/mime-types/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "mmdb-lib@3.0.2", "Name": "mmdb-lib", "Identifier": { "PURL": "pkg:npm/mmdb-lib@3.0.2", "UID": "1d3a0f5205471dbb" }, "Version": "3.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/mmdb-lib/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ms@2.0.0", "Name": "ms", "Identifier": { "PURL": "pkg:npm/ms@2.0.0", "UID": "a3880677f38195cd" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/body-parser/node_modules/ms/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ms@2.0.0", "Name": "ms", "Identifier": { "PURL": "pkg:npm/ms@2.0.0", "UID": "a99587696999aafd" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/compression/node_modules/ms/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ms@2.0.0", "Name": "ms", "Identifier": { "PURL": "pkg:npm/ms@2.0.0", "UID": "b0d621ce1144571b" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/express/node_modules/ms/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ms@2.0.0", "Name": "ms", "Identifier": { "PURL": "pkg:npm/ms@2.0.0", "UID": "f6f28ff02a6fefb" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/finalhandler/node_modules/ms/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ms@2.0.0", "Name": "ms", "Identifier": { "PURL": "pkg:npm/ms@2.0.0", "UID": "3247cb16ad8fd286" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/send/node_modules/debug/node_modules/ms/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "ms@2.1.3", "Name": "ms", "Identifier": { "PURL": "pkg:npm/ms@2.1.3", "UID": "abf57af43cce24ac" }, "Version": "2.1.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/ms/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "multicast-dns@7.2.5", "Name": "multicast-dns", "Identifier": { "PURL": "pkg:npm/multicast-dns@7.2.5", "UID": "56eb502c50b21544" }, "Version": "7.2.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/multicast-dns/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "negotiator@0.6.3", "Name": "negotiator", "Identifier": { "PURL": "pkg:npm/negotiator@0.6.3", "UID": "94cf699f1eb26466" }, "Version": "0.6.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/negotiator/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "negotiator@0.6.4", "Name": "negotiator", "Identifier": { "PURL": "pkg:npm/negotiator@0.6.4", "UID": "279b2962e5c907ad" }, "Version": "0.6.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/compression/node_modules/negotiator/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "nodemailer@9.0.3", "Name": "nodemailer", "Identifier": { "PURL": "pkg:npm/nodemailer@9.0.3", "UID": "5f321228ee37ac37" }, "Version": "9.0.3", "Licenses": [ "MIT-0" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/nodemailer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "object-inspect@1.13.4", "Name": "object-inspect", "Identifier": { "PURL": "pkg:npm/object-inspect@1.13.4", "UID": "5198cc6d8ea06da1" }, "Version": "1.13.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/object-inspect/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "on-finished@2.4.1", "Name": "on-finished", "Identifier": { "PURL": "pkg:npm/on-finished@2.4.1", "UID": "de6793ad92cb8ec6" }, "Version": "2.4.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/on-finished/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "on-headers@1.1.0", "Name": "on-headers", "Identifier": { "PURL": "pkg:npm/on-headers@1.1.0", "UID": "473914144119af93" }, "Version": "1.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/on-headers/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "parseurl@1.3.3", "Name": "parseurl", "Identifier": { "PURL": "pkg:npm/parseurl@1.3.3", "UID": "d47e4bff04a76c6e" }, "Version": "1.3.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/parseurl/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "path-to-regexp@0.1.13", "Name": "path-to-regexp", "Identifier": { "PURL": "pkg:npm/path-to-regexp@0.1.13", "UID": "b7f0aac387c92a3b" }, "Version": "0.1.13", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/path-to-regexp/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg@8.22.0", "Name": "pg", "Identifier": { "PURL": "pkg:npm/pg@8.22.0", "UID": "b43236478d523db6" }, "Version": "8.22.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/pg/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg-cloudflare@1.4.0", "Name": "pg-cloudflare", "Identifier": { "PURL": "pkg:npm/pg-cloudflare@1.4.0", "UID": "ad0ceab06fc5a7b2" }, "Version": "1.4.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/pg-cloudflare/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg-connection-string@2.14.0", "Name": "pg-connection-string", "Identifier": { "PURL": "pkg:npm/pg-connection-string@2.14.0", "UID": "96075bf6b49a8c30" }, "Version": "2.14.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/pg-connection-string/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg-int8@1.0.1", "Name": "pg-int8", "Identifier": { "PURL": "pkg:npm/pg-int8@1.0.1", "UID": "5804afc40a75cb21" }, "Version": "1.0.1", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/pg-int8/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg-pool@3.14.0", "Name": "pg-pool", "Identifier": { "PURL": "pkg:npm/pg-pool@3.14.0", "UID": "ce6c2c110b8f414c" }, "Version": "3.14.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/pg-pool/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg-protocol@1.15.0", "Name": "pg-protocol", "Identifier": { "PURL": "pkg:npm/pg-protocol@1.15.0", "UID": "8ce761efec035eaa" }, "Version": "1.15.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/pg-protocol/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pg-types@2.2.0", "Name": "pg-types", "Identifier": { "PURL": "pkg:npm/pg-types@2.2.0", "UID": "8250f6d9743a9b70" }, "Version": "2.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/pg-types/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "pgpass@1.0.5", "Name": "pgpass", "Identifier": { "PURL": "pkg:npm/pgpass@1.0.5", "UID": "dabcb75803eb9f9" }, "Version": "1.0.5", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/pgpass/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "postgres-array@2.0.0", "Name": "postgres-array", "Identifier": { "PURL": "pkg:npm/postgres-array@2.0.0", "UID": "5a52aae6ce899d20" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/postgres-array/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "postgres-bytea@1.0.1", "Name": "postgres-bytea", "Identifier": { "PURL": "pkg:npm/postgres-bytea@1.0.1", "UID": "a23df0e93ff5aa4c" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/postgres-bytea/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "postgres-date@1.0.7", "Name": "postgres-date", "Identifier": { "PURL": "pkg:npm/postgres-date@1.0.7", "UID": "30288752ea9405a6" }, "Version": "1.0.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/postgres-date/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "postgres-interval@1.2.0", "Name": "postgres-interval", "Identifier": { "PURL": "pkg:npm/postgres-interval@1.2.0", "UID": "69e469306fe4b3ae" }, "Version": "1.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/postgres-interval/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "proxy-addr@2.0.7", "Name": "proxy-addr", "Identifier": { "PURL": "pkg:npm/proxy-addr@2.0.7", "UID": "33ae05e894bfd21" }, "Version": "2.0.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/proxy-addr/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "qs@6.15.3", "Name": "qs", "Identifier": { "PURL": "pkg:npm/qs@6.15.3", "UID": "5b6b44d090e40e41" }, "Version": "6.15.3", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/qs/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "range-parser@1.2.1", "Name": "range-parser", "Identifier": { "PURL": "pkg:npm/range-parser@1.2.1", "UID": "752ae5d5f3845dd5" }, "Version": "1.2.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/range-parser/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "raw-body@2.5.3", "Name": "raw-body", "Identifier": { "PURL": "pkg:npm/raw-body@2.5.3", "UID": "e190a082eed83cbb" }, "Version": "2.5.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/raw-body/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "safe-buffer@5.2.1", "Name": "safe-buffer", "Identifier": { "PURL": "pkg:npm/safe-buffer@5.2.1", "UID": "13741e3dc465c7ef" }, "Version": "5.2.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/safe-buffer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "safer-buffer@2.1.2", "Name": "safer-buffer", "Identifier": { "PURL": "pkg:npm/safer-buffer@2.1.2", "UID": "89c6cb53ead2893c" }, "Version": "2.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/safer-buffer/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "semver@7.8.5", "Name": "semver", "Identifier": { "PURL": "pkg:npm/semver@7.8.5", "UID": "d81ae9d9de7b2053" }, "Version": "7.8.5", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/sharp/node_modules/semver/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "send@0.19.2", "Name": "send", "Identifier": { "PURL": "pkg:npm/send@0.19.2", "UID": "4cb9a5f31f180013" }, "Version": "0.19.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/send/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "serve-static@1.16.3", "Name": "serve-static", "Identifier": { "PURL": "pkg:npm/serve-static@1.16.3", "UID": "ec0432cade8b5fb7" }, "Version": "1.16.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/serve-static/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "setprototypeof@1.2.0", "Name": "setprototypeof", "Identifier": { "PURL": "pkg:npm/setprototypeof@1.2.0", "UID": "364fe830912d7b02" }, "Version": "1.2.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/setprototypeof/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "sharp@0.35.3", "Name": "sharp", "Identifier": { "PURL": "pkg:npm/sharp@0.35.3", "UID": "cf22b9c65460235b" }, "Version": "0.35.3", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/sharp/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "side-channel@1.1.1", "Name": "side-channel", "Identifier": { "PURL": "pkg:npm/side-channel@1.1.1", "UID": "c74adf5c943456e5" }, "Version": "1.1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/side-channel/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "side-channel-list@1.0.1", "Name": "side-channel-list", "Identifier": { "PURL": "pkg:npm/side-channel-list@1.0.1", "UID": "8f61b22130093d83" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/side-channel-list/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "side-channel-map@1.0.1", "Name": "side-channel-map", "Identifier": { "PURL": "pkg:npm/side-channel-map@1.0.1", "UID": "d8381350ed7c7071" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/side-channel-map/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "side-channel-weakmap@1.0.2", "Name": "side-channel-weakmap", "Identifier": { "PURL": "pkg:npm/side-channel-weakmap@1.0.2", "UID": "72b6361961fc00e8" }, "Version": "1.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/side-channel-weakmap/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "split2@4.2.0", "Name": "split2", "Identifier": { "PURL": "pkg:npm/split2@4.2.0", "UID": "2ead325a6a3bd153" }, "Version": "4.2.0", "Licenses": [ "ISC" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/split2/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "statuses@2.0.2", "Name": "statuses", "Identifier": { "PURL": "pkg:npm/statuses@2.0.2", "UID": "384c79e48d3b5c86" }, "Version": "2.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/statuses/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "thunky@1.1.0", "Name": "thunky", "Identifier": { "PURL": "pkg:npm/thunky@1.1.0", "UID": "97733893c4c4fb97" }, "Version": "1.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/thunky/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "tiny-lru@13.0.0", "Name": "tiny-lru", "Identifier": { "PURL": "pkg:npm/tiny-lru@13.0.0", "UID": "be5f0b5ab2999831" }, "Version": "13.0.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/tiny-lru/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "toidentifier@1.0.1", "Name": "toidentifier", "Identifier": { "PURL": "pkg:npm/toidentifier@1.0.1", "UID": "aced475621ae7d38" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/toidentifier/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "type-is@1.6.18", "Name": "type-is", "Identifier": { "PURL": "pkg:npm/type-is@1.6.18", "UID": "a6ae13a9eac32d7b" }, "Version": "1.6.18", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/type-is/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "unpipe@1.0.0", "Name": "unpipe", "Identifier": { "PURL": "pkg:npm/unpipe@1.0.0", "UID": "e2a86638367cf736" }, "Version": "1.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/unpipe/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "utils-merge@1.0.1", "Name": "utils-merge", "Identifier": { "PURL": "pkg:npm/utils-merge@1.0.1", "UID": "4d19017750a10265" }, "Version": "1.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/utils-merge/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "vary@1.1.2", "Name": "vary", "Identifier": { "PURL": "pkg:npm/vary@1.1.2", "UID": "40bbe5258c87bfe1" }, "Version": "1.1.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/vary/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "xtend@4.0.2", "Name": "xtend", "Identifier": { "PURL": "pkg:npm/xtend@4.0.2", "UID": "6d2f08e92c29ed6d" }, "Version": "4.0.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:9a73ac3e57cd823caaf4b30a533431861f9a18c83f5e949444680f9da7f63f03" }, "FilePath": "opt/finetic/node_modules/xtend/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "yarn@1.22.22", "Name": "yarn", "Identifier": { "PURL": "pkg:npm/yarn@1.22.22", "UID": "a475ae636b391b4" }, "Version": "1.22.22", "Licenses": [ "BSD-2-Clause" ], "Layer": { "Digest": "sha256:15f27b93c93d3aaa4df09438a96bad3709b6cbbc38659014d17cc61d8d4fabb9", "DiffID": "sha256:625ca884ca91515900d06a970e88957ac4d2e8963c4a0cc699e069ef7e3c7371" }, "FilePath": "opt/yarn-v1.22.22/package.json", "AnalyzedBy": "node-pkg" } ] } ] }